News about cyberattacks, vulnerabilities, zero-day flaws, ransomware, malware, data breaches, security updates, and IT system protection.
Researchers at Calif demonstrated the WeWorm laboratory attack, which took over a WeChat account through an incoming call without victim interaction. Tencent said it fixed the vulnerability.
Researchers flagged a publicly accessible system containing travel and identification data linked to Vietnam. It has not been confirmed whether anyone copied or misused the data.
The new GrapheneOS 2026090700 build is currently available only in the Alpha channel. It fixes Private Space, updates hardened_malloc, and includes an extensive list of security fixes.
According to CloudSEK research, the BigBear 2.0 platform captures Microsoft 365 passwords and authenticated session cookies. This may give attackers access to an account even after standard MFA is completed.
Education platform Mathspace confirmed unauthorized access to its internal reporting system. The incident affects 1,079,819 people in Australia and New Zealand.
N-able released Hotfix 4 for CVE-2026-86218 in on-premises N-central installations. The vendor’s incident notice now reports exploitation in the wild, but its release notes remain contradictory.
Weverse confirmed the exposure of internal identifiers and transaction metadata involving 422,584 accounts. The company reported no exposure of payment card data, passwords, or contact information.
CERT Polska has confirmed active attacks against unpatched MikroTik routers with publicly accessible SSH. A chain of flaws allows attackers to gain administrator privileges without standard authentication.
Sansec has published additional technical details about the actively exploited StyleSmuggler vulnerability in Magento Open Source and Adobe Commerce. According to the analysis, the attack can lead to PHP code execution and the deployment of a persistent process on the server.
Google released a Chrome update fixing CVE-2026-85046 in V8, for which an in-the-wild exploit already exists. Opera also released a fix.