---
title: "Linux Kernel Vulnerabilities, Critical Authlib Bypass, 500,000 Secrets Exposed – Cybersecurity News [September 28, 2026] | DuoCircle"
description: "Explore the latest cybersecurity news, from Linux kernel flaws and Apple zero-days to exposed secrets, malware threats, ransomware, and major cyber attacks."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/"
---
Quick Answer
This cybersecurity roundup covers major threats, including Linux kernel vulnerabilities, Authlib authentication bypasses, exposed GitHub secrets, Apple zero-days, malware campaigns, AWS flaws, ransomware attacks, and major data breaches affecting organizations and users.
Share
[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Linux%20Kernel%20Vulnerabilities%2C%20Critical%20Authlib%20Bypass%2C%20500%2C000%20Secrets%20Exposed%20%E2%80%93%20Cybersecurity%20News%20%5BSeptember%2028%2C%202026%5D&url=undefined%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F&title=Linux%20Kernel%20Vulnerabilities%2C%20Critical%20Authlib%20Bypass%2C%20500%2C000%20Secrets%20Exposed%20%E2%80%93%20Cybersecurity%20News%20%5BSeptember%2028%2C%202026%5D "Share on Reddit") [ ](mailto:?subject=Linux%20Kernel%20Vulnerabilities%2C%20Critical%20Authlib%20Bypass%2C%20500%2C000%20Secrets%20Exposed%20%E2%80%93%20Cybersecurity%20News%20%5BSeptember%2028%2C%202026%5D&body=Check out this article: undefined%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F "Share via Email")
This week brought **critical security concerns** across multiple fronts, from container escapes and authentication bypasses to major data exposures and international cyber threats. Here’s a roundup of the most significant [cybersecurity](https://www.duocircle.com/blog/state-cybersecurity-2026-data-insights-risks-trends-actions-next-steps/) developments shaping the threat landscape.
## Linux Kernel Bugs Plague Docker Container Security
An onslaught of newly discovered Linux kernel vulnerabilities is forcing cybersecurity professionals to completely rethink container security boundaries. [Malware trapped within Docker containers](https://www.securityweek.com/in-other-news-clop-leak-site-takeover-docker-botnet-hunts-ai-keys-water-utility-exposure/) and other containerized environments now has no shortage of kernel exploits available to break out and escape isolation. This represents a fundamental challenge to the security model organizations have relied on to protect their infrastructure. **Security researchers warn** that attackers are actively exploiting these kernel vulnerabilities to move laterally within compromised systems.
## Critical Authlib Authentication Bypass Affects Countless Applications
A [critical vulnerability in Authlib](https://cybernews.com/security/authlib-authentication-bypass-flaw/), a widely-used authentication library, allows attackers to bypass authentication mechanisms on **countless web applications** that depend on it. Security researchers discovered the flaw leaves applications vulnerable to unauthorized access. _Unfortunately, Authlib maintainers have been difficult to reach for vulnerability coordination, raising concerns about the speed of patches reaching vulnerable users worldwide_.
## Over 500,000 Secret Keys Exposed on GitHub
A major security blind spot has been identified in GitHub’s detection systems: while the platform effectively detects many hardcoded secrets, it still fails to catch Gemini [API keys](https://www.fortinet.com/resources/cyberglossary/api-key). A comprehensive analysis revealed that over 500,000 exposed secret keys are sitting on public repositories, with many still actively working and accessible to attackers. This vulnerability allows threat actors to gain unauthorized access to **cloud infrastructure and sensitive services**.
## Popular Mobile Games Embed Trackers from Russia, China, and Israel
A new study by Proton Research discovered that popular games available on Google Play Store contain surveillance trackers originating from **Russia, China, and Israel**. _The research reveals that the mobile gaming industry is built on an insidious surveillance network, with developers embedding third-party tracking code that harvests user data without proper disclosure_. Users downloading these games are unknowingly participating in large-scale data collection operations.
## Apple Patches CoreGraphics Zero-Day Exploited in Active Attacks
[Apple released critical security patches](https://www.darkreading.com/cyberattacks-data-breaches/apple-zero-day-vulnerability-weaponized-targeted-attacks) for CVE-2026-86950, a zero-day vulnerability in the iOS CoreGraphics engine that was being actively exploited in attacks. The flaw allowed attackers to execute arbitrary code on **vulnerable iOS devices**. This marks yet another example of sophisticated threat actors discovering and exploiting Apple vulnerabilities before the company could patch them.
## RatHat Malware Now Offers Malware-as-a-Service with AI Victim Ranking
Cybersecurity researchers uncovered evidence that [RatHat’s command-and-control (C2) panel](https://www.infosecurity-magazine.com/news/rathat-c2-panel-malware-as-a/) has evolved into a full malware-as-a-service offering. _The sophisticated platform now automatically builds malware variants and ranks victims using artificial intelligence based on their perceived value_. With nearly **100 active deployments** tracked, RatHat represents a significant threat to organizations globally.
