A Wiki Add-On Was Fixed Quietly. Attacks Began a Day After the Flaw Was Made Public.
CVE-2026-100382 in MediaWiki's External Data extension lets anyone run commands on a wiki's server. Bots planted web she...
Wire
ASEAN edition · Fri, 2 Oct 2026 · Signal over noise
Cybersecurity News
AI-curated tech news, ASEAN business intelligence, and cybersecurity updates — written for the region.
1051 articles
60 this week
14 desks
Health & Wellness
55
Cyber Threat Intel
48
Privacy & Data
47
Consumer Tech
45
Science
34
Cloud & Infra
28
Sustainability
17
Statistics
9
Advertisement
Cisco Found an Exploited SD-WAN Flaw While Handling a Customer's Support Case
CVE-2026-76504 lets an attacker with no password use Catalyst SD-WAN Manager's API as the administrator. It was exploite...
Ransomware Hit Tokyo Rail Operator Keio. Its Trains Kept Running.
Keio confirmed the attack on 26 September and cut off parts of its network. Business systems, including at a group hotel...
Advertisement
Apple Patched an Exploited Flaw in iOS 26, Which Most iPhones Still Run
The CoreGraphics bug was used against targeted people on versions before iOS 27. Nearly 80% of iPhones were still on iOS...
Kiteworks Told Customers to Switch Off for Nine Hours, Then Found a Critical Flaw
Acting on a federal warning, the file-sharing company ordered a precautionary shutdown on 25 September. No breach has be...
Two Citrix NetScaler Flaws Were Exploited Before the Fix, and One Hits Default Setups
Fixes for eight flaws shipped on 27 September. US federal agencies have until 30 September and are told to look for intr...
A SharePoint Flaw Filed as Spoofing Is Now Being Used in Attacks
Microsoft reclassified CVE-2026-65660 as remote code execution in August and confirmed attacks on 25 September. US feder...
Attackers Probed a WordPress Core Flaw the Same Day It Was Patched
A critical bug in WordPress's core software affects every release from 4.7 to 7.1.1. Code execution needs a particular t...
Four Exploited Appliance Flaws, and the Deadline Is Today
Security appliances from Arista, F5 and Check Point are being attacked, and United States agencies must patch them by to...
China-Aligned Spies Targeted a Port Authority in Panama
SparroWocky replaced SparrowDoor from August 2025. ESET puts about nine in ten of the group's recent victims in one regi...
Brevo Served Malware for Four Hours and Seven Minutes
A stolen Cloudflare key let attackers rewrite three JavaScript files at the edge and strip the policy headers that would...
CISA Ordered a Compromise Hunt Without Naming the Attack
Three Linux kernel flaws joined the exploited catalogue on 18 September. No attacker, no victim and no technique has bee...
SolarWinds Shipped a Hard-Coded Key in Access Rights Manager
The advisory names no victim and no campaign, and the vector says adjacent network rather than the open internet.
Orkes Conductor Was Patched in June. One Vendor Blocked 1,290 Attempts in a Day.
The fix shipped three months ago and a public exploit followed in August. Fortinet says daily attempts against unpatched...
A 7.8 Flaw in Acronis Backup Plugins Is Being Exploited Now
Local privilege escalation rarely alarms anyone. On shared hosting, where every customer already has a low-privileged ac...
Cisco Found a 10.0 Identity Services Engine Zero-Day in a Support Case
An authentication bypass on the appliance that decides who gets onto the network, scored 10.0, already being exploited w...
Forged Admin Tokens Are Hitting WSO2 API Gateways Patched Five Months Ago
A token signed with an algorithm the gateway does not support is accepted anyway. WSO2 scored it 10.0 and shipped the fi...
A Crafted Email Is Enough to Get Root on Cisco's Secure Email Gateway
A mail gateway reads every message a company receives. Cisco's can be taken over by one of them, and the flaw was alread...
A Plesk Backup Restore Lets a Hosting Customer Get Root on the Whole Server
CVE-2026-68488 needs only a customer's own panel login and FTP access. On shared hosting, that turns one account into ev...
A PAN-OS Flaw Gives Root on Palo Alto Hardware, and There Is No Workaround
CVE-2026-0310 is reachable through a dataplane interface, not only the management plane, and Palo Alto lists no mitigati...
An Internal OpenAI Service Let One ChatGPT Account Read Another's Gmail
Check Point found ChatGPT's isolated sandboxes could pass data through an internal package service — the same one OpenAI...
Microsoft Has Patched 2,760 Flaws This Year. The Old Record Was 1,139.
Microsoft shipped 974 fixes in September, a monthly record. The year is the number that matters: 2,760 so far against a...
The Dutch Warned About Check Point's VPN Flaws Before Anyone Exploited Them
Two pre-authentication flaws in Check Point VPN were patched on 9 September. Three days later the Dutch NCSC said attemp...
Attackers Are Not Breaking Passkeys. They Are Adding Their Own.
Microsoft describes sign-ins followed by attackers registering their own authentication method. It survives every passwo...
Advertisement