Linux Kernel Vulnerabilities, Critical Authlib Bypass, 500,000 Secrets Exposed – Cybersecurity News [September 28, 2026]

This week brought critical security concerns across multiple fronts, from container escapes and authentication bypasses to major data exposures and international cyber threats. Here’s a roundup of the most significant cybersecurity developments shaping the threat landscape.

Linux Kernel Bugs Plague Docker Container Security

An onslaught of newly discovered Linux kernel vulnerabilities is forcing cybersecurity professionals to completely rethink container security boundaries. Malware trapped within Docker containers and other containerized environments now has no shortage of kernel exploits available to break out and escape isolation. This represents a fundamental challenge to the security model organizations have relied on to protect their infrastructure. Security researchers warn that attackers are actively exploiting these kernel vulnerabilities to move laterally within compromised systems. https://cybernews.com/security/

Critical Authlib Authentication Bypass Affects Countless Applications

A critical vulnerability in Authlib, a widely-used authentication library, allows attackers to bypass authentication mechanisms on countless web applications that depend on it. Security researchers discovered the flaw leaves applications vulnerable to unauthorized access. Unfortunately, Authlib maintainers have been difficult to reach for vulnerability coordination, raising concerns about the speed of patches reaching vulnerable users worldwide. https://cybernews.com/security/

Over 500,000 Secret Keys Exposed on GitHub

A major security blind spot has been identified in GitHub’s detection systems: while the platform effectively detects many hardcoded secrets, it still fails to catch Gemini API keys. A comprehensive analysis revealed that over 500,000 exposed secret keys are sitting on public repositories, with many still actively working and accessible to attackers. This vulnerability allows threat actors to gain unauthorized access to cloud infrastructure and sensitive services. https://cybernews.com/security/

Popular Mobile Games Embed Trackers from Russia, China, and Israel

A new study by Proton Research discovered that popular games available on Google Play Store contain surveillance trackers originating from Russia, China, and Israel. The research reveals that the mobile gaming industry is built on an insidious surveillance network, with developers embedding third-party tracking code that harvests user data without proper disclosure. Users downloading these games are unknowingly participating in large-scale data collection operations. https://cybernews.com/security/

Apple Patches CoreGraphics Zero-Day Exploited in Active Attacks

Apple released critical security patches for CVE-2026-86950, a zero-day vulnerability in the iOS CoreGraphics engine that was being actively exploited in attacks. The flaw allowed attackers to execute arbitrary code on vulnerable iOS devices. This marks yet another example of sophisticated threat actors discovering and exploiting Apple vulnerabilities before the company could patch them. https://www.infosecurity-magazine.com/news/

RatHat Malware Now Offers Malware-as-a-Service with AI Victim Ranking

Cybersecurity researchers uncovered evidence that RatHat’s command-and-control (C2) panel has evolved into a full malware-as-a-service offering. The sophisticated platform now automatically builds malware variants and ranks victims using artificial intelligence based on their perceived value. With nearly 100 active deployments tracked, RatHat represents a significant threat to organizations globally. https://www.infosecurity-magazine.com/news/

Amazon Bedrock AgentCore Flaws Could Expose AWS Credentials

Security researchers identified critical vulnerabilities in the Amazon Bedrock AgentCore SDK that could allow attackers to escape AI sandboxes and gain access to AWS credentials. The flaws could enable malicious actors to run unauthorized commands within the supposedly isolated AI environment and compromise an organization’s entire AWS infrastructure. https://www.infosecurity-magazine.com/news/

Microsoft Warns of NeedyMantis Malware Enabling Persistent Network Access

Microsoft Threat Intelligence issued warnings about NeedyMantis, a malware strain deployed by threat actors operating from China. The malware enables persistent network access to compromised systems and has been observed targeting organizations across multiple industries. The malware’s sophisticated capabilities allow attackers to maintain long-term access and move laterally throughout victim networks. https://www.infosecurity-magazine.com/news/

Japanese Railway Operators Hit by Coordinated Cyber Attacks

Tokyo Metro and Keio, two of Japan’s largest railway operators, revealed they fell victim to separate cyber attacks. The attacks disrupted operations and raised national security concerns given the critical nature of transportation infrastructure. Authorities are investigating whether the incidents are connected to state-sponsored activity or criminal ransomware groups. https://www.infosecurity-magazine.com/news/

