FortiGuard Labs and Nozomi Networks describe a Linux botnet that disguises its command channel as replies from a Google STUN server and spreads through router and DVR flaws.
Danish authorities said unauthorized parties misused a private company's legitimate access to the Central Person Register to pull names, addresses and CPR numbers for about 8.8 million people.
Google stopped accepting product vulnerability reports for its Open Source Software VRP on October 1, blaming a surge of automated submissions that were mostly invalid.
CVE-2026-61500 lets an unauthenticated attacker predict HFS session signing keys and take over the admin account. Exploitation was seen on October 1.
Apple said on October 2 it will add controls so apps can only receive Full Disk Access through very explicit user action, citing the growing autonomy of AI agents on the desktop.
Rapid7 documented a new modular Linux implant called AVERAT alongside fresh BPFDoor variants, both abusing TCP port 25 to blend command-and-control traffic into ordinary mail flows.
The Apache Software Foundation released httpd 2.4.69 on October 1, closing 20 vulnerabilities. Five are rated moderate, including a stack overflow in mod_vhost_alias reachable through an oversized Host header.
Microsoft shipped V2 builds of its September 2026 Exchange Server security updates at the start of October, adding a fix for an elevation of privilege flaw it found internally.
In its first espionage alert made public, MI5 said the China General Technology Research Institute exists mainly to fund research that improves MSS spying capability, and that over 100 UK-linked academics contributed.
Socket says four theme extensions on the VS Code Marketplace and Open VSX are tied to the GlassWorm campaign, two of them confirmed malicious and using a Solana blockchain dead drop for command and control.
A working exploit generator and full write-up are now public for CVE-2026-43682, a kernel heap overflow Apple fixed in July. Mounting a crafted disk image is enough to corrupt kernel memory.
Kiteworks fixed CVE-2026-54154, a CVSS 10 flaw chain in its Email Protection Gateway that could let unauthenticated attackers run code as root. Version 9.4.1 fixes it.
