Cybersecurity News and Updates

The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.

The post Adobe Patches 140 Vulnerabilities Across 10 Products appeared first on SecurityWeek.

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. 

The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on SecurityWeek.

Saudi national Abdulrahman Alfozan was arrested Friday and terminated by OpenAI.

The post Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say appeared first on SecurityWeek.

A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP’s official Python client for BTP services. An attacker must be able to control the tenant subdomain,

A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.

The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek.

IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses.

The post AI Turns Familiar Cyberattacks Into a Race Against Time appeared first on SecurityWeek.

Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.

The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek.

Two of 31 newly disclosed flaws in Progress Software’s MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.

Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.

Affected

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said.

The attackers reached them through the controller that runs all of a store’s fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed.

A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list.

Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data