Cybersecurity

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The Hacker News Oct 2, 2026, 8:49 AM (1 week ago)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8)…

Read the full story on The Hacker News.

Read at source

Cybersecurity

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Today is Microsoft’s October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

BleepingComputer 1 hour ago

Cybersecurity

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.

SecurityWeek 2 hours ago

Cybersecurity

UK Housing Ombudsman Service investigates ‘security incident’

The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday.

BleepingComputer 2 hours ago

Cybersecurity

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it.

The Hacker News 3 hours ago

Cybersecurity

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.”

The Hacker News 3 hours ago

Cybersecurity

Adobe Patches 140 Vulnerabilities Across 10 Products

The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.

SecurityWeek 3 hours ago

Latest from The Hacker News

Artificial Intelligence

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.

The Hacker News 2 hours ago

Software

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13.

The Hacker News 3 hours ago

Cybersecurity

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user’s package without having to steal their credentials.

The Hacker News 4 hours ago

Cybersecurity

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users’ sensitive data to advertisers.

The Hacker News 7 hours ago