September 2026

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory 2026-09-22 at 14:38 By A new flaw in the Linux kernel’s KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows […]

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE 2026-09-22 at 14:17 By A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, […]

SES Complete Is a Certified Leader in the AV-Comparatives EPR Test 2026-09-22 at 13:00 By Mark Kennedy When put to the test, SES Complete proved robust prevention and response block 100% of threats This article is an excerpt from SECURITY.COM View Original Source

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing 2026-09-22 at 10:52 By The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. “SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious […]

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor 2026-09-22 at 09:33 By Malware already running on a Mac can quietly take over Meta’s Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works […]

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session 2026-09-22 at 09:03 By A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site’s server. […]

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access 2026-09-22 at 08:31 By The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: […]