October 2026

The “FrostyNeighbor” advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.

Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.

The post Drupal Commerce Core Vulnerability Exploited Against Online Stores  appeared first on SecurityWeek.

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

The post $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack appeared first on SecurityWeek.

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

The post TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines appeared first on SecurityWeek.

The company suffered outages starting at 2pm EST on Thursday and eventually attributed the downtime to a compromise involving an unnamed provider.

Poryadok, which operates 48 stores across 32 Russian cities, first reported technical problems on Sunday, saying its website, mobile app and physical stores were temporarily unavailable.

Binance, the world’s largest cryptocurrency exchange, confirmed Thursday that it had been hacked in a $6.3 billion cyber heist that blockchain investigators are blaming on North Korea.

Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts.

The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware.

“We identified a security incident

Drupal has warned that threat actors are exploiting a “highly critical” security flaw in its Commerce Core component.

The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

“This module enables you to sell goods and services to customers through an included shopping cart