Threat actors began exploiting CVE-2026-85706 in GitLab just one day after public disclosure, taking advantage of a critical path traversal flaw that can let unauthenticated users read arbitrary files. WatchTowr also reported that mass exploitation is likely soon, while GitLab’s latest patches additionally fix CVE-2026-87719 and several other serious vulnerabilities. #GitLab…
Category: Cyber Security News
Pistachio’s large-scale phishing simulation study shows that phishing risk varies widely by industry and team, with tech, IT, and construction employees performing notably worse than financial services. The report stresses that in-house phishing tests should measure not just clicks, but also credential leakage and reporting, because low click rates can still…
GitLab urged users to immediately patch a maximum-severity path traversal flaw, CVE-2026-85706, that could let unauthenticated attackers read arbitrary data from vulnerable servers under certain conditions. The company also fixed CVE-2026-87719 in GitLab EE, while watchTowr reported early probing activity against exposed GitLab systems and warned defenders to check logs for suspicious API requests. #GitLab #CVE-2026-85706 #CVE-2026-87719 #watchTowr
Attackers are abusing trusted AI platform features like Claude Artifacts, claude.ai/share links, ChatGPT, and Grok conversations to lure victims into downloading malware or running malicious commands. Huntress says campaigns such as FakeAgent, MacSync, and AMOS show how search poisoning and platform trust can be weaponized against users, even on real domains. #Claude #ChatGPT #Grok #FakeAgent #SectopRAT #MacSync #AMOS #Anthropic #Huntress
Threat actors are chaining critical JFrog Artifactory vulnerabilities to bypass authentication, escalate to administrator access, and deploy a Rust-based backdoor on self-hosted servers. Wiz reported active exploitation across multiple environments, with attackers creating rogue accounts, stealing data, and maintaining persistence in minutes. #JFrogArtifactory #CVE202642018 #CVE202642016 #CVE202682329 #Wiz #watchTowr
SecurityWeek’s roundup covers a wide range of cybersecurity developments, from phishing evasion using invisible Unicode and an actively exploited WordPress Super Forms flaw to new US sanctions and a bounty targeting Iranian cyber official Amir Yaryab. It also highlights consent phishing, SIM swapping, cybercrime infrastructure, InjectEave side-channel attacks, and scrutiny of…
Kiteworks has acquired Bonfy.AI to extend runtime data governance across its control plane, enabling policy enforcement at the moment sensitive data is exchanged by people, machines, or AI agents. The combined platform closes the gap between data discovery and real-time control, helping enterprises govern data in motion, reduce false positives, and prove compliance across systems like Outlook, Gmail, OneDrive, SharePoint, Workspace, and Salesforce. #Kiteworks #BonfyAI #CMMC20 #HIPAA #GDPR
IDScan.net has confirmed that an unauthorized party may have accessed customer data on its cloud platform, including names and driver’s license or other government-issued identification numbers. The disclosure follows reports that a dark web marketplace called Nexus was offering millions of scanned identity documents, prompting an FBI investigation into the leak. #IDScan.net #Nexus #FBI #Exploit #BrianKrebs
GreyNoise says an attacker built and tested exploits for PaperCut NG/MF vulnerabilities in a private lab, then used AI agents to automate mass compromise efforts against organizations worldwide. The campaign led to at least 440 compromised PaperCut instances across 395 organizations in 48 countries, with education as the most affected sector. #PaperCut #GreyNoise #CVE-2026-81578 #CVE-2026-82078
Anthropic disrupted a cyberespionage campaign that matched the Russian state-nexus group Midnight Blizzard, which used Claude to iteratively modify malware, evade detection, and target more than 20 organizations across government, defense, intelligence, and industry sectors. The report also highlights attacks on AI infrastructure and credentials, including fraudulent Claude reselling, prompt injection…
Surfshark disclosed that a misconfigured internal test server was accessed by a threat actor, exposing limited engineering data and some build-related credentials, but no user data or production systems were affected. The company said it contained the incident, rotated credentials, added security measures, and will conduct an independent security audit. #Surfshark…
Kiteworks has acquired Bonfy.AI to strengthen real-time policy enforcement for sensitive data shared by people and AI agents across enterprise systems. The deal extends Kiteworks’ unified data control plane with inline classification and contextual security decisions for email, file sharing, SaaS apps, AI assistants, and autonomous agents. #Kiteworks #BonfyAI…
Trezor said phishing emails tied to a breach at Brevo targeted 347,000 email addresses and tricked 2,500 users into clicking a malicious link that tried to steal wallet backup information. The company also linked the campaign to earlier third-party breaches, including ShipMonk and a previous support portal intrusion, highlighting repeated exposure of customer data. #Trezor #Brevo #ShipMonk #ShinyHunters
Microsoft fixed a bug that caused Microsoft Teams and the new Outlook for Windows to fail to launch or close unexpectedly on ARM-based Windows 11 devices after August 2026 updates. The issue was resolved in September 2026 Patch Tuesday updates, with Microsoft advising users to install KB5124012 or later and apply Microsoft Store updates if needed. #MicrosoftTeams #Outlook #SurfacePro11 #SurfaceLaptop7 #KB5124012
Pistachio’s Phishing Behaviour Report 2026 finds that phishing resilience should be measured by clicks, credential submission, and reporting together, not by click rates alone. The report also shows that performance can change over time and vary widely by department, with construction, health, logistics, and IT all showing different risk patterns. #Pistachio #PhishingBehaviourReport2026 #Construction #FacilityManagement #Health #Logistics #IT #TechDevelopment