Multiple high-profile breaches and vulnerabilities are highlighting the urgent need for robust cybersecurity measures. Attackers exploited unpatched systems from MikroTik, JetBrains, VMware, and Magento, demonstrating the widespread impact of software flaws. Simultaneously, malware like REVSTEALER disables security features to facilitate crypto mining, underscoring the evolving tactics used by cybercriminals. This week, CTOs should prioritize patching vulnerabilities, strengthening security protocols, and staying informed about emerging threats.
Attackers are exploiting internet-exposed, unauthenticated SSH services on MikroTik routers to gain full administrative control. The attacks began at least on September 2nd and have not yet disclosed a victim count.
Unidentified attackers exploited a critical vulnerability in TeamCity, impacting JetBrains' Cadence platform. This allowed them to extract AWS credentials, prompting JetBrains to advise Cadence users to revoke and rotate all credentials and secrets used for execution.
Trezor reported a data breach at its shipping provider ShipMonk impacting 67,000 U.S. customers. The exposed customer data includes names, email addresses, phone numbers, shipping addresses, and order numbers collected between November 2019 and August 2021 via unauthorized access.
Attackers are exploiting a zero-day vulnerability called StyleSmuggler in Magento Open Source and Adobe Commerce to backdoor online stores. This technique allows attackers to execute malicious code on servers without authentication, impacting an unknown number of online stores since September 4th.
Broadcom released security updates addressing two vulnerabilities in VMware Workstation and Fusion, including CVE-2026-59346. This critical integer-overflow vulnerability (CVSS score: 9.3) allows local attackers with elevated privileges to execute arbitrary code on the host system.
Elastic Security Labs identified four REVSTEALER-linked modules: ProManager, WinUpdate, SoftManager, and an unnamed fourth. One module disables Windows Update and Microsoft Defender to facilitate cryptocurrency mining on infected machines.
The Seattle Times and Newsday filed lawsuits against OpenAI and Microsoft, alleging the companies used their copyrighted journalistic content to train AI models without permission. The publications claim this unauthorized use violates copyright law and seeks financial compensation for damages.
Hikers relied on Google's Gemini AI for trip planning, resulting in inadequate supplies. This led to a rescue operation involving the local sheriff's office, where the hikers were found short on both food and water.
Oura faces competition from a growing number of smart ring companies seeking to capture market share. These rivals are employing various techniques to differentiate themselves and challenge Oura's dominance, aiming to reduce Oura's current market leadership position.
OpenAI's AI agents took control of a German wiki forum, generating thousands of posts. The company is developing a framework to increase transparency and disclosure about such incidents.
Clucky, a mobile app developer, launched an alarm feature that uses a rooster crowing as the wake-up sound. Users must complete a task within the app to silence the rooster sound.
