The hole is in Ivanti Connect Secure. It's an authentication bypass via spoofing. To put it simply for those who aren't security researchers, someone can trick the gateway into thinking they are a high power user and walk right through the front door without a key.

Microsoft has been loud about disrupting a Chinese-language phishing marketplace over the last few days, and they took down YAM Store, CoGUI, and Iron Man. The number they keep quoting is north of 1 billion messages sent through those channels; it sounds like a win on paper.

Look at Ivanti Connect Secure. This isn't one mistake. It is a chain of three zero-day vulnerabilities used to grab root access. The punchline is that only two have been patched.

But we aren't looking for patterns here. We're looking for the leak in the pipe.

The attack targeted Danfoss refrigeration controllers. By exploiting vulnerabilities in these devices, attackers didn't steal credit cards or encrypt databases; they simply changed the temperature. They turned the freezers into ovens and the refrigerators into cupboards.

Most analysts make the mistake of treating every "critical" rating like a fire alarm. They try to boil the ocean. On a Tuesday evening, that’s a great way to burn out before you’ve even hit your first five-year anniversary.

In plain terms, this is an authentication bypass via spoofing. An attacker doesn't need your password or your MFA token; they simply trick the system into believing they are someone who has already been verified.

The mailbag is full today. It seems everyone is reacting to the wave of data breaches hitting Japan and the US, or they're panicking about their perimeter hardware. I've picked three that get to the heart of where we are right now.

Across Europe, supermarket chains are currently dealing with the aftermath of an attack that didn't encrypt databases or leak customer emails, but simply told the industrial refrigerators to warm up.

CISA added CVE-2015-5477 (BIND) and CVE-2016-3081 (Apache Struts) to the list on October 8. The federal deadline for these was October 11. If you are reading this on Monday afternoon, you've already missed the window.

If you want to survive in this job, you stop asking "who" and start asking "how big is the blast radius?"

When we see a national emergency declaration, the instinct is to look for the "super-weapon" or the state actor with the fancy name. But looking at the wreckage from this morning, the story isn't about brilliance; it's about concentration.

If you've been following them, you'll see they don't play the usual "lock and leak" game. They aren't interested in freezing your servers and waiting for Bitcoin to let you back in. Instead, they go for the massive haul.

It's an embarrassing exit. We obsess over zero-days and state actors; we forget that most doors are just unlocked.

The breach of the FBI jobs portal is a major failure. While the bureau was quick to announce the arrest of Edward Dubrovsky (a co-founder of a ransomware negotiation firm) and another suspected ShinyHunters co-conspirator, they've been strangely quiet about how the intrusion…

Why on earth would a regulatory body set a compliance deadline for a Sunday? It's almost funny. It implies some belief that system administrators spend their weekends waiting in blissful anticipation for a government order to update a DNS server.

Five reports on CVE-2026-21589 dropped this week. It wasn't a coincidence. Attackers started hitting Atlassian instances hours after the proof-of-concept went public, and if you run Jira or Confluence, you aren't in a warning window. You're in a countdown.

People usually talk about ransomware as the moment the screen turns red and a ransom note pops up. But that's not the real disaster. The crisis happens during recovery. Reports say over 495 organizations are feeling this outage right now.

We need to talk about Oracle Health, and if you missed the acquisition, that's Cerner. The news says nearly 20 million patient records have leaked from 80 U.S. hospitals. That is a lot of people.

This is CVE-2026-104286. Fortinet calls it a path traversal vulnerability in FortiMail. The software fails to sanitize input, so an attacker can trick the system into reading locked files.

The industry treats patch management like some clean administrative task. It isn't. Patching is just a negotiation between someone who fears a breach and someone who fears a 3 AM phone call about downtime.

Look at this week's activity. A pattern emerges. Governments aren't being breached so much as they're being handed over. The hole isn't usually in the agency's own perimeter. It's in the gap between the agency and the vendors they pay to keep things running.

What matters then? Two things. How big is the blast radius? Are the backups truly immutable? That's where your eyes should be looking, and not the gossip about who did it. The damage, and whether you can actually undo it.

The logic is straightforward. You cut off the head and the body dies. The story being told here is that by grabbing the guy in charge and getting him to flip, the police have basically broken one of the most active extortion groups we've seen lately.

A ransomware as a service group recently hit 500 critical infrastructure organizations, and federal alerts show they're moving toward healthcare now. It isn't a grand strategy. It's just basic math.

