OCT032026
Weekly CVE Brief: September 27–October 3
Five additions to CISA’s exploited-vulnerability catalog make asset matching urgent this week. Layer8’s priorities depend on exposure, business impact and deployment conditions.
Read storyNews & Updates
Follow the story.
Understand the impact.
Reported incidents, technology changes and a weekly vulnerability brief. What happened, how people responded and the practical steps that could reduce the risk.
Browse the archiveEditorial preview
Social publishing is planned to begin November 1, 2026. This collection uses sample archive dates from August 20 to October 3; the articles were prepared October 3 and have not been posted to our social accounts.
Stories & practical context
The latest from the archive
45 stories · latest sample date first
OCT022026
Cisco Talos Announces Executive Threat Detection
Cisco’s new retainer service focuses on executive systems. Organizations considering added scrutiny should define the people, information and response responsibilities involved before relying on coverage.
Read storyOCT012026
Microsoft Publishes Its 2026 Digital Defense Report
*Microsoft’s October 1 release puts connected systems and AI access in focus, giving service owners a reason to review dependencies, evidence and accountability.*
Read storySEP302026
Microsoft Reports July Phishing Campaigns Abusing Remote Administration Software
*A September 29 report links phishing to unauthorized remote access and credential theft, leaving affected organizations and the extent of recovery undisclosed.*
Read storySEP292026
Two Men Sentenced in Business Payment Diversion Scheme
*Federal prosecutors announced prison terms and restitution orders after stolen business email credentials and impersonation helped redirect payments intended for trusted partners.*
Read storySEP282026
CISA Ends Its Weekly Vulnerability Bulletin
The September 28 retirement changes how subscribers receive security updates, giving businesses a reason to review who turns advisory information into maintenance decisions.
Read storySEP272026
Rydox Operator Pleads Guilty After International Marketplace Takedown
*A September guilty plea followed an overseas arrest and marketplace seizure, leaving businesses with a separate question: whether exposed identities can still reach sensitive systems.*
Read storySEP262026
Weekly CVE Brief: September 20–26
Five exploited vulnerabilities warrant inventory checks and assigned remediation owners. Layer8’s priorities weigh exposure and business impact; fixes below reflect an October 3 review.
Read storySEP252026
Former Soldier Sentenced to 70 Months for Telecom Extortion
*The case involved stolen credentials and attempted extortion against multiple organizations; a prison sentence and restitution order now add to earlier guilty pleas.*
Read storySEP242026
Microsoft Makes Purview and Entra Network Data Protection Generally Available
*Microsoft’s September 24 update puts sensitive data rules into network enforcement for people and agents acting on their behalf, giving security teams a specific capability to evaluate.*
Read storySEP232026
Gyazo Breach Leaves Image Access Questions After Initial Containment
*Helpfeel’s September 16 disclosure describes exposed user records and image metadata, restricted delivery and an ongoing investigation, with the number of affected people still unknown.*
Read storySEP222026
Miljödata Fined After Breach Exposed Personal Data
*Sweden’s regulator identified weak software checks and missing monitoring after the supplier’s 2025 breach, while investigations into three public customers remained open.*
Read storySEP212026
Master of Malt Warns Shoppers After Ribon App Breach
*Master of Malt says stolen credentials for a third-party shopping application exposed customer contact details, while BigCommerce says it revoked the application’s access.*
Read storySEP202026
Mathspace Breach Puts Missed Advisories Under Scrutiny
The education provider reported more than a million people affected after an overlooked advisory, while its reporting system still awaited recovery checks.
Read storySEP192026
Weekly CVE Brief: September 13–19
Five additions to CISA’s exploited catalog drive Layer8’s September 13–19 priorities. Weigh exposure and business impact, then confirm the affected product and deployment.
Read storySEP182026
Juniper SSR Release Adds Security Fixes and Automatic Redundancy Recovery
*Juniper’s September update combines security maintenance with a change to network recovery. Organizations using Session Smart Router should review upgrade eligibility and verify continuity.*
Read storySEP172026
Keycloak Releases 26.7.4 With Security and Maintenance Fixes
*The September 16 release combines security repairs with database and administration fixes, putting upgrade ownership and checks on connected business applications back on the maintenance agenda.*
Read storySEP162026
Ericsson Announces NetCloud Private, With October Availability Planned
*The September 16 announcement targets organizations seeking control over network-management data. Adoption planning should establish who operates the management environment and how its readiness will be demonstrated.*
Read storySEP152026
Conti Conspirator Sentenced to Four Years in Prison
*The September 10 sentence follows an international ransomware investigation. For businesses, the practical follow-up is to verify which accounts can reach critical systems and whether recovery actually works.*
Read storySEP142026
Instant On 3.4.2 Adds Threat Guidance and WAN Visibility
*HPE’s September update pairs threat explanations with new network views. Businesses should check which signals they can monitor and who will act when an alert arrives.*
Read storySEP132026
Palo Alto Networks Warns of PAN-OS Firewall Control and Outage Risks
*Firewall maintenance should connect the affected platform and software branch to a named owner, an approved change and evidence that essential services still work.*
Read storySEP122026
Weekly CVE Brief: September 6–12
Four additions to CISA's exploited vulnerabilities catalog and a firewall advisory put Windows, network management and remote support on this week's patch list.
