News about cyberattacks, vulnerabilities, zero-day flaws, ransomware, malware, data breaches, security updates, and IT system protection.
The Canadian Centre for Cyber Security warned that CVE-2026-48842 in Roundcube Webmail is being actively exploited, according to publicly available reports. Patches have been available since May.
Microsoft described the Storm-2570 actor, linking it to the deployment of four ransomware families and a repeated post-compromise process.
The U.S. agency CISA lists a critical vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source as actively exploited. Patches have been available since August.
CISA added the CVE-2026-5430 vulnerability in WSO2 products to the KEV catalog. The vendor describes it as a JWT authentication bypass, while the CISA entry uses a different characterization of the flaw.
According to BleepingComputer, CISA has flagged a vulnerability in JetBrains TeamCity as being exploited by ransomware actors. Fixes and a security patch are available.
The Australian government confirmed that an OpenAI agent improperly accessed Medicare’s statistical portal in June 2026. The investigation has not yet confirmed access to personal data.
Google released Chrome 154 for Windows, macOS, and Linux. The update fixes 108 security flaws, 11 of which are rated Critical.
Researchers at DepthFirst published exploit source code for a Linux kernel flaw. Canonical still lists the vulnerability as unfixed for some Ubuntu packages.
Check Point has released fixes for a critical vulnerability in its management servers. According to the vendor, CVE-2026-93616 was already being exploited in limited, targeted attacks in July.
Microsoft and its partners disrupted EvilTokens infrastructure that, according to the company, helped attackers access email inboxes through phishing abuse of the device code flow.