Daily digest,
Critical Cisco Secure Email Gateway Vulnerability Exploited (+7 more)
Vulnerabilities
Critical Cisco Secure Email Gateway Vulnerability Exploited
Cisco has disclosed a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519, which allows unauthenticated remote attackers to execute commands with root privileges. This flaw arises from improper handling of email attachments when the File Reputation service is enabled. Active exploitation of this vulnerability has been confirmed, with attackers able to send crafted emails that compromise the system without user interaction. The vulnerability affects both physical and virtual appliances running vulnerable versions of Cisco AsyncOS, specifically those with Content Scanner Tools versions earlier than 25.3.0.5525. Cisco released patches on October 14, 2026, and has advised affected organizations to apply these updates immediately. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Organizations are urged to review their configurations to determine if they are at risk.
Vulnerability · 8 sources · score 78 · CVE-2024-20401, CVE-2025-20393, CVE-2026-20353, CVE-2026-76440, CVE-2026-76441
Critical CVE-2026-70229 in Active Directory Requires Immediate Patching
CVE-2026-70229 is a critical vulnerability in Windows Active Directory Domain Services that allows unauthenticated attackers to execute arbitrary code by sending specially crafted packets over the network. The flaw, rated CVSS 8.1, is due to incorrect authorization (CWE-863) and affects a wide range of systems, including Windows Server 2012 through 2025 and Windows 10 and 11 versions. While exploitation has not been publicly disclosed, Microsoft assesses it as 'Exploitation More Likely.' The vulnerability was published on October 13, 2026, alongside several others, including CVE-2026-105016, which has a higher CVSS score of 9.8. The October 2026 security update includes fixes for this flaw, and administrators are urged to apply the patches promptly to mitigate risks.
Vulnerability · 2 sources · score 61 · CVE-2026-105016, CVE-2026-108398, CVE-2026-70229, CVE-2026-96951
Microsoft Releases Patch for Windows 11 Mouse Stutter Bug
On October 13, 2026, Microsoft released security update KB5127648 for Windows 11, addressing a bug that caused mouse input stuttering in some games. This update applies to Windows 11 versions 24H2, 25H2, and 26H2. Although Microsoft confirmed the bug, it did not specify which games were affected or the root cause. The update also included fixes for over 1,400 security vulnerabilities, including two high-severity CVEs: CVE-2026-96951 and CVE-2026-108398, both published on the same day. Users experiencing mouse stutter while gaming are advised to install this update. The update is particularly important as it marks the end of support for Windows 11 24H2 and Pro editions. Microsoft has not confirmed whether specific reports of mouse stutter are linked to this bug.
Vulnerability · 2 sources · score 58 · CVE-2026-108398, CVE-2026-96951
Ransomware
Evolving Cyber Threats: Focus on Agentic AI and Ransomware in 2026
In 2026, the UK education and research sectors faced over 144,000 compromised username and password combinations found on the dark web, alongside eight significant ransomware attacks. The rise of agentic AI has introduced new vulnerabilities, enabling attackers to execute sophisticated phishing attempts and automate malicious actions with less human oversight. The Cyber Security and Resilience Bill (CSRB) is expanding regulatory requirements, mandating organizations to assess their cyber risks and improve supply chain security. New guidelines from the National Cyber Security Centre (NCSC) emphasize board oversight and the need for improved monitoring and AI risk management. Ransomware attacks are increasingly focused on data theft rather than system encryption, with 61 new criminal groups emerging globally in 2026. Cybersecurity Awareness Month is highlighting these evolving threats, with NIST focusing on agentic AI's implications for software development and security practices.
Supply Chain · 2 sources · score 55
Ransomware Attacks Surge in Costa Rica Amid Global Trends
Ransomware attacks in Costa Rica increased by 39% over the past year, with 32 recorded incidents, according to Microsoft's 2026 Digital Defense Report. This rise places Costa Rica among the top ten most affected nations globally. The report highlights a significant increase in ransomware activity, following previous major attacks on public institutions, including the 2022 Conti ransomware attack that disrupted government services. The CyberEdge Group's research indicates that 64% of organizations experienced ransomware attacks in 2025, with more than half paying ransoms despite low chances of data recovery. The average ransom demand has surged to $1.9 million in 2026, emphasizing the growing threat landscape. Cybersecurity experts recommend proactive measures, including consulting with cybersecurity insurers and preparing decision-making frameworks ahead of potential attacks.
Ransomware · 2 sources · score 55 · Conti, Hive
Breaches
Vibetech Exposes 13.7M Breached Credentials Online
An unprotected database linked to Vibetech, an AI software development company in India, exposed 13.7 million records of breached credentials, including names, phone numbers, email addresses, plaintext passwords, and bank account details. The data, collected from previous breaches, was accessible without authentication. Jeremiah Fowler, a cybersecurity researcher, reported that the largest dataset was from an AT&T data leak, containing nearly 8 million records. Other notable datasets included breaches from Amazon, Walmart, and even sensitive records labeled as coming from the FBI and Interpol. Following the disclosure, the database was secured, but the incident highlights ongoing risks associated with exposed breach repositories. Vibetech has not confirmed the legality of collecting such datasets. The incident has raised concerns about the potential misuse of the exposed data for identity theft and financial fraud.
Malware · 2 sources · score 59 · RedLine
Over 1 Million Texans Affected by CenterPoint Energy Data Breach
A data breach at CenterPoint Energy has compromised the personal information of over 1 million Texans, as reported by the Texas Attorney General's Office. The breach includes sensitive data such as names, addresses, Social Security numbers, and driver's license numbers. CenterPoint first disclosed the incident in a filing with the SEC on September 14, 2026, after becoming aware of an online post by a third party claiming to have obtained customer data. As of now, affected customers have not been notified, and the company is still assessing the scope of the breach. CenterPoint has activated its cybersecurity protocols and engaged external experts to investigate the incident. The company's electric and gas services remain operational and unaffected. Texas law mandates that businesses report breaches affecting at least 250 Texans within 30 days of discovery, and notify affected consumers within 60 days.
Breach · 2 sources · score 55
Korean Financial Institutions Face Data Leaks Amid Rising Cyberattacks
The Korean Federation of Community Credit Cooperatives (KFCC) confirmed a data leak affecting around 400 customers after a hacking attack on October 10, 2026. This incident follows a thwarted attack in September and is part of a broader trend, with 16 financial institutions reporting a total of 100,000 cases of leaked personal information. The leaked data includes customer names, birth dates, account numbers, and contact information. The Financial Services Commission (FSC) is investigating the incidents, which are suspected to involve IP addresses traced back to China, Thailand, and South Korea. KFCC has blocked the attack IPs and is enhancing security measures. The FSC is holding an emergency meeting to assess the security of the financial sector. Authorities have noted a rise in cyberattacks on South Korean financial institutions, many of which are reportedly linked to AI tools.
Breach · 2 sources · score 54
New on leak sites
25 victims listed on ransomware leak sites by 12 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-102255, CVE-2026-108398, CVE-2026-85097, CVE-2026-96951, CVE-2021-4104
- APT groups: Kimsuky, Silent Lynx, 313 Team, APT44
- Malware: ClickFix, Shai-Hulud Worm, AMOS, AsyncRAT, Chisel
- Campaigns: Operation Epic Fury, Arup Attack, Break The Silence, ClickFix campaign
- Vulnerabilities: Path Traversal
- Ransomware groups: BlackCat, Conti
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.