Help Net Security lists cybersecurity job openings at IG Group, Cellebrite, NetSPI, BreachLock and other firms across multiple countries.
A routine job-board roundup listing cybersecurity vacancies including Application Security Engineer at IG Group, CISO at LianLian, Red Team Operator at Swift, Senior Penetration Tester at BreachLock, and Android malware reverse engineering roles at NetSPI. Positions span India, Austria, Singapore, UAE, USA, Israel, and the UK. No security incident, vulnerability, or product news is involved.
Help Net Security lists cybersecurity vacancies at NATO DIANA, Docusign, OX Security, Boston Scientific and other organizations across nine countries.
A routine job-board roundup listing cybersecurity vacancies including Application Security Engineer at Arcadia, Cybersecurity Lead at NATO DIANA, Lead Security Engineer at Docusign, Security Researcher at OX Security, and Senior Cybersecurity Engineer at Boston Scientific. Roles cover AppSec, GRC, IAM, cloud security, and medical device security across the USA, UK, New Zealand, India, Israel, and Greece. No security incident, vulnerability, or product news is involved.
Grindr will pay £26m ($35.2m) to settle UK group claims alleging unlawful sharing of sensitive data, including HIV status, before 2020, without admitting liability.
The settlement, reached on September 2 and disclosed to the US SEC, covers roughly 12,000 claimants represented by Austen Hays over the free app's 2016–2020 data practices when Grindr was owned by Chinese conglomerate Kunlun. Grindr will pay £13m by December 31, 2026 and £13m by March 31, 2027, and continues to dispute the allegations; the agreement contains no admission of liability. The claims concerned sharing HIV status, PrEP use, ethnicity, and sexual orientation data with analytics providers Apptimize and Localytics without adequate consent. Norway's data protection authority fined Grindr €6.5m in 2021, and the UK ICO reprimanded the company in July 2022.
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
VulnCheck observed active exploitation of CVE-2026-0768 (CVSS 9.8) in Langflow and CVE-2026-66066 'KindaRails2Shell' (CVSS 9.5) in Ruby on Rails, with detections rising from 50 on August 30, 2026 to 360 by September 1. The Rails flaw allows unauthenticated arbitrary file reads, leaking secret_key_base, Rails master key, database passwords, cloud credentials and API tokens, ultimately enabling RCE; the patch still leaves the variation-key Marshal deserialization RCE gadget functional. Observed chains include a Python credential harvester with SimpleHelp remote access via CVE-2026-5027, and weaponization of CVE-2025-3248 to enlist hosts into an XMR mining botnet after disabling auditd. More than 7,100 exposed vulnerable Ruby on Rails instances and over 15,000 successful exploitation attempts across three Langflow flaws were recorded.
Extortion group FulcrumSec claims stealing 86GB of Manchester Airports Group data, exposing 8.7 million customers' personal and booking details.
Manchester Airports Group disclosed a breach on August 27 affecting parking, lounge, Fast Track and WiFi registrations at Manchester, London Stansted and East Midlands airports, impacting 8.7 million customers, most exposed only email addresses. FulcrumSec claims it stole about 86GB via airport-specific Iterable API credentials exposed in client-side JavaScript, including a 21.5GB Manchester export with booking histories, marketing data and nearly 200,000 records on upcoming 2026 travel. BleepingComputer verified sample records against a real traveler's Fast Track history; MAG declined to address the group's specific claims. Researchers warn the combination of UK postcodes, vehicle registrations and booking details could enable convincing targeted phishing, and MAG says no payment card or banking data was exposed.
CYBERA's money mule intelligence, now in Recorded Future's Payment Fraud Intelligence, targets the shared exit point of $450B-$1T annual scam losses.
Scams, especially authorized push payment fraud, do not require a breach; Global Anti-Scam Alliance estimated ~$450B in 2025 losses while CYBERA co-founder Claudio Staub puts the real figure near $1 trillion when underreporting is counted. Every scam needs a mule account to receive funds, so CYBERA uses agentic personas to engage active scammers and extract verified mule account details before payments occur, now available as an add-on to Recorded Future's Payment Fraud Intelligence. CYBERA collected over 16,000 confirmed mule accounts across 72 countries in H2 2025, finding 28% remained active 30 days or more after identification, including one account in 25 engagements. In Europe 51% of mule accounts sat at neobanks and fintechs, while outside Europe 69% were at major banks; regulatory pressure like the UK's APP reimbursement mandate is raising the stakes for institutions.
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.
Manchester Airports Group disclosed that an unauthorized third party accessed customer data from bookings and airport Wi-Fi registrations.
Manchester Airports Group, which operates Manchester, Stansted and East Midlands airports, reported a cyber incident in which an unauthorized third party accessed customer data. Affected data is linked to bookings and airport Wi-Fi registrations. The number of affected customers was not stated in this report.
Manchester Airports Group says cybercriminals took customer data affecting an estimated 8.7 million customers at the UK's largest airport operator.
The Register reports that Manchester Airports Group, the UK's largest airport operator, believes approximately 8.7 million customers were affected by a cyber incident. The attackers are described as cybercriminals, with data tied to bookings and Wi-Fi registrations at Manchester, Stansted and East Midlands airports. This report adds a scale estimate to the group's breach disclosure.
