Company
SecurityWeek is a cybersecurity news outlet covering vulnerabilities, breaches, threat intelligence, and advisories for IT security professionals.
France's cyber agency ANSSI says the attack that hit about 700 supermarkets also reached Copeland and Dixell XWEB refrigeration controllers. Danfoss says most of its affected units are end-of-life and unpatched.
Reality
Booz Allen says AI agents met every objective in eight OT lab scenarios, reaching an industrial control network in little more than 16 minutes. The researchers warn that the window to prepare is closing, but the tests ran only in the firm's own isolated lab.
Reality
Siemens published 17 ICS advisories on Patch Tuesday, with critical flaws in Simatic S7-1500 CPUs, Industrial Edge and Ruggedcom Crossbow SAC. Some are patched; for others Siemens has issued only mitigations.
Reality
Daniel Rhyne got 32 months in federal prison for planting scheduled tasks on his industrial employer's domain controller that locked the firm out. Access to that one server let a single engineer delete or reset 318 accounts and change local administrator passwords on 3,538 machines.
Reality
George Washington University researchers say a formula predicts how many good outputs a chatbot gives before its first bad one, across seven open-weight models. Their proposed check sits inside the model, so offline AI companions on personal devices, with no cloud filter and no way to patch weights, would need it before they ship.
Reality
Google's October 6 Chrome desktop update fixes 247 security flaws, four of them rated Critical. The fixes apply when Chrome relaunches, so a browser nobody closes keeps running the vulnerable build until someone restarts it.
Reality
Google's October Android bulletin fixes 25 flaws, seven critical, under one 2026-10-01 patch level, ending the two-part monthly split. With no exploitation reported, fleets can roll it normally once compliance checks stop expecting a second October level.
Reality
Microsoft shipped 22 updates, six of them scored 10.0, mostly in Entra ID, Exchange Online and Azure. Fixed server-side is not the same as verified in your tenant.
Reality
SecurityWeek says awareness training has failed against help desk vishing, citing attacks that cost MGM an estimated $100 million. The fix it profiles is Netarx's live-call scanner for cloned voices and spoofed devices, but in both breaches it cites, callers talked help desk staff into granting access.
Reality
China-linked Warlock operators hit at least four organisations through SharePoint flaws in two months, Symantec says. Its report lists six 2026 SharePoint CVEs only as possible additions, and the entry it documents is still older flaws on servers never patched or mitigated.
Reality
Kiteworks told all customers to shut down for about nine hours after federal intelligence said a threat actor might target certain of its systems. Self-hosted Advanced Forms users also need Kiteworks support to confirm the fix, beyond version 9.5.1, before restarting that feature.
Reality
The August 2026 Critical Security Patch Update carried 943 fixes across 23 product families, roughly 65% of Oracle's largest quarterly release. Monthly windows now need quarterly-sized capacity.
Reality
According to SecurityWeek, every technique in the chain was ordinary and the detection stack correlated it correctly. The time was lost in escalation, the part of the playbook most teams still size for an intruder working at human speed.
Reality
ShinyHunters defaced Clop's leak site, demanded an eight-figure sum and threatened to name firms that allegedly paid Clop in the Oracle EBS campaign. Only ShinyHunters vouches for its theft claims. The firms it would name are victims whose payments were meant to stay private.
Reality
WSO2 published the fix in May. watchTowr saw forged tokens arrive at its honeypot in September. Its own replay against a correctly targeted deployment came back with the credentials the gateway holds.
Reality
Graz University of Technology researchers used OS file-change alerts to identify sites another Windows user visited with 97.8% accuracy in Firefox. Every attack needs code already running on the device; on Android, an app that asks for no permissions is enough.
Reality
ISC fixed fourteen flaws in BIND 9.20.29 and 9.21.26, with no workarounds for any of them. The unauthenticated crash is one of only two that never reached the end-of-life 9.18 branch.
Reality
Astrana Health's SEC filing describes impersonation of its own staff and a spoofed corporate number as the way onto its servers, and says private and confidential data was exfiltrated. No group has claimed it.
Reality
The public proof-of-concept watches Defender's update directories, hoards nearly all the free space on C: with delete-on-close files, and hands the space back once the update has already failed. At rest, the disk looks normal.
Reality
CrowdSec's final analysis puts the entry point in a former employee's development environment, hit by the TanStack npm malware in May. Its own organisation audit logs did not keep the clone events, so GitHub Support supplied them.
Reality
Security · September 16, 2026 · Confirmed2 publishers
Security · September 16, 2026 · Confirmed2 publishers
Build · September 1, 2026 · One report1 publisher
Security · August 29, 2026 · Confirmed2 publishers
Security · August 14, 2026 · Confirmed2 publishers