## Amazon Bedrock AgentCore Flaws Could Expose AWS Credentials
Security researchers identified critical vulnerabilities in the [Amazon Bedrock AgentCore SDK](https://www.infosecurity-magazine.com/news/aws-agentcore-sdk-flaws-ai/) that could allow attackers to escape AI sandboxes and gain access to AWS credentials. The flaws could enable malicious actors to run unauthorized commands within the supposedly isolated AI environment and compromise an organization’s **entire AWS infrastructure**.
## Microsoft Warns of NeedyMantis Malware Enabling Persistent Network Access
_Microsoft Threat Intelligence issued warnings about NeedyMantis, a malware strain deployed by threat actors operating from China_. The malware enables persistent network access to compromised systems and has been observed targeting organizations across multiple industries. The malware’s sophisticated capabilities allow attackers to **maintain long-term access** and move laterally throughout victim networks.
## Japanese Railway Operators Hit by Coordinated Cyber Attacks
_Tokyo Metro and Keio, two of Japan’s largest railway operators, revealed they fell victim to separate cyber attacks_. The attacks disrupted operations and raised national security concerns given the critical nature of transportation infrastructure. **Authorities are investigating** whether the incidents are connected to state-sponsored activity or criminal ransomware groups.
## OpenSSL Releases Fix for High-Severity DTLS Heap Memory Leak
OpenSSL developers released patches for a high-severity vulnerability affecting [DTLS (Datagram Transport Layer Security)](https://securityboulevard.com/2024/10/what-is-datagram-transport-layer-security-dtls-benefits-challenges/) implementations. The flaw could leak heap memory unencrypted to the other side of a DTLS connection or crash the affected program. Organizations using OpenSSL for secure communications were urged to **apply patches immediately**.
## 101 Malicious npm Packages Trap Developers in WhatsApp Subscriber Campaign
_Researchers identified a coordinated attack involving 101 malicious npm packages designed to add developers’ WhatsApp accounts to groups without their consent_. The campaign, dubbed PhantomSub, is part of a larger social engineering operation targeting developers. These compromised packages **had thousands of downloads** before being removed from npm.
## ShinyHunters Suspect “Rey” Detained in Jordan, Cooperating with FBI
Dutch authorities arrested a 24-year-old suspect linked to the ShinyHunters digital extortion group, known by the online alias “Rey.” The suspect, whose real name is **Saif al-Din Khader**, was reportedly detained on **September 29, 2026**, and is now cooperating with the U.S. Federal Bureau of Investigation. His cooperation is considered critical to identifying and apprehending other members of the notorious hacking group responsible for multiple high-profile breaches.
## Fortinet FortiMail Critical Vulnerability CVE-2026-104286 Under Active Exploitation
A critical path-traversal vulnerability in Fortinet FortiMail (CVE-2026-104286, CVSS 9.8) allows unauthenticated attackers to write arbitrary files to the underlying system via crafted HTTP requests. The vulnerability affects multiple versions of FortiMail and has already been added to **CISA’s Known Exploited Vulnerabilities** catalog due to evidence of active exploitation. Fortinet has not yet released patched versions, forcing administrators to implement workarounds immediately.
## Europol Dismantles KillSec Leak Site, Secures 110 TB of Stolen Data
_International law enforcement agencies successfully dismantled the KillSec ransomware group’s leak site as part of Operation KillSwitch_. Europol announced the takedown on October 1, 2026, confirming the seizure of at least [110 terabytes of stolen data](https://www.cyberdaily.au/security/14258-takedown-police-seize-110-terabytes-of-stolen-data-from-killsec-ransomware-leak-site). The operation represents a significant blow to one of the most active ransomware operations targeting organizations worldwide.
## Bitget Crypto Exchange Suffers Year’s Largest Hack-$387.5 Million Stolen
_Cryptocurrency exchange Bitget confirmed that attackers stole approximately $387.5 million from its hot and warm wallets on September 24, 2026_. The initial estimate of $351.6 million was revised upward after additional stolen assets on **Zcash and TRON** were traced. The attack is the largest [crypto exchange hack of 2026](https://www.cnbc.com/2026/10/02/bitget-crypto-stolen-hack-recovery.html). Bitget’s security team detected the breach at 18:31 UTC and confirmed that cold wallets remained secure. While the company suspended withdrawals temporarily, Bitget stated that user funds remain protected by its **User Protection Fund**, which holds over $464 million. CEO Gracy Chen indicated that a North Korean hacking group may be responsible for the attack.
## MI5 Warns China’s MSS Funds Research Involving 100+ U.K.-Linked Academics
The [UK’s Security Service (MI5) issued](https://thehackernews.com/2026/10/mi5-says-chinas-mss-funded-research.html) a “Security Service Espionage Alert” on September 30, 2026, warning that the **China General Technology Research Institute (CGTRI)** is primarily funded by China’s Ministry of State Security to conduct research that directly improves MSS espionage capabilities. MI5 identified involvement of more than 100 U.K.-linked academics and researchers, raising concerns about intellectual property theft and foreign intelligence operations.