OpenSSL Releases Fix for High-Severity DTLS Heap Memory Leak

OpenSSL developers released patches for a high-severity vulnerability affecting DTLS (Datagram Transport Layer Security) implementations. The flaw could leak heap memory unencrypted to the other side of a DTLS connection or crash the affected program. Organizations using OpenSSL for secure communications were urged to apply patches immediately. https://www.wiu.edu/cybersecuritycenter/cybernews.php

101 Malicious npm Packages Trap Developers in WhatsApp Subscriber Campaign

Researchers identified a coordinated attack involving 101 malicious npm packages designed to add developers’ WhatsApp accounts to groups without their consent. The campaign, dubbed PhantomSub, is part of a larger social engineering operation targeting developers. These compromised packages had thousands of downloads before being removed from npm. https://www.wiu.edu/cybersecuritycenter/cybernews.php

ShinyHunters Suspect “Rey” Detained in Jordan, Cooperating with FBI

Dutch authorities arrested a 24-year-old suspect linked to the ShinyHunters digital extortion group, known by the online alias “Rey.” The suspect, whose real name is Saif al-Din Khader, was reportedly detained on September 29, 2026, and is now cooperating with the U.S. Federal Bureau of Investigation. His cooperation is considered critical to identifying and apprehending other members of the notorious hacking group responsible for multiple high-profile breaches. https://thehackernews.com/

Fortinet FortiMail Critical Vulnerability CVE-2026-104286 Under Active Exploitation

A critical path-traversal vulnerability in Fortinet FortiMail (CVE-2026-104286, CVSS 9.8) allows unauthenticated attackers to write arbitrary files to the underlying system via crafted HTTP requests. The vulnerability affects multiple versions of FortiMail and has already been added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of active exploitation. Fortinet has not yet released patched versions, forcing administrators to implement workarounds immediately. https://securityonline.info/fortimail-vulnerability-cve-2026-104286/

Europol Dismantles KillSec Leak Site, Secures 110 TB of Stolen Data

International law enforcement agencies successfully dismantled the KillSec ransomware group’s leak site as part of Operation KillSwitch. Europol announced the takedown on October 1, 2026, confirming the seizure of at least 110 terabytes of stolen data. The operation represents a significant blow to one of the most active ransomware operations targeting organizations worldwide. https://ipsip.vn/en/post/cybersecurity-weekly-news-september-28-october-4-2026

Bitget Crypto Exchange Suffers Year’s Largest Hack-$387.5 Million Stolen

Cryptocurrency exchange Bitget confirmed that attackers stole approximately $387.5 million from its hot and warm wallets on September 24, 2026. The initial estimate of $351.6 million was revised upward after additional stolen assets on Zcash and TRON were traced. The attack is the largest crypto exchange hack of 2026. Bitget’s security team detected the breach at 18:31 UTC and confirmed that cold wallets remained secure. While the company suspended withdrawals temporarily, Bitget stated that user funds remain protected by its User Protection Fund, which holds over $464 million. CEO Gracy Chen indicated that a North Korean hacking group may be responsible for the attack. https://oneminers.com/

MI5 Warns China’s MSS Funds Research Involving 100+ U.K.-Linked Academics

The UK’s Security Service (MI5) issued a “Security Service Espionage Alert” on September 30, 2026, warning that the China General Technology Research Institute (CGTRI) is primarily funded by China’s Ministry of State Security to conduct research that directly improves MSS espionage capabilities. MI5 identified involvement of more than 100 U.K.-linked academics and researchers, raising concerns about intellectual property theft and foreign intelligence operations. https://thehackernews.com/

Fake ChatGPT Advertisements Deliver ClickFix Malware to Unsuspecting Users

Cybersecurity researchers warned of a coordinated attack using fake ChatGPT advertisements to distribute ClickFix malware. When users clicked on the malicious ads appearing in search results, they were redirected to pages that deployed ClickFix attacks, leading to malware installation. The campaign highlights how attackers are leveraging the popularity of AI tools to deceive users into downloading malicious software. SPF, DKIM, and DMARC strengthen email security by helping prevent spoofing, phishing, and unauthorized email use. https://dev.to/ziizium/security-news-weekly-round-up-2nd-october-2026-i24