Today's cybersecurity news highlights several critical vulnerabilities being actively exploited, alongside significant law enforcement actions against major threat groups. We're seeing a continued focus on securing open-source projects and addressing the evolving risks posed by AI in business operations.
Critical Flaws in AhsayCBS Backup Utility Actively ExploitedVulnerability
Threat actors are exploiting unpatched vulnerabilities in AhsayCBS, a backup management platform. These flaws allow attackers to bypass authentication and execute operating system commands, ultimately leading to the deployment of webshells and cryptocurrency miners on affected systems.
Why it matters: If your business uses AhsayCBS for backups, it's crucial to apply available patches immediately to prevent unauthorized access and protect your data from being compromised or used for illicit cryptocurrency mining.
Read more at The Hacker News ↗
FBI Continues Crackdown on ShinyHunters with New ArrestBreach
The FBI has announced another arrest in connection with the ShinyHunters extortion group, following its alleged breach of the FBI's jobs portal and theft of sensitive data. This latest apprehension signals an ongoing effort by law enforcement to dismantle the group and its associates.
Why it matters: This demonstrates that law enforcement is actively pursuing cybercriminals, reinforcing the importance of robust security practices to avoid becoming a target and facing similar legal repercussions.
Read more at The Hacker News ↗
Citrix Warns of Critical NetScaler RCE Flaw, Urges Immediate PatchingVulnerability
Citrix has released urgent patches for a critical memory overflow vulnerability affecting its NetScaler ADC and NetScaler Gateway products. This flaw, CVE-2026-107406, could enable remote code execution or denial-of-service under specific configurations, posing a severe risk to affected systems.
Why it matters: If your business uses NetScaler products, it is vital to apply these patches without delay to prevent attackers from gaining control of your systems or disrupting your services.
Read more at The Hacker News ↗
China-Linked Flax Typhoon Exploits Five Flaws, CISA Issues DeadlineThreat
The China-linked threat actor known as Flax Typhoon has been observed exploiting five distinct security vulnerabilities, prompting CISA to add them to its Known Exploited Vulnerabilities catalog. Federal agencies are mandated to patch these flaws by October 11 to mitigate ongoing risks.
Why it matters: Even if your business isn't a federal agency, the active exploitation of these vulnerabilities by a sophisticated threat actor means you should prioritize patching systems affected by CVE-2015-3306 (ProFTPD) and other listed flaws to protect against similar attacks.
Read more at The Hacker News ↗
Exploit Published for Pre-Authentication AnyDesk Linux FlawVulnerability
Security researchers have released a working exploit for a pre-authentication remote code execution flaw in AnyDesk for Linux, which grants attackers root access without prior connection approval. Although AnyDesk patched this issue in version 8.0.3, it was initially described as a crash fix without a CVE.
Why it matters: If your business uses AnyDesk on Linux, ensure all installations are updated to version 8.0.3 or later immediately to prevent unapproved remote root access to your systems.
Read more at The Hacker News ↗
Germany Arrests Alleged Qilin Ransomware MemberRansomware
A suspected core member of the Qilin ransomware group has been arrested in Germany following extradition from Japan. This international collaboration marks a significant win for law enforcement against prominent cybercriminal organizations.
Why it matters: While arrests don't eliminate the threat, they demonstrate law enforcement's commitment to disrupting ransomware groups, emphasizing that businesses must continue to invest in strong defenses to avoid becoming victims.
Credential-Stealing GitHub Actions Workflows DiscoveredThreat
Cybersecurity researchers have uncovered a credential-theft campaign infiltrating tens of thousands of GitHub repositories. Attackers compromised maintainer accounts to push malicious GitHub Actions workflows, designed to steal credentials, into numerous open-source projects.
Why it matters: If your business uses GitHub Actions, review your workflows for any unauthorized changes and ensure multi-factor authentication is enforced for all repository maintainers to prevent credential compromise.
Read more at The Hacker News ↗
Anthropic Launches Free AI Vulnerability Scanner for Open-SourceOther
Anthropic has introduced OSS Scanner, a new, free, opt-in service that utilizes AI to identify vulnerabilities within open-source projects. This initiative aims to enhance the security of the open-source ecosystem by providing thorough, periodic security scans at no cost.
Why it matters: For small businesses leveraging open-source components, this tool could offer an additional layer of free security analysis, helping to identify and address potential vulnerabilities before they are exploited.
Read more at The Hacker News ↗
Pwn2Own Ireland: Google Pixel 10 Hacked, $1.2M in Zero-Days DisclosedVulnerability
At Pwn2Own Ireland, three research teams successfully exploited fully patched Google Pixel 10 phones, demonstrating remote hacks and uncovering multiple zero-day vulnerabilities. The contest awarded over $1.2 million for 98 zero-day flaws across various targets, including phones, printers, and AI infrastructure.
Why it matters: This highlights that even fully patched, modern devices can have exploitable vulnerabilities, reinforcing the need for businesses to stay vigilant, apply updates as soon as they are available, and consider layered security approaches.
Read more at The Hacker News ↗
FBI Disrupts Chinese State-Sponsored Flax Typhoon Hacking ToolsThreat
The FBI and Department of Justice have successfully disrupted malicious tools used by the China-linked Flax Typhoon threat group, seizing several domains and blocking access to platforms. These tools were employed to scan and infiltrate critical infrastructure in the U.S. and other nations.
Why it matters: While directly targeting critical infrastructure, the disruption of these tools reduces the overall cyber threat landscape, indirectly benefiting all businesses by making it harder for state-sponsored actors to operate.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.