Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, emerging threats, major data breaches, and infrastructure incidents from the last several days so you can stay informed and secure in a fast-moving digital landscape.
1. Google Fined €403 Million Over GDPR Location-Data Violations
Published: 2026-09-21
Ireland’s Data Protection Commission fined Google €403 million (about $463 million) for GDPR breaches tied to how Web & App Activity, Location History, and Location Accuracy handled user location data from May 2018 to February 2020. The regulator said processing was not lawful, fair, or transparent, and that location data was kept longer than necessary. Google was ordered to bring processing into compliance within six months and said the case involved historical policies it has since updated.
2. Fake LastPass Installers Deploy Microsoft-Signed Driver That Kills 145 Security Tools
Published: 2026-09-21
LastPass and Delphos Labs detailed a campaign using SEO-optimized fake GitHub pages impersonating LastPass Authenticator and at least 40 other brands. The payload sideloads malware via a renamed Microsoft debugger, then installs a Microsoft-attested kernel driver (Alinubx.sys, disguised as an NVIDIA component) that terminates 145 antivirus and EDR processes before dropping the Rapuncel infostealer. LastPass says its own systems and customer vaults were not breached.
3. North Korean “Contagious Interview” Campaign Hits 30,000 Devices, Steals $10.71M in Crypto
Published: 2026-09-21
A joint advisory from agencies in Japan, the United States, Australia, and Germany says North Korean actors tracked as WaterPlum / Contagious Interview compromised at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto, and NFT recruiters, they tricked developers into running malicious npm packages and coding tests, then stole funds or credentials from more than 7,000 crypto wallets worth about $10.71 million.
4. CISA Warns of Three Linux Kernel Flaws Exploited in the Wild
Published: 2026-09-21
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-39682 (critical TLS receive-path issue, CVSS 9.8), CVE-2026-53266 (ebtables SNAT out-of-bounds write, CVSS 8.8), and CVE-2025-39964 (AF_ALG race condition, CVSS 7.8). Attackers could cause denial of service, memory disclosure, or local privilege escalation. Federal agencies were given a short remediation window through September 21, 2026. Red Hat has confirmed public exploits for some of the flaws.
5. Gyazo Breach Exposes 23.6 Million User Records and 490 Million Image Metadata Records
Published: 2026-09-18
Helpfeel confirmed that attackers exploited a vulnerability in Gyazo’s image-upload server on September 11 and stole about 23.62 million user records, including names, emails, password hashes, session IDs, and some connected-account tokens. About 490 million image metadata records were also taken, including upload IPs, EXIF location data, OCR text from screenshots, and image IDs that can reconstruct share links. Payment cards were not exposed, but private-image access remains a concern.
6. Cisco Patches CVSS 10.0 ISE Authentication Bypass Exploited as a Zero-Day
Published: 2026-09-17
Cisco released emergency patches for CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine and ISE-PIC. An unauthenticated attacker can send a crafted API request, skip the web management login, and potentially reach root-level control of network access policy. Cisco confirmed active exploitation. There is no true workaround; operators should patch to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 and restrict management access.
7. ShinyHunters Defaces Clop Ransomware Leak Site and Threatens Rival Gang
Published: 2026-09-19
Extortion group ShinyHunters compromised Clop’s Tor leak site, allegedly via an unauthenticated Grav CMS file-upload flaw, then defaced the page and claimed theft of source code, plugins, server logs, and onion-service keys. The group is demanding payment and threatening to name companies that paid Clop during its Oracle E-Business Suite campaign. Clop later posted that it was trying to contact ShinyHunters after the site was hijacked. The feud highlights instability inside the ransomware ecosystem.
8. Foreign Actors Manipulate OT Systems at Two Colorado Water Utilities
Published: 2026-09-21
Colorado officials said foreign actors breached operational technology at two small private water utilities in late August. Attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. Service and water quality were not affected, and operators restored control quickly. Officials have not confirmed attribution but noted nationwide activity by an Iranian-backed group targeting drinking-water and wastewater systems. The incidents add Colorado to a broader 2026 wave of U.S. water-sector OT attacks.
9. BigCommerce Merchants Hit After Ribon App Credentials Are Stolen
Published: 2026-09-21
BigCommerce told merchants that credentials for third-party Ribon / Ribon 1.5 apps were compromised and used to inject malicious scripts into storefronts and pull shopper data between September 13 and 17. BigCommerce said its core platform was not breached and uninstalled the apps from affected stores. Impacted shopper data reported by merchants includes names, emails, phone numbers, and shipping addresses; passwords and payment cards were reportedly stored separately. The incident is another reminder that marketplace apps can become a supply-chain back door.
Stay Vigilant
This week’s mix is familiar and still dangerous: signed-driver EDR killers, nation-state fake-job malware, max-severity network-access flaws, screenshot-platform metadata leaks, and real-world OT tampering at water utilities.
Practical takeaways:
- Download software only from official vendor sites and app stores, never from GitHub “download” pages that rank in search.
- Treat unexpected recruiter coding tests and npm/VS Code project files as hostile until independently verified.
- Patch Cisco ISE, Linux kernels, and internet-facing management interfaces immediately, then hunt for compromise rather than assuming a patch closed the incident.
- Reset reused passwords if you use Gyazo or shopped at a BigCommerce store that used Ribon during mid-September.
- For critical infrastructure and small utilities, remove internet-exposed PLCs, cellular modems, and default remote-access paths.
Subscribe for daily updates, keep backups offline and tested, and treat supply-chain apps, AI coding agents, and “helpful” installers as high-risk until proven otherwise. Stay safe online.