Security & privacy
Breaches, cyber incidents, outages and vulnerabilities, with official figures.
-
News Security & privacy
Malicious workflows planted in 500 GitHub repositories to harvest cloud keys
An automated supply chain campaign injected continuous integration configurations across open repositories to extract cloud infrastructure tokens.
-
News Security & privacy
A fifth exploited Citrix NetScaler flaw since August; US agencies get until 7 October to act
The flaw lets an attacker knock NetScaler ADC and Gateway appliances offline without logging in. Versions fixed for September's flaws are still affected.
-
News Security & privacy
Zammad flaws used to breach a security nonprofit are listed as exploited; US agencies must act by 5 October
The Dutch Institute for Vulnerability Disclosure says the attack on it in September was carried out by an AI agent. Zammad says one flaw affects only old versions and it cannot yet verify the other.
-
News Security & privacy
A US judge rules a police search of Flock licence-plate data was an unconstitutional search without a warrant
The Oklahoma judge called the camera networks a type of 'indiscriminate mass surveillance' and threw out the evidence. She noted that nearly every court so far has ruled the other way.
-
News Security & privacy
Attackers are exploiting a FortiMail flaw before a fix exists; US agencies get three days to act
Fortinet says an unauthenticated attacker can write files on its email-security appliances. Fixed releases are listed as upcoming, so for now it offers a workaround: switch off one feature.
-
News Security & privacy
An exploited Cisco flaw lets attackers into SD-WAN Manager as admin; US agencies get three days to act
Cisco says an unauthenticated attacker can reach the network-management system's API with admin rights, and there is no workaround. It is the ninth Cisco SD-WAN flaw CISA has listed as exploited this year.
-
News Security & privacy
Apple fixed an exploited flaw in iPhones, iPads and Macs, and US agencies were given until 2 October to patch
Apple says it may have been used in an extremely sophisticated attack on specific people. The US cyber agency listed it as exploited a day after the fix.
-
News Security & privacy
Two new Citrix NetScaler flaws are being exploited, and US agencies were given three days to act
One lets an unauthenticated attacker run commands on the widely used remote-access and load-balancing appliances. It is the third NetScaler flaw CISA has listed as exploited this month.
-
News Security & privacy
Attackers are exploiting a flaw in WordPress itself, US cyber agency says; fixes go back to version 4.7
The flaw can let an unauthenticated attacker run code on some sites, depending on the theme and server set-up. WordPress released fixes on 22 September; CISA listed it as exploited on 25 September.
-
News Security & privacy
Astrana Health says callers posing as staff got into its systems, and private data was accessed
The US healthcare manager, which coordinates care for about 1.6 million patients, called the incident material on 22 September. It has not yet said whose data was taken.
-
News Security & privacy
Critical flaws in F5 and Check Point security products were exploited on the day they were disclosed
Both let an unauthenticated attacker run code: one in F5's BIG-IP access gateway when it acts as an OAuth server, the other in Check Point's management server.
-
News Security & privacy
China names 30 apps over personal-data failures and gives them 15 working days to fix them
The internet regulator's tests found apps with no privacy rules, demands for unneeded permissions, and no working way to delete an account.
-
News Security & privacy
Three Linux kernel flaws are being exploited, US cyber agency says, including one scored 9.8
The flaws are in the kernel's TLS, crypto-socket and network-bridge code. CISA notes the kernel is used in many products, some of which may no longer get fixes.
-
News Security & privacy
Salesforce customers faced severe delays and errors for more than seven hours, across all regions
Requests stalled on an internal login service. Salesforce says the fix held from 15:26 UTC, and that it will publish the cause after a full investigation.
-
News Security & privacy
A flaw in Pixel phones' cellular modem is being exploited; Google's 5 September patch level fixes it
Google says there are signs of limited, targeted attacks. The US cyber agency added the flaw to its exploited list a day after Google's bulletin.
-
News Security & privacy
A cleanup job overloaded a GitHub database, degrading about 28 services for two hours
Creating issues on the web failed 96% of the time at worst, and sign-ups over 90%. GitHub says it will split up the database cluster that failed.
-
News Security & privacy
Attackers are exploiting flaws in GitLab and JFrog Artifactory, where companies keep their code and builds
The GitLab flaw, scored 10 out of 10, let an unauthenticated user read any file on a self-managed server. US agencies were given three days to patch it.
-
News Security & privacy
Cisco says state-backed hackers and a ransomware group are exploiting its firewall management software
One flaw, scored 10 out of 10, gives root access without logging in. Cisco's researchers found a variant of malware previously attributed to Russia's Sandworm on one compromised system.
-
News Security & privacy
Chrome had two flaws exploited by attackers within a week; update to version 153 fixes the second
Both were in V8, Chrome's JavaScript engine, and let a crafted web page run code inside the browser's sandbox. Chrome 153 also fixed 229 other security bugs.
-
News Security & privacy
Boston Scientific says a cyberattack that halted manufacturing will likely hit its results for the year
The medical-device maker told the SEC it probably won't meet its sales and earnings guidance after an incident on 25 August disrupted its operations worldwide.
-
News Security & privacy
US agencies must now fix the riskiest exploited flaws in under three days, under a new CISA directive
BOD 26-04 replaces the old fixed deadlines with ones based on risk, and adds forensic checks. In September, 33 of the 41 flaws CISA listed as exploited carried 3-day deadlines.