October 2026

Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.

“CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions,” Citrix said.

The vulnerability

A now-patched vulnerability in AWS Bedrock AgentCore could allow an attacker to use one AI chatbot to take over an organization’s entire fleet.

The first cybercriminal to ever make the FBI’s “10 Most Wanted Fugitives” list allegedly infused Tren de Aragua’s violent criminal operations with cash.

Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.

The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.

The post Cisco Patches a Dozen Critical Vulnerabilities appeared first on SecurityWeek.

All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable.

The post Security Awareness Training Isn’t Dead, but It Needs a Rethink appeared first on SecurityWeek.

Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.

The post Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication appeared first on SecurityWeek.

Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026.

The post US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward appeared first on SecurityWeek.

The proposed sale would include about 100 million emails, 500 million Microsoft Teams messages, employment contracts, employee and timecard records and payroll and tax information, Rep. Steven Horsford (D-NV) said in a press release.

The U.S. and other nations took down digital tools and infrastructure by Beijing-based Integrity Tech that allowed “widespread vulnerability scanning and, in some cases, intrusions” as part of the Flax Typhoon campaign.