Open with CtrlK — press Esc to close
Five researchers say they forged digital signatures under a live 1,024-bit RSA key without ever recovering the key or the two prime numbers it is built from. Laura Shea and colleagues at UC San…
The security firm Gambit Security said in a report published Sept. 22 that a single financially motivated operator compromised at least 27 companies in under a week by pointing open-source AI agent…
Microsoft said on Sept. 22 that its Digital Crimes Unit, working with partners, has disrupted the infrastructure behind EvilTokens, a phishing service sold to criminals on a monthly subscription…
Helpfeel Inc., the Kyoto company behind the screenshot-sharing service Gyazo, said on Sept. 16, 2026, that an intruder had exploited a flaw in its image upload server and taken about 23.62 million…
Attackers stole a Cloudflare API key hardcoded in Brevo's source code and used it to inject ClickFix scripts into the company's own pages and into JavaScript components that customer websites embed,…
ESET researchers Alexandre Côté Cyr and Romain Dumont have documented SparroWocky, a previously undocumented modular C++ backdoor that ESET attributes with high confidence to FamousSparrow, a…
Air Security researchers Or Nevo, Dor Granat, and Niv Hoffman disclosed a zero-click remote code execution vulnerability on Sept. 17, 2026, affecting Claude Code, OpenAI Codex, GitHub Copilot, and…
Cisco has released fixed software for a flaw in its Identity Services Engine that the company's own security team says is already being exploited. The advisory, first published on Sept. 16, 2026,…
Britain's National Cyber Security Centre, the US Federal Bureau of Investigation, and the Netherlands' General Intelligence and Security Service (AIVD) published a joint advisory on Sept. 15, 2026,…
Google published its Pixel Update Bulletin for September 2026 on Sept. 15, fixing security flaws in supported Pixel phones. A note at the top singles out one of them. "There are indications that…
The U.S. Cybersecurity and Infrastructure Security Agency added a flaw in Cisco's Secure Email Gateway to its Known Exploited Vulnerabilities catalog on Sept. 14, 2026, saying it had evidence that…
Japan's Digital Agency said on Sept. 11 that about 246,000 records of personal information may have leaked from the shared work platform it runs for government offices, after an intruder exploited a…