🔴 Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals.
The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working exploit is separate work the analysis does not demonstrate.
🔴 MetaMask Security Incident Prompts Exit of Affected Ethereum Validators
MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure.
"We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors," the software cryptocurrency wallet maker said. "At this time, we have identified no immediate threat to MetaMask wallets."
MetaMask did not disclose any additional details related to the security issue. As a precautionary measure, MetaMask said it's proactively exiting affected validators within its non-custodial staking operations, in coordination with clients and partners.
🔴 Google sends TPUs into space and will test whether AI will survive launch
Google is preparing to send its AI accelerators into orbit and test for the first time whether server chips can survive rocket launches, cosmic radiation and operation in a vacuum.
The experiment is part of Project Suncatcher, where Google is studying the possibility of creating entire orbital clusters for AI in the future. The first satellite prototype is scheduled to be launched on October 1st aboard a SpaceX Falcon 9 rocket as part of the Transporter-18 mission. The device was developed jointly with Planet and is powered by four Google TPU processors.
Hidden Moscow Links Trigger Scrutiny Across Europe’s Digital Evidence Infrastructure
European law-enforcement agencies are reviewing their exposure to Oxygen Forensics after U.S. prosecutors alleged that the Virginia-based digital-forensics supplier concealed Russian ownership and Russia-based software development while selling powerful investigative technology to Western governments.
🔴 Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit
Anthropic’s disclosure appears in the prospectus for the AI giant’s stock market debut, which Reuters reviewed.
Anthropic’s agentic technology is built to work inside customers’ systems with broad access and to operate without supervision for days. The company acknowledged the risks that come with this level of autonomy.
“These autonomous capabilities could increase the potential for harm, as errors, misalignment, or security exploits may result in real-world consequences,” Anthropic said in the prospectus.
🔴 Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
Russian state-sponsored APT Star Blizzard has updated its tactics, techniques, and procedures (TTPs) in recent attacks to evade detection, Microsoft says.
Believed to be subordinate to the Russian Federal Security Service (FSB) Centre 18, Star Blizzard is known for launching targeted spear-phishing campaigns against academia, defense, governmental organizations, NGOs, and think tanks, and for using the ClickFix technique and the DarkSword iOS exploit kit.
In attacks observed this year, the APT has been relying on large-scale phishing attacks and a new malware delivery technique dubbed RedFlick, which requires a single user interaction for malware execution.
Trusted AI Pages Become Launchpads for Multi-Stage Windows Intrusions
Threat actors are abusing attacker-created Custom GPTs hosted on the legitimate ChatGPT domain to redirect users into a sophisticated ClickFix campaign that ultimately installs a full-featured remote access trojan (RAT).
🔴 Pentagon personnel database breach exposes personal data of millions
The US Department of Defense has confirmed a breach at one of its main repositories of personnel information, the Defense Manpower Data Center (DMDC), that has exposed the sensitive details of just over three million people.
According to media reports, some 2.76 million people are impacted by the breach, as well as a further 294,000 who are now deceased.
Unauthorised users are said to have accessed files between October 2025 and 16 July 2026 without anyone noticing. It was only after nine months that a vulnerability in a file-sharing system was discovered and patched by the DMDC.
A dataset belonging to Kafiil, an Arabic freelance marketplace connecting businesses and clients with freelancers, has been shared on a forum.
According to the post, the exposed records include usernames, full names, account verification status, profile information, ratings, profile completion data, visit counts, received favorites, and avatar URLs.
A sample of the purported data was included alongside the listing.
🔴 Adecco France Dataset With 8.6 Million Records Offered for Sale
A dataset belonging to Adecco France has been offered for sale on a forum, with the seller claiming it contains 8,640,691 records.
According to the post, the data dates back to a 2022 breach and is provided in CSV format at approximately 1.75 GB.
The seller claims the dataset includes millions of names, phone numbers, email addresses, physical addresses, dates of birth, and IBANs, along with more than 400,000 encrypted social security-related records.
The actor also claims the original group responsible for the breach was later raided after using linked IBAN information for fraud, and says the dataset has not previously been sold.
Sample records were provided alongside the listing.
These claims have not been independently verified.
