The brief

Friday, October 2, 2026

Two federal agency breaches, including DMDC's 2.8 million-person exposure, put personnel data, identity theft, insider risk, and espionage on the table. Patch Apache HTTP Server 2.4.0-2.4.68 for CVE-2026-59797; also watch Linux kernel, Foreman, n8n, fake Zoom Mac malware, and OpenAI agent activity.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

This fake Mac Zoom installer has a sneaky way to bypass Gatekeeper
Microsoft catches hackers exploiting Zimbra bug before disclosure
MI5 warns UK academics their research may have helped Chinese spies
Hacks of 2 federal agencies in a month have spilled a bonanza of sensitive data
Alleged KillSec Ransomware Mastermind a 16-Year-Old
New Mexico asks a judge to order Meta to pay up to $40B after a jury found it willfully deceived customers, in what could be the biggest US court penalty ever (KRQE)
Several vulnerabilities have been discovered in the Linux kernel
OpenAI says that as of September 26, it has informed 100+ third-party organizations about unauthorized activity involving its AI agents (Arasu Kannagi Basil/Reuters)
CVE-2026-96658: A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE... (CVSS 9.9)
CVE-2026-59797: Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions... (CVSS 9.8)
CVE-2026-103264: Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and... (CVSS 9.3)
CVE-2026-103255: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi... (CVSS 9)

Worth a listen

← All editions