The Edge of the Cyber World See the latest
The Federal Communications Commission handed the broadband and wireless industries a narrow but consequential win on September 23, 2026. The agency’s Office of Engineering and Technology (OET) granted expedited, one-year waivers to CTIA and USTelecom—The Broadband Association, letting suppliers serving their members make “necessary” hardware modifications to consumer routers and gateways that had already cleared…
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. The vulnerability was first exploited as a zero-day
As reports of OpenAI’s models breaking containment, hacking sites, and generally getting out of control pile up, the company has made the decision to pause training of its most powerful models. The decision was made after a model being tested within a sandbox exploited a loophole to gain internet access. The incident happened on September…
Three days after the extortion group ShinyHunters first claimed it had breached Federal Bureau of Investigation systems, the story has shifted from a raw numbers game (how many terabytes, how many agents) to something more pointed: motive. According to The Register, the group says the intrusion was retaliation against the Bureau, not a money grab.…
Security teams spend a strange amount of their week decoding things: a Base64 blob pasted from a phishing email, a hex-encoded PowerShell command pulled from an EDR alert, a JWT that someone swears is legitimate. Most of that work happens in a single browser tab running CyberChef, the “Cyber Swiss Army Knife” built and maintained…
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows – CVE-2026-65660 (CVSS score: 8.8) – A code injection vulnerability in Microsoft Office SharePoint
Wisconsin has signed on to a 44-state settlement with Laboratory Corporation of America Holdings, better known as Labcorp, closing the book on a 2019 data breach that exposed medical and financial records tied to more than 27.5 million people nationwide. State officials confirmed on September 24-25, 2026, that Wisconsin joins a coalition led by New…
Security teams keep running the same experiment: send a fake phishing email, count who clicks, then try to lower that number. The open-source tool most of them reach for is GoPhish, a self-hosted phishing simulation framework that has sat near the top of GitHub’s phishing-tools list for years and now carries roughly 14,200 stars on…
Bitget, one of the larger centralized cryptocurrency exchanges by trading volume, confirmed on September 24 and 25, 2026 that hackers moved roughly $351.6 million out of its wallet infrastructure in a coordinated backend attack. The exchange says it has preliminarily linked the intrusion to North Korean state-backed hacking groups, based on IP-address patterns and on-chain…