## Fake ChatGPT Advertisements Deliver ClickFix Malware to Unsuspecting Users
Cybersecurity researchers warned of a coordinated attack using [fake ChatGPT advertisements](https://siften.com/read/technology/fake-chatgpt-ads-show-malware-operators-abusing-ai-interaction-layers-not-just-a-1791077283598) to distribute ClickFix malware. _When users clicked on the malicious ads appearing in search results, they were redirected to pages that deployed ClickFix attacks, leading to malware installation_. The campaign highlights how attackers are **leveraging the popularity of AI tools** to deceive users into downloading malicious software. SPF, [DKIM](https://www.duocircle.com/blog/email-hosting/what-is-dkim-and-why-you-should-use-it-to-secure-your-email/), and [DMARC](https://www.duocircle.com/email/dmarc/) strengthen [email security](https://www.duocircle.com/) by helping prevent spoofing, phishing, and unauthorized email use.
Brad Slavin
General Manager
General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.
## Secure your email infrastructure
Protect, authenticate, and deliver. Contact our team to find the right solution.
[Contact Sales](/contact/) [Explore Products](/products/)
Share this article
[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F) [ ](https://twitter.com/intent/tweet?text=Linux%20Kernel%20Vulnerabilities%2C%20Critical%20Authlib%20Bypass%2C%20500%2C000%20Secrets%20Exposed%20%E2%80%93%20Cybersecurity%20News%20%5BSeptember%2028%2C%202026%5D&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-40-of-2026%2F) Copy
Related Articles
- [  Cisco SD-WAN Flaw, Critical NGINX Exploit, Foxconn Ransomware Attack – Cybersecurity News \[May 11, 2026\] Blog ](/blog/cybersecurity-news-update-week-20-of-2026/)
- [  GitHub Code Leak, 7-Eleven Breached, NYC Patient Exposure – Cybersecurity News \[May 18, 2026\] Blog ](/blog/cybersecurity-news-update-week-21-of-2026/)
- [  FBI Warns Firms, Carnival Breach, GlobalProtect Flaw – Cyber News Blog ](/blog/cybersecurity-news-update-week-22-of-2026/)
- [  DentaQuest Leak, Cisco Patch Pending, Instagram Bug – Cyber News Blog ](/blog/cybersecurity-news-update-week-23-of-2026/)
## Related Articles
[ news Cisco SD-WAN Flaw, Critical NGINX Exploit, Foxconn Ransomware Attack – Cybersecurity News \[May 11, 2026\] May 18, 2026 ](/blog/cybersecurity-news-update-week-20-of-2026/)[ news GitHub Code Leak, 7-Eleven Breached, NYC Patient Exposure – Cybersecurity News \[May 18, 2026\] May 25, 2026 ](/blog/cybersecurity-news-update-week-21-of-2026/)[ news FBI Warns Firms, Carnival Breach, GlobalProtect Flaw – Cyber News Jun 1, 2026 ](/blog/cybersecurity-news-update-week-22-of-2026/)[ news DentaQuest Leak, Cisco Patch Pending, Instagram Bug – Cyber News Jun 8, 2026 ](/blog/cybersecurity-news-update-week-23-of-2026/)
```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```
```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```
```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Linux Kernel Vulnerabilities, Critical Authlib Bypass, 500,000 Secrets Exposed – Cybersecurity News [September 28, 2026]","description":"Explore the latest cybersecurity news, from Linux kernel flaws and Apple zero-days to exposed secrets, malware threats, ransomware, and major cyber attacks.","url":"https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/","datePublished":"2026-10-05T00:00:00.000Z","dateModified":"2026-10-05T00:00:00.000Z","dateCreated":"2026-10-05T00:00:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/"},"articleSection":"news","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/spf-record-6732-1791191970404.jpg","caption":"cybersecurity news updates"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"news"},{"@type":"ListItem","position":3,"name":"Linux Kernel Vulnerabilities, Critical Authlib Bypass, 500,000 Secrets Exposed – Cybersecurity News [September 28, 2026]","item":"https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/"}]}]
```
```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"news","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Linux Kernel Vulnerabilities, Critical Authlib Bypass, 500,000 Secrets Exposed – Cybersecurity News [September 28, 2026]","item":"https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/"}]}
```
```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Linux Kernel Vulnerabilities, Critical Authlib Bypass, 500,000 Secrets Exposed – Cybersecurity News [September 28, 2026]","description":"Explore the latest cybersecurity news, from Linux kernel flaws and Apple zero-days to exposed secrets, malware threats, ransomware, and major cyber attacks.","url":"https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/","datePublished":"2026-10-05T00:00:00.000Z","dateModified":"2026-10-05T00:00:00.000Z","dateCreated":"2026-10-05T00:00:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/cybersecurity-news-update-week-40-of-2026/"},"articleSection":"news","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/spf-record-6732-1791191970404.jpg","caption":"cybersecurity news updates"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```