South Korea Orders Financial-Sector Security Review After Wave of Data Breaches
South Korea has ordered a broad security review after banks and other financial firms disclosed breaches affecting customers, employees and contractors. Investigators are also examining signs of shared...
Patched Citrix NetScaler Appliances Are Crashing on Their Own, and Nobody’s Sure Why Yet
Citrix customers who rushed to install the emergency 14.1-73.37 build for two actively exploited NetScaler zero-days are now reporting repeated appliance reboots triggered by malformed SAML traffic. Citrix...
Microsoft Reissues Exchange Security Update to Close Cross-Mailbox Access Flaw
Microsoft has issued revised September 2026 Exchange Server updates for CVE-2026-96940, an 8.8-severity authorization flaw that could let an authenticated attacker access another user’s mailbox. Organizations that installed...
Suspected ShinyHunters Member Detained as FBI Data-Theft Inquiry Expands
A suspected ShinyHunters member has reportedly been detained in Jordan and is cooperating with investigators seeking other people linked to the group. The development follows unverified claims of...
Vercel Confirms KVM Zero-Day Behind Claimed Guest-to-Host Root Escape
Vercel has confirmed a KVM zero-day reported through its Sandbox bounty program after a researcher claimed a full guest-to-host escape. Technical details, affected versions and remediation guidance remain...
Debian’s Massive 1,313-CVE Kernel Update: What Administrators Actually Need to Know
Debian's DSA-6528-1 advisory bundles fixes for 1,313 CVEs into a single kernel update for Trixie, addressing privilege escalation, denial-of-service, and information-leak risks. The headline number is less alarming...
Root-Level cPanel/WHM Flaw Puts Every Hosted Account on a Server at Risk
cPanel has patched a critical flaw (CVE-2026-93698) in the Multilang adminbin component that allows arbitrary command execution as root, alongside two stored XSS bugs in WHM's SSL Hosts...
Leaked Control Panel Exposes 50,000 Stolen Credentials Harvested From WordPress Backups
Researchers at LevelBlue uncovered TIKTOUK, a credential-harvesting toolkit that scans for exposed WordPress backups, configuration files, and JavaScript secrets. A leaked operator panel contained roughly 50,000 real credentials...