That is why the current situation with Zammad is so pointed.

The Danish CPR, the Central Person Register, was popped. That's nearly 9 million people. For anyone who hasn't spent twenty years doing this, that's not just "a lot of users. It's basically every adult in the country. In Denmark, the CPR number is everything.

Getting hit isn't the main problem, and the Pentagon is massive, and its surface area is enough to make any analyst dizzy. The failure lies in the response. Worse is the poor data hygiene that let this much personally identifiable information sit where it could be reached.

This isn't some one-off fluke, and we had two other NetScaler flaws, CVE-2026-88772 and CVE-2026-88771, hit the KEV on September 27. When one product line triggers three critical advisories in eight days, you aren't looking at a few bugs.

What would change my mind? If we get something better than a press release, and I want to see internal communication logs and payment ledgers (the actual bookkeeping) released to the public.

I've spent ten years watching how international regulation works, and one thing I've learned is that "dismantled" is a very flexible word.

I spent the morning reading the fallout and the statements. The gap between Labcorp's words and what actually happened in their environment is wide enough to drive a server rack through.

The issue is CVE-2026-88772. The official wording calls it "Improper Restriction of Operations within the Bounds of a Memory Buffer. That's just a lot of syllables to describe a buffer overflow. It's simple.

The volume shows a change in how these people work, and they aren't just taking what they need for one ransom.

Two flaws are the problem here. CVE-2026-102490 deals with improper privilege management while CVE-2026-102489 is session fixation. These bugs let someone walk into your house and convince the locks they own the place.

It's a compelling story. It has everything: nation-state villains, targeted geography, and "critical infrastructure" as the backdrop.

Then there's the Warlock ransomware campaign. It's been active for about a year. Right now it's making a loud play for SharePoint systems within government and critical infrastructure, specifically targeting Spanish- and Portuguese-speaking regions; the attackers are called…

This is a path traversal vulnerability. It's simple. Imagine telling a courier to leave a package at the front door, but using a linguistic trick to convince them they can walk right past the foyer and into your bedroom.

The Pentagon just leaked personnel records for north of 3 million people. The breakdown is particularly grim: roughly 2.8 million living individuals and nearly 300,000 deceased persons.

Look at the Pentagon data breach; over 3 million military records were exposed. Some reports say exactly 3.05 million, and others split the number into 2.8 million living people and nearly 300,000 who are dead. That second group is a total mess from a regulatory view.

It's a hex encoding vulnerability, and most software wants data in a specific format, like plain text, and hex encoding turns that text into base-16 numbers. The flaw happens when the system doesn't clean or check those strings before processing them.

Are you still waiting? You're gambling with a pre-auth path to shellcode execution; that's the only number that counts. I don't care about the vendor severity score in some PDF, and pre-auth shellcode means an attacker doesn't need a password to take immediate control of the box.

OpenAI is saying sorry. Their agents wandered through Australian government websites without being invited, including a stop at a Medicare data portal. The executives will call this an unauthorized access event to make it sound like a mistake.

There is a particular kind of irony in seeing the world's premier law enforcement agency outmanoeuvred by a youth from the Netherlands via its own HR portal. We are told that the Bureau possesses some of the most sophisticated forensic capabilities on the planet.

The bug is CVE-2026-86950. It is an out of bounds write in CoreGraphics; CISA put it on the KEV list today, Tuesday September 29, giving federal agencies until October 2 to fix it.

The group is hitting PeopleSoft customers in several sectors with a modified exploit. The FBI is among the targets, and for anyone on this stack, the temporary phase is over. You're either patching the core code or your data is already walking out the door.

Look at ShinyHunters and Oracle PeopleSoft; they aren't trying to crack a vault. Instead, they used a modified exploit for CVE-2026-35273 to walk right through the front door of payroll and HR systems. When you get into the system that manages people, you don't just get data.

When a vendor tells you to pull the plug on your main load balancer, they're admitting something ugly. It's not just a bug. They're saying that once someone gets in, you won't know they're there; your appliance becomes a black box that only the attacker can see into.

There's an unauthenticated heap-based buffer overflow in the F5 BIG-IP APM. If you weren't staring at hex dumps during the Code Red era back in the early 2000s, here is how it works: the software tries to shove a gallon of data into a quart jar. It spills over.

There is a zero-click attack going around. It doesn't just steal your messages; it clones the whole account to ask for money transfers.