35 Apache vulnerabilities fixed, including Apache ZooKeeper flaws CVE-2026-115448 and CVE-2026-100252, plus OpenOffice, ActiveMQ and Juneau bugs.

Related Posts:

• Cisco Patches High-Severity Remote Code Execution in UCS Central Alongside ISE and Unified CM Flaws
• Attackers Exploit Critical GPUStack Authentication Bypass in the Wild to Run Reverse Shells
• Control Web Panel Patches Ten Flaws Allowing Unauthenticated Root Code Execution

The post Apache Vulnerabilities in ZooKeeper, OpenOffice, ActiveMQ and Juneau Get Fixes appeared first on Daily CyberSecurity.

The Investment Fraud Supply Chain

How Victims Were Drawn In

Why Victims Kept Paying in This Investment Fraud

How a Couple's Complaint Exposed the Network

The Role of Europol and Eurojust

Apache Wicket vulnerabilities: a security update fixes 19 flaws, including CVE-2026-84170 upload DoS and XSS bugs. Upgrade to 8.20.0, 9.25.0 or 10.12.0.

Related Posts:

• Critical MediaTek Vulnerabilities Patched in Chipsets
• Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
• Critical FreePBX Vulnerabilities Patched in User Manager

The post Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0 appeared first on Daily CyberSecurity.

A Bitcoin Core DoS vulnerability allows remote peers to trigger out-of-memory crashes on Windows, macOS, and BSD nodes via TCP socket handling errors.

Related Posts:

• Android SMS of Death Bug Triggers Remote Reboots
• JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach
• CERT/CC Warns of Xerj Authentication Bypass Flaw CVE-2026-97406

The post Bitcoin Core DoS Vulnerability Crashes Remote Nodes appeared first on Daily CyberSecurity.

FBI Seizes Virtualine Over Alleged Cybercrime Activity

Hosting Provider Allegedly Ignored Repeated Abuse Reports

Virtualine Advertised Measures to Evade Law Enforcement

Cryptocurrency Payments Linked to Money Laundering

International Cooperation Behind Virtualine Takedown

Apache Kafka fixes 12 vulnerabilities, including CVE-2026-110985, which skips JWT signature verification and grants full cluster access. Patch now.

Related Posts:

• Kerio Connect Vulnerability CVE-2026-112353 Exploited in the Wild to Steal Mailboxes
• FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild to Run Commands
• Details and PoC Exploit Released for Jackson-Databind Flaw CVE-2026-110879 (CVSS 9.8)

The post Apache Kafka Fixes 12 Vulnerabilities, Including a JWT Bypass That Grants Full Cluster Access appeared first on Daily CyberSecurity.

An Intelbras camera vulnerability enables a denial-of-service attack that knocks Mibo cameras offline from the local network. Update to R.260804.

Related Posts:

• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
• Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect

The post Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline appeared first on Daily CyberSecurity.

Body-parser vulnerability CVE-2026-111181 (CVSS 7.5) enables Express denial of service with one request. Upgrade to body-parser 2.4.0 or 1.20.9.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
• Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect

The post Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public appeared first on Daily CyberSecurity.

Denmark ends Collabora pilot testing across its public sector after formatting errors disrupted case workflows, securing a quiet victory for Microsoft.

Related Posts:

• Microsoft Voluntary Buyout Program Targets 60,000 Staff
• Apple Blocks eMudhra Certificates Over Weak Key Flaw
• Anthropic S-1 IPO Filing Targets Historic $2T Valuation

The post Denmark Ends Collabora Pilot in Blow to Open Source appeared first on Daily CyberSecurity.

OOXML standardization history: The Document Foundation says Microsoft steered ISO approval in 2006-2008. Microsoft disputes such claims.

Related Posts:

• Apple Presto Return Scanner Targets In-Box Fraud
• Come Back to Firefox Campaign Champions Web Privacy
• OpenSSL 4.1.0 Release Introduces Elbrus Support and DTLS 1.3

The post Document Foundation Revisits the OOXML Standard Fight appeared first on Daily CyberSecurity.

DOJ officials announced a Cambodia crypto scam extradition after Zheng Zhao allegedly helped launder $36.9M stolen from 174 US victims via USDT.

Related Posts:

• Doppelganger Campaign Targets Israel Elections With Fake News and AI Poisoning
• Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials
• Storm-0940 Uses ARTEX AI Agent to Probe IT and Software Vendors for Supply Chain Access

The post DOJ Extradites Suspect in $36.9M Cambodia Crypto Scam Targeting Americans appeared first on Daily CyberSecurity.

Cisco fixes 13 Snort 3 vulnerabilities, including CVE-2026-20043 and denial of service flaws affecting FTD, Meraki MX and IOS XE.

Related Posts:

• cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts

The post Cisco Fixes 13 Snort 3 Vulnerabilities, Including CVSS 9.0 Out-of-Bounds Write appeared first on Daily CyberSecurity.

FoxIO released details and PoC code for a QPACK amplification attack that can crash HTTP/3 servers, including quic-go, quiche, lsquic and Bun.

Related Posts:

• cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts

The post PoC and Full Details Released for QPACK Amplification Attack That Crashes HTTP/3 Servers appeared first on Daily CyberSecurity.

No travel, no lessons, no test, and a UAE licence at the end of it. That was the promise behind a fake driving licence scheme that Dubai Police say has now been shut down. An eight-member criminal gang has been arrested for fraudulently obtaining driving licences from a neighbouring country for customers who had never been there, then helping them swap those licences for a UAE driving licence.

