Paint maker giant AkzoNobel confirms cyberattack on U.S. site

The multinational Dutch paint company AkzoNobel has confirmed to BleepingComputer that hackers breached the network of one of its U.S. sites. [...]

Facebook accounts unavailable in worldwide outage

Social media giant Facebook is currently experiencing a massive worldwide outage, preventing users from accessing their accounts. [...]

Announcing FreeType 2.14.2, fixes CVE-2026-23865

Posted by Alan Coopersmith on Mar 03While the announcement below says "A bunch of potential security problems have been found. All users should update." the Meta CNA has issued CVE-2026-23865, stating: -------- Forwarded Message -------- Subject: Announcing FreeType 2.14.2 Date: Sun, 1 Mar 2026 20:46:54 +0000 From: Werner LEMBERG To: freetype-announce () nongnu org, freetype () nongnu org, freetype-devel () nongnu org FreeType 2.14.2 has been...

Violent repeat offender accused in Charlotte knife attack was free despite decade-long rap sheet

A Charlotte stabbing case reignites debate over repeat offenders after an accused man's extensive criminal history spanning multiple counties comes to light.

Qualcomm Zero-Day Exploited in Targeted Android Attacks

The exploitation activity against CVE-2026-21385, a high-severity memory corruption flaw, could be tied to commercial spyware or nation-state threat groups.

The ‘Six-Day’ Security Week: AI Adoption Ignites Leadership Crisis

Enterprise security teams are sprinting toward an artificial intelligence (AI)-driven future, but the breakneck pace of adoption is pushing leadership to a breaking point. According to Seemplicity’s 2026 State of the Cybersecurity Workforce Report, released Tuesday, the industry is witnessing a “system failure” where rapid technological integration is outpacing human capacity and governance. The data.. The post The ‘Six-Day’ Security Week: AI Adoption Ignites Leadership Crisis appeared first on

Coruna: Spy-grade iOS exploit kit powering financial crime

A powerful iOS exploit kit has circulated among multiple threat actors over the past year, moving from a commercial surveillance operation to state-linked espionage campaigns and, ultimately, ended into the hands of financially motivated hackers, according to new research from Google’s Threat Intelligence Group (GTIG). “The exploit kit, named ‘Coruna’ by its developers, contained five full iOS exploit chains and a total of 23 exploits,” the analysts noted. The exploit list includes both CVE-trac

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Posted by Jan Schaumann on Mar 03Via AWS Security Bulletin https://github.com/aws/aws-lc ----- Forwarded message from "Latest Bulletins: Amazon Web Services" ----- ----- End forwarded message -----

[OSSA-2026-003] OpenStack Vitrage: Remote code execution through Vitrage query parser (CVE-2026-28370)

Posted by Jeremy Stanley on Mar 03================================================================= OSSA-2026-003: Remote code execution through Vitrage query parser ================================================================= :Date: March 03, 2026 :CVE: CVE-2026-28370 Affects ~~~~~~~ - Vitrage:

CVE-2025-66168: Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated

Posted by Christopher L. Shannon on Mar 03Severity: Affected versions: - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.2 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.1.9 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.2.0 before 6.2.1 - Apache ActiveMQ All Module (org.apache.activemq:activemq-all) before 5.19.2 - Apache ActiveMQ All Module (org.apache.activemq:activemq-all) 6.0.0 before 6.1.9 - Apache ActiveMQ All Module...

CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Posted by Justin Bertram on Mar 03Severity: critical Affected versions: - Apache Artemis (org.apache.artemis:artemis-server) 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 2.11.0 through 2.44.0 Description: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core...

Django CVE-2026-25673 and CVE-2026-25674

Posted by Natalia Bidart on Mar 03* Announce: https://www.djangoproject.com/weblog/2026/mar/03/security-releases/ * CVE JSON Record for CVE-2026-25673: https://www.cve.org/CVERecord?id=CVE-2026-25673 * CVE JSON Record for CVE-2026-25674: https://www.cve.org/CVERecord?id=CVE-2026-25674 In accordance with `our security release policy `_, the Django team is issuing releases for `Django 6.0.3

Fig Security emerges from stealth with $38 million to resilience-proof enterprise security

Fig Security, a new platform that finds and fixes broken security flows across your entire SecOps infrastructure, has launched from stealth with $38 million across Seed and Series A rounds. It addresses one of the least visible challenges yet most consequential in enterprise security: the quiet breakdown of security operations as environments grow more complex. The round is backed by Team8 and Ten Eleven Ventures, alongside a group of prominent security leaders. Enterprises pour billions … More

Threat actors weaponize OAuth redirection logic to deliver malware

An ongoing phishing campaign is abusing the OAuth authentication redirection mechanism to avoid triggering conventional email and browser defenses, Microsoft researchers have revealed. The attackers are targeting government and public-sector organizations, and redirecting unsuspecting users from trusted login pages to their own infrastructure, to serve malware or capture login credentials. The attack, from the victim’s perspective The OAuth authentication redirection mechanism is a trusted login

Cloudflare tracked 230 billion daily threats and here is what it found

Cloudflare’s network blocks over 230 billion threats per day. The volume indicates how routine and automated the attack cycle has become, and the patterns behind that volume point to a shift in how breaches begin and progress. Cloudflare’s threat research unit, Cloudforce One, published its inaugural cyber threat report 2026, covering activity observed through 2025 and projecting into the year ahead. The report draws on telemetry from Cloudflare’s network, which handles roughly 20% of global … M

LexisNexis confirms data breach as hackers leak stolen files

American data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information. [...]

Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)

CrushFTP is a Java-based open source file transfer system. It is offered for multiple operating systems. If you run a CrushFTP instance, you may remember that the software has had some serious vulnerabilities: CVE-2024-4040 (the template-injection flaw that let unauthenticated attackers escape the VFS sandbox and achieve RCE), CVE-2025-31161 (the auth-bypass that handed over the crushadmin account on a silver platter), and the July 2025 zero-day CVE-2025-54309 that was actively exploited in the

Josys centralizes identity data to replace manual IT oversight with automated governance

Josys has transitioned into an autonomous identity governance platform, expanding beyond traditional SaaS management. The enhanced platform empowers IT leaders and managed service providers (MSPs) to scale governance and compliance efforts by centralizing identity data within a single, AI-driven system. With Verizon reporting that 80% of hacking breaches stem from compromised credentials, identity is the ultimate attack surface. As threats and costly non-compliance penalties surge, organizations

New ‘AirSnitch’ Attack Shows Wi-Fi Client Isolation Could Be a False Sense of Security

Researchers have uncovered a Wi-Fi vulnerability that allows nearby attackers to intercept sensitive data and execute machine-in-the-middle attacks against connected devices. The post New ‘AirSnitch’ Attack Shows Wi-Fi Client Isolation Could Be a False Sense of Security appeared first on SecurityWeek.

Pakistan says it killed 67 Afghan security force members in fifth day of fighting

Pakistan says that Afghan forces have attacked Pakistani military positions along the border, triggering intense clashes that left 67 Afghan troops and one Pakistani soldier dead