July 14, 2026 cybersecurity job listings featuring roles at Fiserv, American Express, Orca Security, Ofsted, and others across multiple countries.
This Help Net Security post lists cybersecurity jobs currently open at Fiserv, Integris Group, American Express, Orca Security, Jefferson County, Ofsted, Armstrong Fluid Technology, UNEY, Red Alpha Cybersecurity, Astranis, and lululemon. Roles span network engineering, threat intelligence leadership, AI security specialization, and security operations. All listed positions are on-site, hybrid, or remote across USA, Israel, UK, Canada, UAE, and Singapore. Most positions noted as no longer accepting applications.
July 28, 2026 cybersecurity job listings spanning cloud security, offensive security, AI safety, and application security roles across multiple organizations.
This Help Net Security post lists open cybersecurity positions at Toyota Automated Logistics, VELUX, Maryville University, BlackSea Technologies, AZ Group, Sedha Consulting, Gentex, cyforce, Postman, NVIDIA AI, Matillion, and RBC. Roles include cloud security engineering, offensive security leadership, AI safety research, and vulnerability triage management, spanning USA, Denmark, UAE, Israel, UK, and Canada. Positions are on-site, hybrid, or remote; many noted as no longer accepting applications.
Agentic AI transforms phishing economics, enabling personalized multi-channel attacks with deepfakes like the $25M Arup deepfake heist.
The article argues phishing has evolved through three stages: from malicious content, to intent-based BEC, to AI-powered multi-channel campaigns where attacker agents autonomously conduct reconnaissance and generate tailored lures. The widely reported Arup case saw a deepfake video call impersonating colleagues convince an employee to approve transfers worth roughly $25 million. An Osterman Research study of 128 security leaders found 88% experienced trust-undermining incidents, while Microsoft 365 EOP and Google Workspace were measured missing hundreds of phishing messages per 100 mailboxes monthly. The author argues defenders must adopt their own agents to match attacker speed.
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.
Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.
· Gitea all versions before 1.27.1 KEV PoC ×4moderate
Unauthenticated RCE in Langflow /api/v1/validate/code
Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available.
Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.
· Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20 (when the optional zimbra-snmp package is installed and SNMP notifications are enabled) KEV PoC ×4large
Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.
Unauthenticated Eval Injection RCE in Langflow (eval_custom_component_code)
CVE-2026-0769 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in Langflow, an open-source platform for building LLM applications, located in the eval_custom_component_code function. The function fails to properly validate a user-supplied string before using it to execute Python code, so a remote attacker who can reach the Langflow service without any credentials can submit a crafted string that is then executed as Python code. Successful exploitation yields arbitrary code execution in the context of the current process, with full confidentiality, integrity, and availability impact on the affected host. Any Langflow deployment is potentially exposed, particularly self-hosted or internet-facing instances that accept unauthenticated API requests. Exploitation of critical Langflow flaws has been reported in the wild in recent credential-focused campaigns; this CVE itself is not yet in CISA KEV and has no known public PoC, but its EPSS of 38% (98th percentile) signals high near-term exploitation risk.
Unauthenticated Arbitrary File Read in Ruby on Rails Active Storage
CVE-2026-66066 is a flaw in Active Storage (part of Ruby on Rails' Action Pack) in which libvips operations that are marked unsafe for untrusted content are not disabled, so a crafted upload can invoke such an operation on the server. It is triggered when an unauthenticated attacker uploads a maliciously crafted image to a Rails application that is configured to use libvips and accepts image uploads from untrusted users. Successful exploitation lets the attacker read arbitrary files accessible to the Rails process, including environment variables and application secrets; leaked credentials such as secret_key_base or external-service tokens can be leveraged for remote code execution or lateral movement. Affected applications are those running Rails 7.2.x, 8.0.x or 8.1.x before the patched releases 7.2.3.2, 8.0.5.1 and 8.1.3.1, provided Active Storage with libvips is in use. Public exploit code is not yet documented, but news reports describe active attacks against Rails apps (a campaign referred to as "KindaRails2Shell"), EPSS assigns a 27.9% probability of exploitation within 30 days (98th percentile), and the flaw is not yet listed in CISA KEV.
· Ruby on Rails Active Storage (Action Pack) 7.2.x prior to 7.2.3.2 · Ruby on Rails Active Storage (Action Pack) 8.0.x prior to 8.0.5.1mass
Authenticated Path Traversal Arbitrary File Write in Langflow Files API
CVE-2026-5027 is a path traversal flaw (CWE-22) in the 'POST /api/v2/files' endpoint of Langflow, the open-source platform for building AI/LLM agent workflows. The endpoint fails to sanitize the 'filename' field supplied in multipart form data, so an attacker who submits a name containing '../' sequences can direct the resulting file write to arbitrary locations on the server's filesystem. The CVSS vector (network-accessible, low complexity, low-privilege account required, no user interaction) indicates an authenticated user can abuse this to overwrite or create files at attacker-chosen paths, which can compromise confidentiality, integrity, and availability — for example by overwriting configuration, credentials, or executable content that leads to code execution depending on deployment. Any organization running a self-hosted Langflow instance that exposes the files API, even to low-privileged accounts, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific CVE, and it is not yet on CISA's KEV list, but its elevated EPSS (36.1%, 98th percentile) and active exploitation of other Langflow vulnerabilities (e.g., CVE-2026-0768) suggest near-term exploitation risk.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.