Automatic translation from Italian. The Italian version is the reference text.

1. The "dancer scam" is back: fake contests on WhatsApp used to hijack accounts

   source: CERT-AgID · 6 Oct 2026

   CERT-AgID reports a phishing campaign that arrives from an already compromised contact and asks you to vote for a young dancer in a contest. The voting page asks you to "verify" your WhatsApp account: the code entered actually links an attacker-controlled device to the profile, letting them read conversations and resend the message to contacts.

   For a small businesscheck WhatsApp Settings Linked devices right away for unknown devices, turn on two-step verification and tell staff never to enter codes on sites reached through messages.

2. Atlassian: critical flaw in eight self-hosted products, already exploited

   source: BleepingComputer · 7 Oct 2026

   Atlassian published an advisory for CVE-2026-21589, an unauthenticated arbitrary file access vulnerability in eight self-hosted products, including Jira, Confluence and Bitbucket Data Center. After a PoC was released, a honeypot detected exploitation attempts about two hours later. Atlassian advises updating or, failing that, applying the listed mitigations.

   For a small businessif you run Jira or Confluence on your own servers, have whoever manages them update straight away; with Atlassian Cloud there is nothing to do, as the fix is already applied.

3. Pixel: the October 2026 security patch is rolling out

   source: TuttoAndroid · 6 Oct 2026

   Google has started a staged rollout of the monthly update to all supported Pixels, from the Pixel 6 to the Pixel 11 Pro Fold. It fixes 25 Android vulnerabilities (7 critical) and 7 Pixel-specific ones (3 critical), plus some keyboard, audio and camera bugs. It may be the last update for the Pixel 6 and 6 Pro, as their support ends in October 2026.

   For a small businessinstall the update from Settings System System update on company Pixel phones and, if you have Pixel 6 devices, plan their replacement.

4. Fake fines by SMS and email: CERT-AgID explains how they work

   source: Civico20News · 9 Oct 2026

   According to the CERT-AgID analysis reported by the outlet, the campaigns imitate the Polizia di Stato and pagoPA with exact amounts, case numbers and tight deadlines. The fake payment pages ask for card number, expiry and CVV, or plate number and tax code. In 2026, domains containing "poliziadistato" have been registered that do not belong to the police.

   For a small businessnever pay a fine through a link you receive: check on the issuing body's website and, if someone entered card details, have the bank block the card immediately.

Roundup compiled automatically with AI from the sources listed: the original articles are the reference for details.