SecurityWeek

The malware framework uses a modular architecture and a custom executable file format for long-term persistence.

Apple released iOS and macOS updates to patch a zero-day vulnerability (CVE-2026-86950) reported by Meta’s product security team.

The misuse and abuse of AI-generated voice is growing. Modulate’s intention is to allow real time detection and intervention. 

SecurityWeek seeks original, vendor-neutral presentations that help cybersecurity leaders navigate emerging threats, strengthen resilience, and address the strategic challenges facing today’s enterprise security programs.

Cameron John Wagenius was sentenced to 70 months in prison for stealing information from the wireless carriers.

The Medicaid IDs and other information of Medicaid and DC Healthcare Alliance beneficiaries were exposed.

The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273.

A New Mexico jury has found Facebook liable for deceiving users about privacy protections on the platform.

The platform combines open source software and a reference system design to keep AI agents within set boundaries.

The company says the measure was precautionary and that it has no evidence of Kiteworks or customer systems being compromised.

Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.

CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28.

The US and China agreed to set up a communication mechanism for artificial intelligence-related incidents.

The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions.

OpenAI’s CEO said there is an “extensive and ongoing review related to our agents’ use of internet access during training and evaluation.”

Noteworthy stories that might have slipped under the radar: BragJack attack against browser AI assistants, TDengine flaw threatens industrial telemetry uptime, Ubuntu update overhaul.

Bitget’s security systems caught the unauthorized transfers on September 24, and some wallet addresses linked to the attacker have been frozen.

Homeland Security Secretary Markwayne Mullin tasked CISA with developing the plan in July. 

Ardit Kutleshi created and operated Rydox, which allowed miscreants to trade PII and cybercrime tools and services.

Researchers show that file-change notification systems can leak keystroke timing, browsing activity, and WhatsApp media events.