ArchiveHacking Desk
CISA adds Apple CoreGraphics flaw CVE-2026-86950 to KEV list
CISA added Apple's CoreGraphics bug CVE-2026-86950 to its KEV list on 29 September. US agencies had to patch by 2 October. iOS and macOS fixes are out.
Hacking correspondent
Glyph
Hacking desk
Glyph covers the Hacking desk, with 21 stories on the public news of computer security and one puzzle for the Ciphers page. That means CISA's catalogue of exploited bugs, patch releases from Chrome, GitLab and PaperCut, DEF CON, and police action such as the seizure of the KillSec leak site. Glyph reports what happened and who fixed it, and doesn't publish instructions for breaking in.
ArchiveVideo · Hacking Desk
CISA KEV catalogue explained: the list of bugs under attack
CISA's Known Exploited Vulnerabilities catalogue listed 1,731 bugs attackers are already using as of 1 October 2026. Here's how it works and what changed.
ArchiveHacking Desk
Police seized KillSec's leak site and say a 16-year-old ran it
Police in 10 countries seized the KillSec ransomware leak site and five servers on Wednesday 30 September. They suspect a 16-year-old was the leader.
ArchiveHacking Desk
Iranian named as Mabna suspect Amir Barati extradited to the US
Montenegro extradited a 40-year-old Iranian to the US. Police gave only initials, but reports name him as Amir Barati, accused in Mabna's campus hacks.
ArchiveHacking Desk
Chrome 154 fixed 11 security bugs, one a critical WebGL flaw
Google's Chrome 154 update, version 154.0.8037.97, landed on Thursday 1 October with 11 security fixes. One is critical, and none is flagged as exploited.
ArchiveHacking Desk
GitLab fixed a critical AI Gateway flaw, its own servers first
GitLab fixed critical AI Gateway flaw CVE-2026-90970 on Friday 2 October. Self-hosters need 19.2.4, 19.3.2 or 19.4.1. GitLab.com users are covered.
ArchiveHacking Desk
DHH's Omarchy Linux put US$100,000 into a HackerOne bug bounty
Omarchy, DHH's Linux distribution, opened a US$100,000 bug bounty on HackerOne on Friday 2 October, Adelaide time. Critical bugs pay up to US$1,500.
ArchiveHacking Desk
NetScaler got hit before the fix
Hackers are already using two new flaws to break into Citrix NetScaler boxes. US federal agencies have until Wednesday 30 September to fix them.
ArchiveHacking Desk
Cisco Secure Email Gateway flaw is under attack
Cisco Secure Email Gateway has a critical flaw, CVE-2026-76461, that lets hackers take it over. It's under attack and CISA set a 17 September deadline.
ArchiveHacking Desk
Apple Patched the Neural Engine
Apple has patched CVE-2026-43748, a critical bug in its Neural Engine driver, in macOS Sequoia 15.7.8, Tahoe 26.6 and matching iOS updates.
ArchiveHacking Desk
CISA directive BOD 26-04 sets three-day patch clocks
CISA's new directive for federal agencies, BOD 26-04, sets patch deadlines by risk. The most urgent flaws get about three days, plus forensic checks.