The gang charged AED 10,000 per licence. The arrests were made by Dubai Police’s General Department of Criminal Investigation, in cooperation with the UAE Ministry of Foreign Affairs and Dubai’s Roads and Transport Authority (RTA).

How the Fake Driving Licence Scheme Worked

Dubai Police’s Economic Crimes Department found that the gang exploited legitimate licence exchange agreements. These arrangements allow holders of driving licences issued by certain countries to exchange them for UAE licences without additional training or testing, provided they meet the necessary requirements.

The suspects used offices belonging to transaction processing companies in the UAE to approach potential customers and promote their services. They offered to arrange licences from a neighbouring country without customers needing to travel there, learn to drive or pass mandatory tests.

Once obtained, the licences could be presented for exchange through Dubai’s RTA. In effect, the scheme used an agreement designed to simplify the process for eligible drivers to bypass the training and testing meant to confirm that drivers are qualified.

Why Police Call It a Risk to Road Safety

Dubai Police warned that obtaining a licence through illegal means is more than a procedural violation. It can pose a serious threat to road safety.

Driving lessons and examinations assess whether motorists have the skills, knowledge and ability to handle different traffic situations. Skipping them could put unqualified drivers on public roads, endangering motorists, passengers, pedestrians and other road users.

The force urged residents to be cautious of individuals or businesses promising licences without the required training, testing or legal procedures.

Fake Driving Licence Buyers Could Face Legal Action

Police stressed that legal responsibility does not stop with those arranging the licences. Anyone who knowingly pays for a fake driving licence obtained through unlawful procedures may also face penalties and legal action.

Dubai Police also clarified a key point for buyers. Exchanging an illegally obtained foreign licence for a UAE licence does not make the original licence legitimate, and it does not exempt the holder from responsibility. Completing the official exchange process cannot be used to justify violations committed when the foreign licence was obtained.

What the Exchange Agreements Actually Allow

According to Dubai Police, international licence exchange agreements exist to make it easier to exchange legally issued licences that meet the relevant requirements. They do not allow applicants to bypass the rules that govern how licences are originally issued in their home countries.

The force urged anyone seeking a driving licence to follow approved procedures and deal only with authorised entities. Residents were also encouraged to report individuals or companies offering licences through unlawful means, to help authorities identify fraud and protect the community.

Dubai Police reaffirmed that properly trained and qualified drivers are fundamental to road safety, and that licence exchange arrangements must never be used to get around these requirements.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

What Happened

Four notable UK prosecutions illustrate the growing intersection of cybercrime, online exploitation subcultures, and digital terrorism involving teenage offenders:

Scattered Spider Operators Sentenced for Transport for London (TfL) Hack:

• In July 2026, Thalha Jubair (20) and Owen Flowers (18) were sentenced at Woolwich Crown Court to five years and six months each in prison. Convicted under Section 3ZA of the Computer Misuse Act (CMA), reserved for attacks causing serious damage to critical national infrastructure, the pair, operating as part of the "Scattered Spider" collective, breached Transport for London (TfL) in late August 2024.
• Initiated when Flowers was 17, the attack bypassed two-factor authentication (2FA) by social engineering a TfL help-desk worker over the phone. The intrusion knocked 148 internal IT systems offline, forced in-person password resets for 27,000 staff, exposed up to 10 million customer records, and incurred £29 million to £39 million in operational and recovery costs. 

"The Com" Online Exploitation Network: 

• In August 2026, Justin Swaddle (20) of Leeds was sentenced at Leeds Crown Court to two years' imprisonment, alongside a 10-year Sexual Harm Prevention Order, following a National Crime Agency (NCA) investigation.
• Swaddle, who began offending at age 17 under aliases such as "Epstein" and "Moscow" across Telegram, Discord, and Snapchat, operated within "The Com," a decentralised online network of youth engaged in cyber-extortion, harassment, and swatting.
• Swaddle used doxxing threats and intimate images to blackmail 117 female victims worldwide (aged 13–17) into self-harm and sexual abuse for peer recognition and status within the community.  

Cybersecurity Provisioning for Proscribed Terrorist Groups:

• In July 2026, Yusuf Shah (18) of Ilford was convicted at Kingston Crown Court of multiple offences under the Terrorism Act 2000 following an investigation by Counter Terrorism Policing (CTP) London.
• Radicalised online from age 13, Shah offered technical capabilities to proscribed groups via Telegram, authored a bespoke manual titled "A Guide on Cybersecurity" for Tehrik-e-Taliban Pakistan (TTP), and facilitated an untraceable $1,376.51 cryptocurrency donation to Al-Qaeda using privacy techniques he developed.

How GhostBat RAT Reaches Victims

GhostBat RAT's Ghost Overlay Trick

GhostBat RAT Watches 60 Financial Apps

Inside the GhostX Network Behind GhostBat RAT

Why GhostBat RAT Is Hard to Detect

Staying Safe From GhostBat RAT

Three IBM critical vulnerabilities, rated up to CVSS 9.9, hit IBM i, Db2 Mirror and Maximo AI Service, including remote code execution. Patch now.

Related Posts:

• SAP Security Patch Day October 2026 Fixes CVSS 10 Cloud SDK Flaw and Three More Critical Bugs
• Discourse Vulnerabilities Let Attackers Hijack Pages for Every Visitor and Read Server Files
• Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

The post IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo AI Service appeared first on Daily CyberSecurity.