Company
Security Affairs is a cybersecurity news blog run by researcher Pierluigi Paganini, covering malware, data breaches, vulnerabilities, and threat intelligence.
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
Leaked chats reviewed by Recorded Future News show the Silent Ransom Group directing US-based recruits it calls 'agents' into law firm offices. For firms holding client data, an intrusion can start at reception with someone posing as a courier or an IT worker.
Reality
CISA added Apple's CoreGraphics zero-day CVE-2026-86950 to its KEV catalog, giving federal agencies until October 2, 2026 to patch. Only federal civilian agencies are bound by that date. Every other Apple fleet sets its own deadline for a bug Apple links to targeted attacks.
Reality
Three exploited flaws, three very different exposure classes. The self-hosted Metabase zero-day is the one with an unpatched population behind it.
Reality
Researcher Dancho Danchev matched 205 handles from a 2005-2008 Exploit.in dump to private messages on five later forums, 26 of them from active early members. A matching handle does not prove a matching person, so 205 is a ceiling, but the forum's core was only about 90 accounts, few enough to follow from board to board.
Reality
Revolut says its own systems were not breached; the fraudulent European Investigation Orders arrived from an authentic pec.interno.it mailbox, and the actor behind them claims six months inside Italian law-enforcement systems.
Reality
ENISA says in a July 2026 assessment that the research-and-develop delay defenders implicitly count on is disappearing as automated systems take over the attacker's work, with the remaining window measured in minutes.
Reality
Hunt.io rebuilt the framework from five directories the operators left open, and found the worker roles fixed while the model profile stays a swappable setting, with requests fronted by private proxies instead of vendor APIs.
Reality
Ransomnews validated the sample as real The Town 2025 buyer data, down to the 487.50-real student ticket, but every row carries a single export timestamp that points away from Ticketmaster and at an unnamed partner.
Reality
Recruiting and document review own this intrusion path, because the hire really does the job. Huntress found its five 2026 cases in passport photo metadata and in a PiKVM turning up on a new starter's laptop.
Reality
A forum seller wants $600 for what they say are 877,000 EV salary sacrifice driver records, and the 999-row sample published as proof holds up under structural testing in ways a fabricated file usually does not.
Reality
July's intrusions into US water utilities did not need an exploit. They needed a PLC on a cellular modem with nothing in front of it, and CISA's August 21 guidance is an inventory job.
Reality
A compiled timeline of identity-verification failures since 2011 puts nearly half the incidents in the category where what leaked was the face or the document itself.
Reality
The StopAndProtect campaign keeps its payloads, command channel and stolen-file storage on other people's blogs. That makes domain reputation a weaker signal, and cleanup somebody else's bill.
Reality
Tenable says autonomous agents mapped 21 Taiwanese government systems in four days. The way in was discoverable federation configuration and weak credentials, not a novel exploit.
Reality
A free 15.5 GB dump holds no passwords and no payment data, but every row carries Google Ad Manager cohort labels that chess.com's public API does not expose.
Reality