Latest security news

Thu, 10 Sept 2026

1. 11:14
   Microsoft says September updates fix mouse settings reset issues

   Microsoft has fixed a known issue that wiped mouse settings on some Windows 11 systems after installing the KB5120998 August 2026 preview update.

   BleepingComputer·Microsoft, Windows
2. 10:52
   Update Chrome now to protect against an actively exploited vulnerability

   Chrome issues another monster update, fixing an actively exploited V8 vulnerability and 229 other flaws.

   Malwarebytes Labs·Chrome
3. 10:40
   [object Object]

   Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it. What’s worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we’re going to need to change the way we deal with security responses in open source. Simon Willison comments : Anil points out that this rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, we need to figure out new processes for keeping our communities safe...

   Schneier on Security
4. 10:36
   CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079 (CVSS score: 10.0) - An authentication

   CriticalThe Hacker News·Citrix, Cisco, Fortinet
5. 10:22
   Scytale expands vendor risk management with AI-powered TPRM tools

   Scytale has announced the launch of their latest AI-powered third-party risk management (TPRM) capabilities within its Vendors module. The release further extends vendor risk management from a periodic review exercise into a continuously updated vendor risk intelligence engine, giving security and GRC teams a current view of every vendor in their ecosystem. Scytale’s AI GRC platform automates vendor discovery, risk scoring, and evidence collection across compliance frameworks. (Source: Scytale) The expansion arrives as third-party exposure … More →

   Help Net Security
6. 10:10
   ISC Stormcast For Thursday, September 10th, 2026 https://isc.sans.edu/podcastdetail/10088, (Thu, Sep 10th)

   (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

   SANS Internet Storm Center
7. 10:06
   WordPress adds automated security checks to block risky plugin releases

   WordPress’ automated security review will now assess every plugin release before it is distributed through the WordPress.org update API. Releases considered a potential security risk will be blocked automatically. “A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release. Until now there was no consistent review step between a release being committed and that release reaching millions of sites,” David Perez, Co-Lead, WordPress Official Plugin Repository Team, explained. … More →

   Help Net Security·WordPress
8. 10:06
   Organizations Warned of Cisco Secure FMC Exploitation

   Cisco and CISA have flagged exploitation of CVE-2026-20079, a vulnerability disclosed in March 2026.

   CriticalSecurityWeek·Cisco
9. 10:00
   The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

   Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities.

   Unit 42
10. 09:59
    Copyright scammers get Instagram accounts suspended and demand payment

    Scammers are filing fraudulent copyright complaints to suspend Instagram accounts, then demanding payment to withdraw them.

    Malwarebytes Labs