Cybersecurity

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after an unidentified threat actor accessed a sensitive API credential. Researchers from Huntress observed sign-in activity across nearly 1,000 Entra tenants, with over 300 sign-ins appearing successful. The compromised credential allowed attackers to bypass multi-factor authentication and access Microsoft 365 applications like Exchange Online…

CISA has republished a vendor advisory detailing multiple vulnerabilities in Hitachi Energy MicroSCADA X SYS600 product versions 10.7 and 10.8. The issues include a CSV injection flaw and an incorrect implementation of the authentication algorithm that could allow unauthorized access or privilege escalation. Researchers from Sandia National Laboratories reported the vulnerabilities to CISA. The advisory…

CISA issued an advisory for two vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier. The flaws, identified as CVE-2026-109812 and CVE-2026-109813, allow attackers with adjacent network access to steal sensitive data or compromise communications. Moxa has released firmware version 1.4.1 to fix the issues, which users can install via the device web…

Symantec researchers reported that Russian government-linked hackers compromised two defense companies and a law enforcement agency in NATO countries. The group, known as Swallowtail or APT28, targeted a naval shipbuilder, an aircraft engine manufacturer, and a police agency. Analysts observed hands-on-keyboard activity where human operators manually stole credentials from the shipbuilder over a week. The…

Hitachi Energy is aware of vulnerabilities affecting RTU500 product versions listed in the document. If exploited, these vulnerabilities can impact the confidentiality, integrity, and availability of the product. The advisory identifies specific firmware versions, such as 13.5.1 through 13.5.4, as affected by issues like NULL pointer dereference. Users are directed to refer to the Recommended…

Researchers from the SHARE Foundation and The Citizen Lab confirmed that Pegasus spyware infected the devices of two prominent Serbian figures. Vladan Ðokić, the rector of the University of Belgrade, and Rade Bajić, a prosecutor, were identified as targets of the surveillance. The Citizen Lab report stated that the infection used a zero-click exploit, requiring…

The Department of Homeland Security is prohibiting civilian federal agencies from using DeepSeek and its affiliates. The order cites national security risks, including data storage on servers in China and potential malware threats. Agencies must remove existing DeepSeek products and exclude them from future procurements. Exceptions require a compelling justification submitted 60 days in advance….

The Treasury Inspector General for Tax Administration assessed the IRS information security program as ineffective for the second year in a row. A report dated September 15, 2026, revealed that six of seven sampled systems had critical vulnerabilities left unfixed beyond the 30-day limit. The agency also reported 841 privileged service accounts operating outside its…

The Federal Chief Information Security Officer's Council will host a governmentwide tabletop exercise in early November to test resilience against AI-enabled cyber attacks. Acting federal CISO Mike Duffy stated the event aims to ensure agencies have the necessary capabilities and processes to respond to evolving threats. Duffy noted that cyber attacks using artificial intelligence increased…

Sen. Ron Wyden called on the Cybersecurity and Infrastructure Security Agency and Office of Management and Budget to implement Encrypted Client Hello across federal websites. He identified at least 350 sites lacking this protection, which secures the specific website name during data transmission. Wyden warned that exposed website names could allow hackers to identify whistleblowers…