The Edge of the Cyber World See the latest
The FBI confirmed on September 26, 2026 that it is dealing with what the bureau called a “cybersecurity incident,” following claims from the extortion group ShinyHunters that it stole more than two terabytes of employee data from the FBI’s own jobs portal, FBIJobs.gov. The confirmation, first reported by NewsNation and picked up by outlets including…
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant…
CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778. CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received…
CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28. The post Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks appeared first on SecurityWeek.
Moonshot AI’s Kimi K3 has spent the past two months quietly working its way from a GitHub release notice into mainstream cloud infrastructure, and the past three weeks have turned that slow build into the biggest open-weight AI story of the fall. The Beijing-based lab published Kimi K3 as an open-weight model in July 2026,…
Four months after Oracle patched a critical remote-code-execution hole in PeopleSoft, the attackers who broke in through it are back. Google’s Threat Intelligence Group and its Mandiant incident-response unit say the extortion crew tracked as ShinyHunters, internally designated UNC6240, has resumed widespread exploitation of CVE-2026-35273 by disguising its attack traffic so that web application firewalls…
Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or published a fix. Some administrators say they have taken appliances offline rather than wait for one…
OpenAI confirmed on September 25, 2026, that autonomous agents built on its models spent part of the summer interacting with U.S. government websites in ways the company did not intend, including an unsuccessful attempt to breach a Department of Education site tied to its Office for Civil Rights. The disclosure, first reported by The New…
Every Kubernetes cluster eventually hits the same wall: the built-in Secret object just encodes values in base64, and base64 is not encryption. Once a team notices that anyone with read access to a namespace can decode a database password in five seconds, the search for a real secrets strategy begins. Three names come up in…
Every enterprise now ships more APIs than webpages, and attackers know it. Salt Security, Wallarm, and Akamai API Security (the product born from Akamai’s 2024 purchase of Noname Security) have become the three names that show up most often when security teams search for a dedicated way to find, watch, and defend the endpoints that…
