DEV Community: BeyondMachines

Apple Patches Hundreds of Vulnerabilities in September 2026 Security Update

BeyondMachines — Tue, 15 Sep 2026 20:01:14 +0000

Summary

Apple's September 14, 2026 release of iOS 27, macOS Golden Gate 27, Safari 27 and its sibling updates patches over 200 CVEs, concentrated in WebKit, the kernel and drivers, and file-sharing/file-system code (SMB, WebDAV, autofs, disk images). The flaws enable universal XSS, root privilege escalation, kernel memory corruption from hostile servers or crafted volumes, Gatekeeper and sandbox bypasses, and arbitrary code execution from images and 3D models.

Take Action:

If you use any Apple devices: iPhone, iPad, Mac, Apple Watch, Apple TV or Vision Pro, update them ASAP to the latest version (iOS/iPadOS 27 or 26.7, macOS Golden Gate 27, Tahoe 26.7 or Sequoia 15.8, tvOS/watchOS/visionOS 27, and Safari 27). The September releases patch a huge number of issues. Until you've updated, be extra careful about visiting unfamiliar websites, opening files or images from strangers, and connecting to unknown file-sharing servers or Wi-Fi networks.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Communauto Insider Incident Exposes Customer Records Through Unauthorized Script

BeyondMachines — Tue, 15 Sep 2026 17:01:13 +0000

Summary

Communauto disclosed a security incident after an employee used an unauthorized automated script to access and download customer records, potentially affecting a few thousand users. The company blocked the access, notified police, and stating it has found no evidence that the information has been publicly disclosed or misused.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Japan Digital Agency VPN Breach Potentially Exposes 246,000 Personnel Records

BeyondMachines — Tue, 15 Sep 2026 16:01:13 +0000

Summary

Japan's Digital Agency disclosed a data breach after an attacker exploited a known VPN vulnerability to gain unauthorized access to its Government Solution Service. Approximately 246,000 records containing names, email addresses, phone numbers, and addresses may have been exposed.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

State of (in)security - Week 37, 2026

BeyondMachines — Tue, 15 Sep 2026 13:01:13 +0000

Summary

Week 37 of 2026 saw 13 advisories and 31 incidents (up from 27 the prior week), affecting roughly 5.6 million known individuals. The largest is the Veradigm third-party credential-theft breach at 3.5 million. Unauthorized access, ransomware/malware, and third-party compromise are the leading causes and healthcare by far the hardest-hit sector. Critical patches landed across Microsoft, Google, Adobe, Fortinet, SAP, Ivanti and others, alongside five flaws under active exploitation including zero-days in N-able N-central, GitLab, Cisco Secure FMC, Fortinet CAPWAP, and Adobe Commerce/Magento.

Take Action:

Patch the actively exploited flaws first: Adobe Commerce, Windows, Chrome, GitLab, Cisco Secure FMC, Fortinet, Check Point and N-able N-central. Where you can't patch straight away, take management and admin interfaces off the public internet.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Hawaii Family Dental Reports Data Breach Impacting 45,000 Patients

BeyondMachines — Tue, 15 Sep 2026 12:01:14 +0000

Summary

Hawaii Family Dental suffered a cyberattack in July 2026 that compromised the personal and health information of 45,853 patients. The Qilin ransomware group claimed responsibility for the breach, which was caused by a compromised account.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

ConnectWise Patches Critical ScreenConnect Flaw Exploited in Worm Attacks

BeyondMachines — Tue, 15 Sep 2026 11:01:14 +0000

Summary

ConnectWise fixed a critical vulnerability (CVE-2026-84869) in ScreenConnect that allows unauthorized file execution and worm-like propagation across remote sessions.

Take Action:

If you use ConnectWise ScreenConnect, update to version 26.6.5 right away and then reinstall every host client. The update only takes effect once the clients are reinstalled, and this flaw is already being exploited to spread from machine to machine. If you can't patch, turn off the TransferFiles permission for all user roles as a mitigating measures. Don't forget to check integrated tools like ConnectWise Automate for their own patched versions.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Community Health Care Inc. Reports Data Breach After Phishing Attack

BeyondMachines — Tue, 15 Sep 2026 10:01:27 +0000

Summary

A phishing attack compromised a single Community Health Care Inc. employee email account, exposing Social Security numbers, contact details, insurance data, and medical records for 808 patients.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Swiss Bitcoin Pay Shuts Down Infrastructure Following Internal System Breach

BeyondMachines — Tue, 15 Sep 2026 09:01:14 +0000

Summary

Swiss Bitcoin Pay took its servers offline after a malicious actor gained access to internal systems and potentially compromised customer data including IBANs and hashed passwords. The company says that user funds are safe due to the non-custodial nature of the platform.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Next Level Medical Reports Ransomware Attack, Data Theft

BeyondMachines — Tue, 15 Sep 2026 08:01:13 +0000

Summary

Next Level Medical LLC suffered a ransomware attack by the Pear group, resulting in the alleged theft of three terabytes of sensitive patient and employee data. The organization is investigating the breach.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Surfshark Reports Security Incident Involving Misconfigured Test Server and Unauthorized Access

BeyondMachines — Mon, 14 Sep 2026 10:01:14 +0000

Summary

Surfshark disclosed unauthorized access to an internal test server and isolated proxy server caused by a misconfiguration. The incident exposed limited internal engineering materials and build-related credentials, but no user data or VPN services were affected.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Storm Ransomware Group Claims Penfold Motors Data Breach

BeyondMachines — Mon, 14 Sep 2026 09:01:14 +0000

Summary

Penfold Motors confirmed a data breach involving an external software provider after Storm claimed responsibility for the attack. Exposed information includes customer contact details, vehicle information, VINs, and tax invoices. Penfold stated there is no evidence that bank account details or other high-risk personal information were affected.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

BeyondMachines — Sun, 13 Sep 2026 17:01:13 +0000

Summary

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

Take Action:

If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines