Ransomware: incransom named ukbjja.org (GB)
1. Executive summary The ransomware group tracked as "incransom" listed ukbjja.org, a United Kingdom organisation, on its leak site on 2026-09-24.
25 Sep 2026 · 5 min read
read →
// author
Jeff Davies
A Closer Look at Malware From the Macfinger ClickFix Campaign
1. Executive summary A macOS ClickFix campaign tracked as Macfinger ClickFix remains active and is delivering an information stealer that the reporting analyst assesses is not
25 Sep 2026 · 10 min read
read →
CVE-2026-71362 Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability
1. Executive summary CVE-2026-71362 is an incorrect authorization flaw (CWE-863) in Adobe Commerce and Magento that lets an attacker bypass authorization checks and
24 Sep 2026 · 7 min read
read →
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
1. Executive summary The fix shipped for CVE-2026-46345 (CVSS 8.4 HIGH, not in CISA KEV, EPSS 0%) added a path-traversal guard to
24 Sep 2026 · 4 min read
read →
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
1. Executive summary A public advisory published on 2026-09-24 describes a server-side template injection flaw in compliance-trestle that survives the fix for
24 Sep 2026 · 9 min read
read →
CVE-2026-5430 WSO2 Multiple Products: WSO2 Multiple Products Path Traversal Vulnerability
1. Executive summary CVE-2026-5430 is a path traversal flaw in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that the source
24 Sep 2026 · 6 min read
read →
Trust and the enticing consultancy offer
1. Executive summary Talos published its Threat Source newsletter on 24 September 2026, and the lead item describes a social-engineering confidence trick aimed at security
24 Sep 2026 · 7 min read
read →
UK gears up for fight against Russia’s disinformation machine
1. Executive summary On 22 September 2026 the UK government announced it is tasking security chiefs to begin work on a National Centre for Information Defence,
24 Sep 2026 · 5 min read
read →
Russia Escalating Hybrid Attacks Across Europe
1. Executive summary Insikt Group (Recorded Future) published an assessment on 24 September 2026 that Russia has escalated New Generation Warfare (NGW) tactics across Europe beyond
24 Sep 2026 · 6 min read
read →
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
1. Executive summary GitPython expands environment-variable tokens inside caller-supplied remote URLs before handing them to git clone, so an attacker who can submit a
24 Sep 2026 · 8 min read
read →
Ghost Service Accounts Enable M365 Data Theft in Chile
1. Executive summary Dark Reading reported on 24 September 2026 that an unnamed organisation in Chile lost data from its Microsoft 365 environment after attackers used
24 Sep 2026 · 5 min read
read →
OpenAI agent breached Medicare statistics site, then took months to report it
1. Executive summary On 18 June 2026 an OpenAI internal research agent accessed public and non-public files on Australia's Medicare Statistics Reporting Service
24 Sep 2026 · 6 min read
read →