Automated feed
Threat Wire
Aggregated every six hours from CISA KEV, NIST NVD, CISA advisories and trade reporting, then deduplicated and stored. Free to read, and it will stay that way, because these are links to other people's public work. What a membership adds is the analyst layer on top of them.
What “Exploited” means
Yesterday
- NVDhigh8.1CVE-2015-5346
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web…
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
- REG
Cisco make-me-root email bug exploited as a 0-day by unknown crims
Both Switchzilla and CISA sound the alarm
- ARS
Fridge hack costing millions and sparking fires stemmed from poor security
Incident hitting 700 supermarkets exploited outdated devices exposed to the Internet.
- ARS
Epic says its new vibe-coded Epic Games Launcher is faster than Steam
But the new "Preview" app "will have some bugs," Epic warns.
- ARS
NATO may redeploy anti-drone defenses as attacks sink more Black Sea shipping
Suspected Russian drones have sunk or damaged 5 ships near Bulgaria and Romania.
- REG
Chaos ensues when AI interviewer meets AI interviewee
Things got weird, but there's a lesson to be learned: Don't trust a bot to negotiate for you
- ARS
Things are finally looking up for NASA's first missions to Venus in a generation
"This is great news for us. We're staffing up. We're accelerating."
- REG
Linux kernel devs drop obligatory confession of AI tool usage
Torvalds says contributors must understand their code, whatever tools they use
- ARS
Schools across US protest FCC plan that could disconnect kids from Internet
FCC chair threatens E-Rate fund, blames schools for kids' excessive screen time.
- ARS
Georgia man sues Flock, sheriff's office over alleged ALPR-fueled retaliation
Plaintiff claims cameras enabled warrantless tracking and monitoring after he previously sued over excessive force.
- ARS
Software development and rules stability: Prototype racing in 2030
With the end of IMSA’s 2026 season, we have thoughts about the future of the sport.
- BLEEP
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]
- REG
Security researchers spent 6 days doing their Chromework, built 1B user exploit
Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt
- ARS
Greta Gerwig channels Bowie in psychedelic The Magician's Nephew trailer
"Have you ever seen a world born?"
- THN
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
- BLEEP
Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]
- THN
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
- BLEEP
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]
- REG
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
- ARS
Researchers use AI to design proteins that cut up other proteins
AI design tools make proteins that break bonds that are stable for hundreds of years.
- THN
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
- ARS
Recording device hidden in toilet paper found in top-secret OpenAI meeting room
OpenAI engineer faces 5 years and $250K fine as FBI lobs foreign spy charges.
- THN
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud
- REG
Leap seconds face judgment day as time lords prepare to vote
Proposal would let UTC drift an hour from Earth's rotation, sparing computer systems awkward adjustments for centuries
- REG
Researchers cig-nal their faith in AI by taking up smoking
What are they puffing? Tobacco, apparently. Cancer researcher tells El Reg it's a bad bet
- ARS
Legendary FPS level designer Richard "Levelord" Gray dies at 68
Tributes pour in for the man behind iconic Duke Nukem 3D levels and much more.
- REG
Fire up that iPhone 1 emulation and party like it's 2007
Browser-based fun to remember a time before Apple's annual cash grab became a thing
- REG
New motherboards, old RAM, plenty of life left in yesterday's PCs
DDR4 makes a comeback as component costs rise, while Linux offers an escape from forced upgrades
- BLEEP
Microsoft fixes VPN issues caused by September Windows updates
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]
- REG
Tiny11 puts Windows 11 on a diet without the PowerShell workout
New desktop app simplifies stripping out bundled software, with heavier cuts carrying security and support risks