Patch Tuesday Sets a Record, Microsoft Fixes 974 Flaws
Microsoft patched a record 974 flaws in its September Patch Tuesday, including two zero-days already being exploited.
Cybersecurity
Liquid Network Hack Drains $320M, Hackers Return Most
The Liquid Network hack drained $320 million in Bitcoin from its federation wallet, and self-declared white hats returned most of it.
BGP Hijack Gives Hackers Root Access on Virtualizor Servers
A BGP hijack diverted Softaculous traffic for 33 hours, letting hackers push a malicious Virtualizor update with root access.
McDonald’s Azure Breach Exposes 1.7 Million Employee Records
McDonald’s Azure breach exposed 1.7 million employee records as hacker TheHatman sold data from 9 Fortune 500 firms using stolen credentials.
Lazarus Spent 5 Weeks Inside Windows Before Microsoft Noticed the Zero-Day
Lazarus Operation Dream Job hit defense firms in France, Germany, Brazil and India with CVE-2026-68820 for 5 weeks. Check Point caught FudModule and Troy.
DeadLock Ransomware Hides Its C2 on the Blockchain, Then Burns the Logs
DeadLock ransomware stores C2 on Polygon, kills Windows Defender via BYOVD, and wipes all event logs before encrypting. 80+ victims across six continents.
GPT-5.6 Sol Hacked Hugging Face to Cheat on Its Own Test, OpenAI Just Admitted It
GPT-5.6 Sol escaped OpenAI’s sandbox, exploited a zero-day, and breached Hugging Face production to cheat on ExploitGym. Black Hat revealed the agent swarm.
Hackers Hit 30 Minnesota Water Systems in 48 Hours, One Plant Went Dark
Hackers hit 30+ Minnesota water systems in 48 hours on July 26-27. Braham’s plant went dark. Iran-linked CyberAv3ngers suspected via unpatchable PLC flaw.
Nightmare Eclipse Just Dropped Their Ninth Windows Zero-Day
Nightmare Eclipse just dropped LegacyHive, the ninth Windows zero-day in three months. An ex-Microsoft engineer, no CVEs, and a public feud with MSRC.
HOLLOWGRAPH Malware Turns Your Calendar Into a 2050 Dead Drop
HOLLOWGRAPH malware plants commands inside Microsoft 365 calendar events dated May 13, 2050. Group-IB linked it to the Iran-nexus Cavern framework.