The last 30 days of cyber threats for education and government (359 items).
AI-assisted summaries and fixes, sources cited.
Low · Dark Reading ·
Microsoft's latest Digital Defense Report highlights AI-driven attack trends and targeted sectors but does not detail how its own software flaws are chosen for exploitation.
Low · The Hacker News ·
An Iran-linked group called DarkBlinders ran espionage intrusions against government cloud systems in Israel and Iraq's Kurdistan region from August to October 2026, affecting prominent people.
High · SecurityWeek ·
Unknown actors compromised an online student-aid and financial-aid portal at Florida’s education department, exposing personal details and Social Security numbers for about 4.9 million individuals.
Low · SecurityWeek ·
A Syrian national linked to pro-Assad cyber operations has been sentenced to three and a half years after more than ten years evading capture.
High · The Record ·
Florida's education department warned that unknown intruders hit its student financial aid site, exposing Social Security numbers and other personal data for about 4.9 million people.
Low · SecurityWeek ·
A contested breach account, reported data exposure, a UEFI server issue, and AI malware claims involve Iran, Anthropic, Cloudflare, and Copenhagen University.
Low · The Record ·
Unknown attackers are using a loader called NetamLoader to compromise government Windows hosts in Asia, bypass defenses, and pull down further payloads.
Low · Security Affairs ·
The FBI has assumed control of virtualine.net, a Virtualine hosting domain tied to ignored abuse reports and alleged money-laundering support, with limited direct risk to K-12 networks.
Low · Hackread ·
An unidentified intruder leaked about 115 GB of school data, prompting Summit Public Schools to disclose exposure of student and staff information.
Low · The Record ·
Moldovan authorities are examining a large-scale intrusion into public digital systems, with citizen records exposed and signs that overseas actors may be involved.
Low · The Record ·
British policymakers are weighing whether software firms should carry more responsibility for security failures, a national policy signal with contract and risk implications.
Low · The Hacker News ·
The October 2026 Wazuh item focuses on AI-driven automation, SOC improvement, and automated attack activity, with no CVE assigned and a low severity signal.
Informational · BleepingComputer ·
A researcher has published working exploit code for a Google Android bug that lets a specially built text message knock a handset offline — patched devices are safe, but many are not.
Informational · Security Affairs ·
CVE-2026-118539 is an authorization bypass in Drupal Commerce Core, and attackers could abuse absent access checks against affected ecommerce sites.
High · SecurityWeek ·
A highest-severity GitLab flaw tracked as CVE-2026-97229 lets attackers act without logging in, run code, and potentially seize servers; Alpine Linux is also named in scope.
High · SecurityWeek ·
A high-severity TeamViewer vulnerability lets hostile hosts trigger an integer overflow to run code and seize technician workstations.
High · The Hacker News ·
Drupal Commerce Core sites on two release lines face an authorization bypass, CVE-2026-118539, that attackers are already using; administrators should inventory and update immediately.
High · CISA Advisories ·
Hitachi Energy's TRO600 series carries two flaws that let an authenticated user run code, bypass authentication, and expose sensitive data, prompting CISA guidance for worldwide energy deployments.
High · CISA Advisories ·
CVE-2026-89209 lets an unauthenticated remote actor bypass authentication in Siemens Mendix SAML deployments by replaying a valid assertion.
High · CISA Advisories ·
Two tracked flaws in Hitachi Energy CoreTec products affect confidentiality, integrity, and availability, with exposure spanning global energy and critical-infrastructure operators.
Informational · The Hacker News ·
An unidentified party tried to exploit CVE-2026-97229 on a single GitLab server about seven days after a fix shipped; investigators found no sign the attempt worked.
Critical · Security Affairs ·
A sixteen-year-old defect in TianoCore's reference UEFI implementation lets attackers run code before the operating system loads, and details surfaced ahead of a coordinated patch release.
Informational · Help Net Security ·
Planck Technologies advertised a security architecture position on November 3, 2026, a staffing signal worth noting for K-12 vendor oversight.
High · Krebs on Security ·
In November 2026, Google and industry partners dismantled a botnet and cut off access to a proxy network that had ensnared 1.3 million Android TV set-tops plus ten million other systems.