Latest security news

Mon, 14 Sept 2026

1. 18:33
   Apple Updates Everything, (Mon, Sep 14th)

   Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases.

   SANS Internet Storm Center·Apple
2. 17:58
   Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

   A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to

   The Hacker News
3. 17:27
   Android security advisory – September 2026 monthly rollup (AV26-920)

   Serial Number: AV26-920 Date: September 14, 2026 As of September 8, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices. The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Android Security Bulletin—September 2026

   Canadian Centre for Cyber Security·Android
4. 16:56
   Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

   A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. "Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU)

   The Hacker News
5. 15:11
   Samsung mobile security advisory (AV26-919)

   Serial number: AV26-919 Date: September 14, 2026 As of September 8, 2026, Samsung published a security update to address vulnerabilities in the following product: Samsung mobile devices – versions prior to SMR-SEP-2026 The most recent security update resolves multiple identified vulnerabilities. The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update. Samsung Security Updates

   Canadian Centre for Cyber Security·Samsung
6. 14:46
   Malicious actors already using critical GitLab flaw, CISA and others warn

   The vulnerability could let unauthenticated users access sensitive files from software-development environments.

   Cybersecurity Dive·GitLab
7. 14:40
   ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

   AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of

   The Hacker News·PaperCut
8. 14:30
   MongoDB security advisory (AV26-918)

   Serial number: AV26-918 Date: September 14, 2026 As of September 11, 2026, MongoDB is affected by a vulnerability in the following product: MongoDB Server Prior to 7.0.43 Prior to 8.0.32 Prior to 8.3.11 Prior to 9.1.0-rc0 Prior to 9.0.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Shred collection validator constants during parsing Alerts | MongoDB

   Canadian Centre for Cyber Security
9. 14:30
   Perfect-10 GitLab bug under attack days after patch lands

   CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers

   The Register·GitLab
10. 14:15
    Human Attacker Hits Machine-Speed Exploitation of Marimo RCE

    A human attacker exploited a Marimo RCE and reached an SSH bastion in eight seconds

    Infosecurity Magazine