F5 BIG-IP APM Zero-Day: What CVE-2026-94127 Means for OAuth Deployments
F5 has issued engineering hotfixes for CVE-2026-94127, a critical vulnerability in BIG-IP Access Policy Manager (APM) that has been exploited in the wild. The key scoping detail is configuration: the…
Japan Dismantles First North Korean Laptop Farm as Allies Detail WaterPlum Campaign
Japan dismantled its first North Korean laptop farm while the United States, Japan, Germany and Australia published a joint report on the broader WaterPlum campaign, SecurityWeek reported. The activity underscores…
BigCommerce Customer Data Accessed Through Compromised Ribon Application Key
Attackers used a compromised BigCommerce application key held by Ribon to access customer data, according to SecurityWeek. The incident highlights the access risk created when third-party applications hold broad or…
Malicious indexed-btree npm Package Reaches Millions of Downloads
A malicious npm package named indexed-btree, presented as the legitimate sorted-btree package, accumulated millions of downloads, SecurityWeek reported. The package reportedly hid a malware trigger in a prototype method. Development…
Zyxel GS1900 Switch Vulnerability Exploited in Chinese-Linked Attacks
A Chinese threat actor has targeted vulnerable Zyxel GS1900 switches worldwide for sensitive-information exfiltration, SecurityWeek reported. The activity follows reporting on active exploitation of a flaw affecting the switch line.…
WordPress Patches Click2Shell Vulnerability That Could Lead to Remote Code Execution
WordPress has patched a vulnerability researchers call Click2Shell. According to SecurityWeek, the issue could let an attacker install themes and achieve remote code execution. Site owners should apply the relevant…
CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 22 after evidence of active exploitation. The agency’s alert identifies the additions as affecting Check Point products. Organizations…
SonicWall Gen 6 end of support raises firewall replacement and exposure concerns
What happened: Spiceworks published guidance on the end-of-support status for SonicWall Generation 6 firewalls and the resulting planning considerations for affected organizations. Why it matters: Perimeter devices are high-value targets.…
Cohesity introduces resilience controls for AI agent infrastructure
What happened: Cohesity announced Agent Resilience, a product initiative aimed at protecting and recovering infrastructure used by AI agents. This is a vendor announcement; organizations should evaluate the claimed capabilities…
UK Cyber Bill reporting rule leaves only 10% of surveyed organizations confident
What happened: Channel Insider reported that only 10% of respondents to a survey expressed confidence in meeting a proposed 24-hour cyber-incident reporting requirement associated with the UK Cyber Bill. Why…