Security Industry Sources

Follow security research, antivirus tests and software updates from industry sources, with links to original reports and community discussions.
Live industry deskFresh security research, without the noiseScan the essentials, open the original report, or jump into a MalwareTips discussion.
Fine-tune the deskShow me the news I care about
Clear filters
Updated throughout the day

More industry reporting

20 fresh items on this page
Image from The Hacker News for Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
The Hacker NewsSecurity updates

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially
Read at The Hacker News
Image from The Hacker News for Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
The Hacker NewsSecurity updates

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting  PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was
Read at The Hacker News
Image from Help Net Security for AOMEI Backupper servers hijacked for minutes at a time to push backdoor
Help Net SecurityMalware & threats

AOMEI Backupper servers hijacked for minutes at a time to push backdoor

An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals. The tampered files belong to the software’s update and promotional pop-up mechanism, which periodically fetches instructions from AOMEI’s servers. The activity was observed on … More → The post AOMEI Backupper servers hijacked for minutes at a time to push backdoor appeared first on Help Net Security.
Read at Help Net Security
Image from Help Net Security for Incomplete security patches show hackers where to look next
Help Net SecurityMalware & threats

Incomplete security patches show hackers where to look next

Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year. “A fix would ship, a bypass would be found, and another fix would go out. Worried this was sample bias, we looked at every published CVE record … More → The post Incomplete security patches show hackers where to look next appeared first on Help Net Security.
Read at Help Net Security
Image from Help Net Security for ThreatModeler NexusAI tracks architectural changes and proposes security updates
Help Net SecurityMalware & threats

ThreatModeler NexusAI tracks architectural changes and proposes security updates

ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform. NexusAI helps enterprises automate more of the work involved in creating, analyzing, and maintaining threat models, enabling security teams to scale their impact without scaling manual effort. As AI accelerates application development, security teams face growing pressure to assess more applications, respond to architectural changes, and manage risk without slowing innovation. NexusAI addresses this challenge by taking … More → The post ThreatModeler NexusAI tracks architectural changes and proposes security updates appeared first on Help Net Security.
Read at Help Net Security
Image from The Hacker News for Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
The Hacker NewsMalware & threats

Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or
Read at The Hacker News
Image from Help Net Security for Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Help Net SecuritySecurity updates

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4. On 17 October, it updated the advisory to tell customers that version 4.0.9.8 resolves the issue, and a blog post warning about active … More → The post Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign appeared first on Help Net Security.
Read at Help Net Security
CISA Advisories
CISA AdvisoriesSecurity updates

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability   CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability  These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to F
Read at CISA Advisories
CISA Advisories
CISA AdvisoriesSecurity updates

#StopRansomware: SafePay Ransomware

Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication  October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics.  Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Following, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks. Affected Products CVE-2020-3259 [Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor] CVE-2023-20269 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] CVE-2023-27532 [CWE-306: Missing Authentication for Critical Function] CVE-2024-40711 [CWE-502: Deserialization of Untrusted Data] CVE-2024-40766 [CWE-284: Improper Access Control] Key Actions Regularly patch and update systems, especially firewalls, and other edge devices. Implement Zero Trust Principle. Restri
Read at CISA Advisories
Back
Top