The Edge of the Cyber World See the latest
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. “Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence…
Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackle the risk online ad data poses to troops, and more.
A settlement has resolved one of the largest healthcare data breach lawsuits still working through the U.S. court system. The HIPAA Journal reported on September 3, 2026 that Managed Care of North America, Inc. (MCNA) has agreed to a multi-million-dollar settlement fund closing out class action litigation tied to a 2023 ransomware attack that hit…
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as…
A misconfigured server does not announce itself. It just sits there, quietly accepting the default settings a vendor shipped it with, until someone finds the gap. The Verizon 2026 Data Breach Investigations Report found that software vulnerability exploitation has overtaken stolen credentials as the top initial access vector in confirmed breaches, appearing in roughly 31%…
Thomson Reuters disclosed on September 2, 2026, that an unauthorized party accessed files from its C-Track court case management platform, exposing sensitive records tied to courts in 11 US states, the US Virgin Islands, and three courts in Ontario, Canada. The disclosure lands in the same week as reporting on a separate 153 million driver’s…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security…
Enterprise technology buyers spent the first week of September 2026 recalibrating their AI roadmaps after OpenAI CEO Sam Altman told reporters at the G20 Innovation Ministerial that the company’s next generation of models will be “sobering for everybody.” The remark, paired with an admission that OpenAI is deliberately slowing how fast it ships new capability,…
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are – CVE-2026-14894 (CVSS score: 9.8) – A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of…
Session hijacking has quietly become the top way attackers get into corporate accounts in 2026, and it works whether or not you have MFA turned on. A single infostealer infection now yields an average of 44 passwords but 1,861 cookies, according to password and passkey usage research published in mid-2026, and cookies are what attackers…
