CTM360 has documented a wave of fake gift card giveaways in which scammers impersonate well-known brands and celebrities to draw in consumers. The campaigns use bogus verification steps to harvest personal information and enroll victims in unwanted subscriptions, then monetize the resulting traffic through affiliate networks. For security and brand teams, the findings show how trusted names can be exploited at low cost to fuel fraud, and how affiliate-style revenue models keep such schemes profitable and persistent.
SonicWall has released security updates fixing seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass that has already been exploited in attacks. The flaw can let attackers circumvent MFA on SSL-VPN access, weakening a key remote-access control. Organizations running affected SonicWall firewalls should treat the issue as urgent and apply the vendor’s fixes promptly.
QNAP is warning customers that attackers are exploiting a vulnerability chain dubbed Plex2Shell to breach its network-attached storage devices. Users are being urged to install the newest version of Plex Media Server from the QNAP App Center. The warning matters for anyone running Plex on QNAP hardware, since unpatched devices may be exposed to active attacks.
OpenAI has introduced GPT-6 Cyber, an AI model that identified 81 previously unknown high-severity Firefox vulnerabilities and produced working exploits for 948 distinct Linux kernel flaws. The results point to a significant leap in AI-assisted vulnerability discovery and exploit development at scale. For security teams, this raises the urgency of faster patching and defensive review, while also highlighting the dual-use risks of increasingly capable cyber models.
Zyxel has released a patch for a zero-day flaw affecting its GS1900 series network switches after attackers exploited it to compromise almost 1,000 devices globally. The intrusions allowed theft of configuration files and credentials, raising the risk of further access or lateral movement. Administrators should prioritize patching exposed switches and review for signs of compromise, especially where sensitive credentials may have been exposed.
Attackers began attempting to exploit a newly disclosed OpenSSH vulnerability within hours of its disclosure, according to Previdian. The flaw, tracked as CVE-2026-123158 with a CVSS score of 8.1 and nicknamed SSHole, can allow sign-ins to accounts that have no password set. In at least one honeypot case, exploitation led to root-level access, highlighting how quickly exposed SSH services can
A newly disclosed OpenSSH vulnerability lets attackers log in to certain Alpine Linux and other musl-based accounts that are configured to block password authentication, simply by entering an oversized password. It matters because it undermines a common hardening assumption, so administrators of affected musl-based systems should assess exposure and prioritize remediation.
A researcher at Picus Security, Umut Bayram, found that installing the patch for an actively exploited WordPress flaw can briefly leave sites vulnerable again. The updater unpacks the fix using the site's old, unpatched code, so an attacker could strike during that window. For defenders, this means patching alone may not close the exposure immediately, and the update process itself warrants scrutiny and monitoring.
OpenAI announced GPT-6 Cyber, a model it positions as a significant advance for security research, pairing stronger vulnerability-hunting and remediation capabilities with what it calls a step-change in alignment. The launch follows work in which AI-assisted analysis surfaced 81 Firefox flaws and 948 Linux exploits, according to the company's framing. For security teams, the pitch is a tool that can both find and fix weaknesses at scale—an appealing but double-edged proposition, since the same capability that hardens software could shorten the path for attackers. The emphasis on alignment signals OpenAI is trying to preempt concerns about releasing more potent offensive-capable tooling.
D-Link has disclosed multiple unpatched security vulnerabilities in its DGS-3130 series managed Gigabit stackable switches and published mitigation measures, but no firmware fix is available yet. Because the flaws remain unpatched, organizations running these switches in production networks face a window of exposure with only workarounds as protection. Administrators should review D-Link's guidance promptly and apply the mitigations while awaiting a permanent patch.
SonicWall has warned customers about two security flaws in its end-of-life Global Management System software that will not receive patches. Because the product is no longer supported, organizations still running it must rely on mitigations or migrate to a supported platform. The warning matters for security teams that may have overlooked legacy management infrastructure in their risk assessments.
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News ch
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature that lets people send tasks from their pho
CISA has warned federal agencies that a high-severity remote code execution vulnerability in WordPress, which was recently patched, is now being exploited in real-world attacks. The notice signals that attackers are already targeting unpatched installations, making routine patch delays risky. Organizations running WordPress should urgently confirm their version, apply the update, and check for signs of compromise.
Two flaws in Barracuda's Email Security Gateway can be chained to execute commands as root, the appliance's highest privilege level, without requiring a login. Barracuda released patches on Monday, and the security firm watchTowr detailed the attack chain. The unauthenticated root-level exposure makes timely patching important for organizations running this email-filtering appliance.
In October 2026, a new wave of cyber threats targeted US businesses by exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns matter because their impact extends beyond isolated security incidents and raises broader organizational risk. Security teams should view them as enterprise-level threats rather than one-off events.
VulnerabilitiesBreaches & IncidentsThreat IntelligenceRead more →
Cybersecurity researchers have detailed a now-patched flaw that allowed Lockdown Mode protections in ChatGPT to be bypassed, potentially exposing chats without any action from the user. Lockdown Mode was introduced in June 2026 as an optional setting meant to reduce certain risks for users who enable it. The bypass matters because it undercut a security control users had opted into, though the issue has since been fixed.
The article contends that a critical vulnerability can move through multiple security tools and still leave an organization exposed, even after it receives a severity score and a ticket reaches the queue. It argues progress stalls because findings often lack the context that determines action: who owns the affected system and whether attackers can realistically reach it. Five tests are offered for assessing whether an exposure management platform closes that gap or simply passes alerts along. For security teams, the takeaway is that scoring and ticketing alone do not demonstrate reduced risk.
OpenAI described a 30-hour run in which an upcoming cyber-focused model validated and patched 948 Linux local privilege-escalation vulnerabilities, at $1.2 million in API costs. The prototype screened 2,308 candidates before reaching that set. For security teams, it signals that AI-assisted vulnerability discovery and remediation can operate at industrial scale, though the expense and prototype status temper near-term operational expectations.
CISA added a medium-severity vulnerability affecting multiple Apple operating systems to its Known Exploited Vulnerabilities catalog on Wednesday, citing reports of active exploitation. According to the agency, attackers have been using the flaw to deliver information-stealing malware. The vulnerability has already been patched, so the addition signals that defenders should confirm remediation and treat unpatched Apple devices as exposed. Inclusion in the KEV catalog generally carries remediation deadlines for federal agencies and serves as a prioritization cue for other organizations.