🔴 Aruba and Bitdefender: data and cybersecurity aren't leaving Europe! The challenge to US hyperscalers is on
Bitdefender, a leading European cybersecurity company, today announced a strategic partnership with Aruba SpA, a leading Italian provider of IT, cloud, and data center services, to host its leading cybersecurity platform on Aruba's cloud infrastructure. The partnership offers a sovereign cybersecurity model, ensuring that customer and configuration data, security incident information, and telemetry data are never accessed, transferred, or processed outside the European Union (EU).
As part of the partnership, Aruba will distribute Bitdefender's entire portfolio of enterprise security products and services, which includes solutions for threat prevention, protection, detection, and response. A core element of the partnership is Bitdefender GravityZone, the company's unified platform for security, risk analytics, and compliance, hosted on Aruba's cloud infrastructure. Aruba provides the technological infrastructure, while Bitdefender maintains full operational control of the platform, ensuring that all customer data remains encrypted and is managed exclusively by Bitdefender.
🔴 WaterISAC reckons with range of threats after summer of cyberattacks
The computers that automate water treatment systems across the country were built for durability, not for an internet-connected world. Many still accomplish their fundamental function, but as cyberattacks on the sector mounted this summer, water industry officials say those aging systems, especially internet-exposed operational technology and programmable logic controllers, remain among the easiest ways for adversaries to break in.
Tom Dobbins, executive director of the Water Information Sharing and Analysis Center or WaterISAC, told CyberScoop the sector’s biggest ongoing weaknesses include exposed OT, vulnerable PLCs, insecure connections through integrators and poor cyber hygiene at smaller utilities, which have pushed the center to make threat sharing faster across the sector.
🔴 Two Nigerians bag 189 months for $2.4m US cyber fraud
Two Nigerians resident in the United States, Chijioke Timothy Odimegwu and Harafat Mogaji, have been sentenced to a combined 189 months in federal prison for their roles in an international cyber fraud scheme that defrauded businesses of more than $2.4 million.
The two men, who were residents of Delaware and members of the US Air Force at the time of the offences, were sentenced on September 25, 2026, following their convictions.
US Attorney for the Southern District of Iowa, David Waterman, announced the sentences in a statement issued by the district’s Public Information Officer, MacKenzie Tubbs.
🔴 OpenAI introduces Dots! AI agents that work around the clock. What could possibly go wrong?
The idea is fascinating, but also deeply disturbing: an AI agent that no longer waits for someone to tell it what to do, that can have its own computer, browse the web, use applications, write code, and continue a project for hours, even when the user isn't looking. It's no longer just a chatbot that answers questions: it's something that can take on a task and continue it over time. And when we grant such a system access to data, accounts, applications, and infrastructure, the question of security becomes inevitable.
🔴 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.
Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.
🔴 South Africa Seeks Help After Cyberattack Targets Air Traffic Control
The South African state-owned company that provides air traffic control (ATC) and weather operations for approximately 10% of the world's airspace discovered ransomware-linked malware in an operational technology (OT) network, according to public documents released this month.
The company, Air Traffic and Navigation Services (ATNS), believes that its technical team stopped the attack, but it issued a request for quotes (RFQ) seeking cyber-forensics firms to investigate the incident. A second attack, possibly an insider's theft of data, is also part of the investigation request.
🔴 High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
The developers of the OpenSSL and WolfSSL open source cryptographic libraries announced patches for roughly a dozen vulnerabilities each, including high-severity flaws.
Of the 14 vulnerabilities fixed in OpenSSL, one has been assigned a high severity rating. Tracked as CVE-2026-84782, it could allow a remote peer to obtain fragments of heap memory or crash applications that use Datagram TLS (DTLS), a protocol commonly found in VPNs, VoIP and IoT products.
🔴 Is AI becoming too autonomous? NVIDIA puts a "red button" on AI agents
AI agents are becoming so autonomous that NVIDIA has decided to no longer rely on the agents themselves for their security. The company has effectively moved the "red button" to a separate processor, which monitors the autonomous system's behavior externally and can stop it in milliseconds.
The new NVIDIA Open Agent Safety Platform is designed for agents that access files, credentials, APIs, and enterprise services, and can execute code autonomously. Such an AI agent already resembles a privileged user, so NVIDIA believes that the standard ban in the system prompt is insufficient.
