Ravie LakshmananSep 18, 2026Mobile Security / Malware Cybersecurity researchers have flagged a new Android malware called RatHat that’s assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. “Distributed… Read More "RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall"
Technology standards across Europe are evolving to prepare manufacturers for the EU Cyber Resilience Act (CRA) that takes full effect in December 2027. The European Telecommunications Standards Institute (ETSI), one of the three official standards organizations recognized by the EU,… Read More "ETSI Proposes 17 Cybersecurity Standards to Support EU CRA"
Vendor risk management is hard and it’s getting harder. But it doesn’t have to be. Business units are outsourcing more of their operations to third-party suppliers. In turn, these suppliers outsource to their own service providers. It’s undeniable, the average organization’s exposure… Read More "Vendor Risk Management Best Practices in 2026"
Swati KhandelwalSep 17, 2026Vulnerability / Artificial Intelligence Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a… Read More "Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files"
More than 40,000 WordPress sites have been exposed to an authentication bypass flaw in the User Profile Builder plugin that can let unauthenticated attackers access the site’s administrator account. The vulnerability, tracked as CVE-2026-15826 and given a critical CVSS rating… Read More "WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover"
ISO 27001:2022 compliance provides greater assurance that an organization is adequately managing its cybersecurity practices, such as protecting personal data and other types of sensitive data. Third-party risk management (TPRM) programs can benefit immensely from implementing the relevant ISO 270001… Read More "Meeting the Third-Party Risk Requirements of ISO 27001 in 2026"
Ravie LakshmananSep 17, 2026Hacking News / Cybersecurity News Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and… Read More "ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories"
A vulnerability in UNISOC modem firmware can allow arbitrary code execution with kernel privileges from the modem context, potentially allowing an attacker to modify Android kernel code. The flaw stems from a lack of isolation between modem memory and kernel… Read More "UNISOC Modem Flaw Enables Remote Code Execution via Video Calls"
The National Institute of Standards and Technology (NIST) has responded to the increased prevalence of third-party risks by specifying industry standards for securing the supply chain attack surface – the attack surface most vulnerable to third-party risks. Those controls belong… Read More "Meeting the Third-Party Risk Requirements of NIST 800-53 in 2026"
A critical vulnerability in Check Point’s Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy… Read More "Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root"
