Know what changed. Know what matters.

A patched CVE-2026-96940 lets authenticated attackers read other users’ mailboxes on Microsoft Exchange servers.

Apple requires app developers to declare full‑disk access usage in macOS Monterey, aiming to curb AI agents that silently harvest user data.

A new China-aligned cyber‑espionage group has used Microsoft-based phishing to target U.S. AI policy experts.

Saif al‑Din Khader, known online as “Rey,” was detained in Jordan on Sept. 29, 2026 and is cooperating with U.S. authorities, helping expose the ShinyHunters ransomware crew.

The suspected China‑linked threat actor Warlock exploited Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware against organizations in Spanish‑ and Portuguese‑speaking countries.

A critical vulnerability in GitLab’s AI gateway lets a logged-in user run commands if they have Duo Agent Platform access, requiring immediate patching of self-hosted instances.

A new espionage effort targets Asian governments by exploiting legitimate Microsoft tools for hidden command channels.

A new round of credit‑monitoring tools now includes dark‑web checks, helping users spot stolen data before attackers can exploit it.

Spanish authorities detain a teen linked to the KillSec ransomware gang and take control of its data-leak website on September 30.

OpenAI disrupts a Moonshot‑linked campaign that attempted to extract hidden reasoning from its models.

The European Union plans to revise its General Data Protection Regulation with harsher penalties for non‑compliance, potentially starting next year.

A global study finds consumer losses from online fraud reached $15 billion and are rising.