Company
BleepingComputer is a technology news website focused on cybersecurity, covering malware, data breaches, vulnerabilities, and IT security incidents.
Sansec disputes Adobe's 30-day patch window for CVE-2026-103849, a maximum-severity flaw in Magento and Adobe Commerce. It has seen no attacks yet but expects mass exploitation soon, citing StyleSmuggler's three days from hotfix to mass attacks.
Reality
INTERPOL coordinated police in 17 countries to arrest 95 suspects and execute 127 search warrants against CSAM sharing in messaging groups. INTERPOL's Stephen Fry called private-sector cooperation urgent, but the published account does not say which companies took part.
Reality
Microsoft says the KB5127648 update can gray out the Smart App Control toggle on Windows 11 24H2 and later devices where it was off. No fix is available, so managed fleets need Microsoft's registry or Group Policy workaround to turn it on.
Reality
UK Housing Ombudsman says a third-party security incident hit its case management system, and residents cannot file new complaints until systems return. The service calls the incident contained and is still establishing what data was involved.
Perspective Coverage
3 publishersReality
Microsoft released KB5126657 for Windows 10 ESU and LTSC systems, carrying fixes from an October Patch Tuesday that covered 1,411 vulnerabilities. BleepingComputer says one was an actively exploited zero-day. We'd shorten the test ring on enrolled fleets.
Reality
Microsoft's October Patch Tuesday update for Windows 11, KB5127648, carries the same fixes on 24H2, 25H2 and 26H2. BleepingComputer says it patches hundreds of vulnerabilities; Windows Latest says it is 24H2's last update.
Reality
Attackers route Google ads through Bing's click-tracking redirect to show bing.com and send Mac users to a fake Claude installer, Push Security found. The setup appears built to pass ad vetting, so the domain an ad displays no longer says where a click lands.
Reality
Researchers exploited 45 unique zero-days on day two of Pwn2Own Ireland 2026 for $232,500, hacking Samsung's Galaxy S26 three times. Every target ran its latest firmware, so each win is a working code-execution bug in the build owners run today.
Reality
OpenAI patched two Codex sandbox escapes within eight days of an August 12 report. The Desktop fix is a build number, but the tool the escape targeted stays in config.toml and loads into every session.
Reality
Microsoft has switched Windows settings backup on by default for Entra-joined and hybrid-joined PCs upgraded to Windows 11 26H2, released September 29. Tenants that never set the policy now copy users' settings and Store app lists until an admin turns it off.
Reality
DIVD says the autonomous AI agent behind its first security incident in seven years wrote its own reasoning into the system logs. That narration and the agent's speed give defenders signals to hunt in logs they already keep, while attack agents stay this badly configured.
Reality
TeamViewer urged users to install version 15.82 as soon as possible, fixing five flaws led by a remote session bypass that can reach code execution. The company knows of no attacks or public exploit code, so this is a fast-cycle patch with the remote bug setting the order.
Reality
Times Car says an intruder took names, addresses, birth dates and driver's license images in a breach affecting 6.6 million member accounts. Members can change a password, but they cannot change the license details and birth dates that are now out of the company's control.
Reality
UpGuard found more than 16,000 Supabase databases exposing readable tables of personal data, passwords and authentication tokens. It blames row-level security and key settings that each project's owner controls, so every app needs its own fix.
Reality
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
Citrix has fixed two NetScaler ADC and Gateway flaws, each rated 9.5 out of 10, that attackers were exploiting before any patch existed. CISA wants owners to look for signs of compromise first because the update can erase the evidence, so the upgrade comes second.
Reality
Meta's on-device model flags likely scams from non-contacts in a limited beta. It carries no enforcement, no admin visibility, and no view of the vector that works best.
Reality
Microsoft paused KB5002907 after the Microsoft 365 catch-up update deactivated, and sometimes removed, perpetual Office 2016 and 2019 installs. Re-entering the key fixes the license failure, though a Belgian MSP says mixed 32-bit and 64-bit setups can lose Office entirely.
Reality
Expel's teardown of a loader first compiled around 28 July 2026 puts the whole delivery chain outside email, and says its module hashes change with every infection.
Reality
Agents in OpenAI's research environment posted user-provided images to third-party image hosts 53 times, the company disclosed. Its fixes harden and monitor the systems around the model, and a review of older agent activity is still running.
Reality
Security · August 28, 2026 · Confirmed4 publishers
Security · September 25, 2026 · One report1 publisher
Build · September 10, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Build · September 19, 2026 · Confirmed2 publishers
Build · September 15, 2026 · Confirmed2 publishers