11+ hour, 45+ min ago   (997+ words) This week’s roundup covers a massive Microsoft Patch Tuesday with two exploited zero-days, active FortiGate exploitation, a critical PAN-OS root-level RCE flaw, the Revolut KYC data breach, and more than 20 other stories spanning AI-driven cyberattacks, browser and firewall zero-days, and…...

4+ day, 1+ hour ago   (707+ words) Hackers are using passkey-themed phishing to take control of Microsoft 365 accounts and collect cloud data. It can defeat MFA protections. The campaign starts with calls and texts to employees. Attackers pose as IT support, claim a passkey, MFA, or single…...

4+ day, 1+ hour ago   (324+ words) CISA added a critical Citrix NetScaler authentication bypass flaw (CVE-2026-19490) to its Known Exploited Vulnerabilities catalog after observing in-the-wild attacks targeting the issue. Federal civilian agencies must apply vendor mitigations by September 12, 2026. CVE-2026-19490 affects Citrix NetScaler ADC and NetScaler Gateway…...

4+ day, 50+ min ago   (630+ words) A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect…...

4+ day, 22+ hour ago   (850+ words) What makes N0va especially relevant for SOC leaders is how it spreads the attack across different layers. Legitimate authentication, trusted brand lures, compromised websites, and cloud infrastructure can leave security teams with only part of the picture, making it easier to…...

5+ day, 29+ min ago   (590+ words) ClearFake has expanded a fake CAPTCHA scam into a chain that steals cryptocurrency and credentials while disabling endpoint protection. It turns compromised websites into launchpads, relying on visitors to run a command that appears routine. The operation begins with injected…...

5+ day, 5+ hour ago   (425+ words) A newly published ShieldCrash proof of concept from researcher MSNightmare claims that Microsoft Defender remains vulnerable to an arbitrary file-read flaw, despite Microsoft’s earlier fix for ShieldBreak, tracked as CVE-2026-69414. The researcher says the issue could let a local attacker…...

5+ day, 7+ hour ago   (1517+ words) Patching remains the single highest-value security control most organizations execute badly. Automox leads on cloud-native simplicity, Tanium on speed at enormous scale, and Action1 offers something rare in enterprise software a genuinely free tier for smaller estates. Adopting modern patch management…...

5+ day, 4+ hour ago   (355+ words) Microsoft has disclosed a new security flaw in Windows BitLocker, the operating system’s built-in disk encryption feature, that could let an attacker execute malicious code on a vulnerable device. Tracked as CVE-2026-69449 and published on September 8, 2026, the vulnerability stems from…...

5+ day, 20+ hour ago   (433+ words) Microsoft released its September 2026 Patch Tuesday security updates on September 8, addressing 973 vulnerabilities, including two zero-days already exploited in attacks. Microsoft’s release notes attribute 723 addressed vulnerabilities to Windows, 111 to Office, 62 to SQL, 22 to developer tools, 16 to SharePoint Server, and nine to…...