CUPS vulnerabilities could be abused for DDoS attacks
60
60
60
The Apple Security Update Review for September 2026
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.
75
60
60
Week in review: Cisco SD-WAN 0-day exploited, Patch Tuesday forecast
60
60
57
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
60
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
60
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
60
60
60
60
Lawmakers call on Treasury to sanction hackers-for-hire
Bipartisan US lawmakers asked Treasury to sanction three India-based hack-for-hire firms accused of long-running espionage against Americans.
Sens. Ron Wyden and Sheldon Whitehouse and Rep. Pat Harrigan urged Treasury to add Sunkissed Organic Farms (formerly Appin), BellTroX, and CyberRoot to the Entity List. The letter says the mercenary groups conducted targeted espionage against US citizens, businesses, and lawyers for over fifteen years, allegedly including work for Qatar's government such as targeting opponents of Qatar's World Cup bid and Kristi Rogers, wife of Senate candidate Mike Rogers. Adding the firms to the Entity List would restrict their access to American software, cybersecurity tools, and cloud infrastructure. The lawmakers also accuse the groups of lawfare campaigns to censor investigative reporting on their hacking activities.
45
60
60
60
60
U.S. CISA adds a flaw in Broadcom VMware vCenter Server to its Known Exploited Vulnerabilities catalog
60
⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit
60
Warning: VMware vCenter and Kemp LoadMaster Flaws Under Active Exploitation
60
60
Recently disclosed VMware vCenter Server bugs are actively exploited in attacks
60
60
Critical Security Flaws Uncovered in Honeywell Experion DCS and QuickBlox Services
60
VMware Issues Security Patches for High-Severity Flaws Affecting Multiple Products
60
Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0
60
Google Releases Urgent Chrome Update to Patch 2 Actively Exploited 0
60
November 2020 Patch Tuesday: Microsoft fixes actively exploited Windows Kernel flaw
60
60
60
60
60
60
60
60