The Edge of the Cyber World See the latest
Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. “Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel,” Nozomi Networks said in…
South Korea’s financial regulator ordered every bank, card issuer, and savings institution in the country to inspect their externally exposed IT systems after a fast-moving wave of data breaches hit at least four major lenders in four days. The Financial Services Commission (FSC) issued the sector-wide directive on October 2, 2026, following disclosures from Shinhan…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding…
The Technical University of Denmark is no longer just counting records. Three days after disclosing that its DTUBasen identity database may have exposed data tied to up to 200,000 current and former users, DTU has handed the case to Denmark’s data protection authority and its national cybercrime police unit, turning a breach disclosure into a…
The Technical University of Denmark confirmed on October 2, 2026, that hackers broke into DTUBasen, the university’s central identity and access management system, and downloaded a large volume of personal data. In a public notification, DTU said information tied to as many as 200,000 current and former users may have been affected, a number that…
A ransomware group has put a dual-listed insurer on notice, and the insurer is pushing back on the word “confirmed.” On October 3, 2026, Insurance Business reported that Tower Limited, the New Zealand insurer known as Tower Insurance, is investigating a claim from a cyber-extortion group that says it stole company data. Tower told Stuff…
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. “In the
A Dutch national who allegedly went by the handle “Archduke” is now fighting extradition to the United States after a nine-country law enforcement sweep tore through the infrastructure of the KillSec ransomware-as-a-service operation. The suspect, identified by the U.S. Department of Justice as Fouad Eltibrizi, was arrested in the United Kingdom on September 30, 2026,…
A critical flaw in Fortinet’s FortiMail secure email gateway is now confirmed under active attack, and the window for patching it is shorter than almost any similar bug this year. CVE-2026-104286, rated 9.8 out of 10 on the CVSS scale, lets an unauthenticated attacker write arbitrary files to a vulnerable FortiMail appliance using nothing more…
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding…
