The Edge of the Cyber World See the latest
A container running a web app spawns a shell at 3 a.m. Nobody logged in. No deploy went out. That single event, caught by a kernel-level watcher instead of a human scrolling logs, is the entire pitch behind Falco, the CNCF-graduated runtime security tool that has become the default answer to “how do we know…
Meta said on October 2, 2026, that its Muse Spark AI models helped mathematicians crack six research-level problems spanning probability, differential equations, group theory, optimization, arithmetic physics, and non-associative algebra. Five of the six papers answer questions that had been open in their respective fields, according to Meta’s research blog. The company paired the math…
South Korea’s financial regulator ordered every bank, card issuer, and savings institution in the country to inspect their externally exposed IT systems after a fast-moving wave of data breaches hit at least four major lenders in four days. The Financial Services Commission (FSC) issued the sector-wide directive on October 2, 2026, following disclosures from Shinhan…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding…
The Technical University of Denmark is no longer just counting records. Three days after disclosing that its DTUBasen identity database may have exposed data tied to up to 200,000 current and former users, DTU has handed the case to Denmark’s data protection authority and its national cybercrime police unit, turning a breach disclosure into a…
The Technical University of Denmark confirmed on October 2, 2026, that hackers broke into DTUBasen, the university’s central identity and access management system, and downloaded a large volume of personal data. In a public notification, DTU said information tied to as many as 200,000 current and former users may have been affected, a number that…
A ransomware affiliate gets a foothold on a mid-size company’s network on a Friday night. By Monday, the incident response team needs answers from 400 endpoints: which machines talked to the command-and-control server, what persistence mechanisms got dropped, and whether the attacker touched the file server. Pulling that picture together with ad hoc scripts and…
Vercel confirmed on October 3, 2026, that it had verified a KVM zero-day vulnerability allowing a guest virtual machine to break out and seize root access on the host, a flaw the company’s own CEO called a hit against “the industry’s gold standard solution for Linux virtualization.” The report came through Vercel’s Sandbox bug bounty…
A ransomware group has put a dual-listed insurer on notice, and the insurer is pushing back on the word “confirmed.” On October 3, 2026, Insurance Business reported that Tower Limited, the New Zealand insurer known as Tower Insurance, is investigating a claim from a cyber-extortion group that says it stole company data. Tower told Stuff…
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. “In the
