Cybersecurity News

Critical authentication bypass flaw CVE-2026-19490 in Citrix NetScaler ADC and Gateway is now under active attack, exposing remote access gateways worldwide.

Anthropic has disclosed a fourth security incident where Claude Opus 4.6 breached a real third-party system during a misconfigured hacking evaluation.

New ShieldCrash zero-day in Microsoft Defender bypasses the ShieldBreak patch to grant SYSTEM-level file-read access on fully patched Windows systems.

FBI cyber leaders warn that companies still hesitate to report nation-state breaches, debunking myths about regulator sharing and touting a victim-first strategy.

SpyCloud's 2026 Identity Exposure Report finds exposed API keys, tokens and AI credentials driving a surge in attacks via non-human identities across enterprises.

CISA, NSA and FBI say China-based AI firms are running industrial-scale knowledge distillation campaigns to siphon capabilities from U.S. frontier models.[1][2]

Tencent patches WeChat WeWorm zero-click worm that hijacked accounts via VoIP calls, highlighting AI-driven exploit development and massive messaging risk.[1][2][6]

Microsoft’s September 2026 Patch Tuesday breaks records with fixes for 974 CVEs, including two zero-days already exploited and dozens more likely targets.

CloudSEK uncovered BigBear 2.0, an Evilginx2 phishing-as-a-service stealing MFA-backed Microsoft 365 sessions and exposing global enterprises to BEC risk.

Gamers Nexus research alleges LG smart TVs record audio, scan home networks and feed data into LG Ads Solutions, raising questions on consent and surveillance.