Read storySEP112026
Microsoft Expands VEX Coverage to Support Patch Decisions
*Microsoft’s expanded advisory coverage gives IT teams more structured vulnerability information. Its value depends on matching that information to installed products and verifying the resulting maintenance.*
Read storySEP102026
Surfshark Details Test Server Intrusion and Response
*The VPN provider says it contained an intrusion involving development systems after an initially lower priority alert, and plans an independent review of its wider infrastructure.*
Read storySEP092026
Cradlepoint E300-C7C and E300-C7D Reach End of Sale
*Cradlepoint’s September 9 sales cutoff applies to two E300 variants, while a separate 2031 support deadline gives owners a reason to review contracts and maintenance plans.*
Read storySEP082026
Microsoft Releases September .NET Servicing Updates
Microsoft’s September updates cover two application platform families. Business owners should pair applicable maintenance with a named approver, a representative workflow test and a documented recovery decision.
Read storySEP072026
Trezor Expands ShipMonk Breach Notice to Older Orders
*An updated disclosure says roughly 67,000 additional U.S. customers were exposed after historical shipping data remained at a supplier despite written deletion assurances.*
Read storySEP062026
Microsoft Publishes Security Guidance for Local AI
Microsoft’s September 4 guidance asks organizations adopting local AI to establish who checks the operating environment, approves components and controls the actions a model may take.
Read storySEP052026
Weekly CVE Brief: August 30–September 5
For August 30–September 5, Layer8’s editorial priorities weigh exploitation, exposure and business impact. Inventory determines applicability. Four entries gained CISA exploitation listings during the week; HPE published its advisory…
Read storySEP042026
HPE Expands Server BIOS Advisory to Three Earlier Generations
HPE’s September revision adds older server platforms to a firmware advisory, giving IT teams a reason to check BIOS records alongside operating system maintenance.
Read storySEP032026
Dell Identifies iDRAC Security Fixes Across Four Server Generations
Dell's September 3 advisory covers remote management controllers across four server generations, with separate firmware fixes and an important condition: an attacker needs high privileges.
Read storySEP022026
Unit 42 Details AI-Assisted Extortion Intrusion
Stolen access can turn a security incident into a wider business problem. Restricting administrative authority and verifying alerts deserve attention before the next emergency.
Read storySEP012026
HPE Releases Fabric Composer Updates Under Critical Advisory
HPE’s September 1 notice directs Fabric Composer operators toward released security updates, with product applicability and support status determining the maintenance decision.
Read storyAUG312026
Unit 42 Reports Helpdesk Impersonation Campaign on Microsoft Teams
Spring Ring targeted more than 150 employees across at least ten companies, underscoring the need to verify unexpected support requests before granting remote access.
Read storyAUG302026
Boston Scientific Works Toward Partial Shipping Restoration After Cyber Incident
Boston Scientific was pursuing partial shipping restoration on August 30, while electronically submitted orders waited for fulfillment and an investigation with outside cybersecurity experts continued.
Read storyAUG292026
Weekly CVE Brief: August 23–29
Five vulnerabilities entered CISA’s exploited catalog during August 23–29. These Layer8 editorial priorities call for inventory checks, deployment-specific fixes and evidence that maintenance succeeded.
Read storyAUG282026
OneTrust Closes Response to Klue Integration Incident
OneTrust says notifications are complete after compromised integration credentials exposed CRM records, underscoring the need to define and verify third-party access.
Read storyAUG272026
Microsoft Adds Third-Party Signals to Defender Experts MDR P2
Microsoft’s August 27 announcement extends managed detection and response through Sentinel. Organizations using several security vendors should verify the supported data, purchased scope and response ownership.
Read storyAUG262026
CISA Adds Six Flaws to Its Known-Exploited Catalog
The August 26 update spans application components, operating systems, network appliances and databases. Businesses should check their own inventory and assign responsibility before choosing a response.
Read storyAUG252026
Netim Clarifies June Development Environment Intrusion
*Netim says a development-system intrusion involved limited former-customer data, highlighting the need to verify isolation and control what testing environments retain.*
Read storyAUG242026
ReliaQuest Says Access Controls Contained Impersonation Attempt
*ReliaQuest says callers impersonating security staff briefly exposed one identity, while access restrictions blocked business applications. Its account puts containment and verification at the center.*
Read storyAUG232026
Lucid Says Vendor Cyber Incident Left Production Unaffected
Lucid reported a vendor incident without retail or production disruption and said the supplier lacked access to customer data or information enabling vehicle interference.
Read storyAUG222026
Weekly CVE Brief: August 16–22
Five entries added to CISA’s exploited-vulnerability catalog make this a week to check Windows, VMware, TrueConf and Zimbra deployments against the right vendor guidance.
Read storyAUG212026
Hong Kong Regulator Reports Canvas Breach Findings
*Four institutions were affected, but the regulator found no contravention of privacy law. Its findings separate restored service from the unresolved consequences of stolen data.*
Read storyAUG202026
CISA Adds Two TrueConf Flaws to Its Exploited Vulnerabilities Catalog
The August 20 additions give organizations running TrueConf Server a reason to revisit maintenance ownership, applicable updates, and the evidence needed to close a security change.
Read storyNo stories match this view.
Try another date or a broader search.
More ways to connect
Keep the conversation going.
Every two weeks · planned
Videos
A closer look at operating decisions, technology updates and useful IT and security questions.
First video and viewing details will be announced here.
Monthly · planned
Ask Me Anything
Bring a question about IT, security or the decisions behind them. We’ll post the date, time zone and joining details once confirmed.
Suggest a topicAnswers from future sessions will join our FAQ. Browse AMA answers →
Put the lesson to work.
Discuss what a reported incident or technology change means for your own environment.