ARTICLES 2026 SEPTEMBER January(387) February(431) March(447) April(451) May(495) June(499) July(647) August(1282) September(893) October(0) November(0) December(0) | YEARS(4 225) STATISTICS (0)
DATE |
NAME | Info |
CATEG. |
WEB |
|
30.9.26 |
OpenAI agents go rogue: AI agent governance lessons | Recently and rather quietly, there have been reports that describe an alarming case where thousands of AI agents used a dormant wiki as a coordination mechanism. On the surface, it’s a fascinating technical story. | AI blog | Barracuda Networks Blog |
|
30.9.26 |
SOCRadar Attack Surface Management Now Integrates with ArmorCode ASPM | Your team has a process for triaging vulnerabilities. The question is whether findings from your external attack surface ever reach it. An internet-facing asset carrying a critical CVE may be sitting outside the system your application security team reviews each day. | Hacking blog | SOCRADAR |
|
30.9.26 |
The 2026 U.S. Midterms Election Cyber Landscape | In late April 2026, Army General Joshua Rudd, the head of U.S. Cyber Command and the NSA, testified before the Senate Armed Services Committee that foreign adversaries would likely attempt to interfere in the upcoming midterm elections. When pressed on whether the joint Election Security Group had been stood up, he said he was not sure. | BigBrother blog | SOCRADAR |
|
30.9.26 |
Hacker-for-Hire Economy: Inside Cyber Mercenaries | Somewhere on the dark web, a threat actor is running a business with published prices, customer reviews, communication channels, and an escrow system, much like legitimate online businesses. | Hacking blog | Flare |
|
30.9.26 |
Beware of Malware infection in Facebook Ads Offering Cryptocurrency Rewards | Just because it’s a familiar tactic doesn’t mean you can let your guard down. A similar attack method using cryptocurrency rewards as bait has recently been identified again. This time, a case was confirmed in which the Node.Js-based malware JSCEAL was distributed through Facebook ads impersonating a cryptocurrency exchange. | Cryptocurrency blog | ASEC |
|
30.9.26 |
Zecurit RMM Abuse: DocuSign Phishing Campaign | ZeroBEC investigated a phishing email that impersonated a document-signing workflow and ultimately delivered the Windows agent for Zecurit, a legitimate remote monitoring and management platform. | Phishing blog | ZeroBEC |
|
30.9.26 |
Linux endpoint management without MDM via Elastic Workflows | Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Codex config onto new laptops without piling up duplicate actions on offline hosts, and it works for other config too. | OS Blog | Elastic Security Labs |
|
30.9.26 |
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | On August 31, 2026, eSentire's Threat Response Unit (TRU) detected exploitation of zero-day vulnerabilities disclosed in our security advisory, PaperCut Discloses Zero-Day Vulnerabilities (CVE-2026-82078 and CVE-2026-81578), published on September 3, 2026 affecting a customer in the Education industry. | Vulnerebility blog | eSentire |
|
30.9.26 |
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report | Ransomware is no longer defined only by how many organizations get hit. The most important shifts are happening beneath the headline victim counts; in how attackers gain access, who they target first, and how much data they steal once they’re in. | Ransom blog | Zscaler |
|
30.9.26 |
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) | NetScaler, from Citrix (now under Cloud Software Group), is an application delivery controller - some believe it qualifies to be described as a security appliance. | Vulnerebility blog | LABS WATCHTOWR |
|
30.9.26 |
Star Blizzard refines phishing and malware delivery with the RedFlick technique | Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. | APT blog | Microsoft blog |
|
30.9.26 |
TOPHIT Part 2: Renting the Attack Surface | CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code. | Malware blog | CloudSEK |
|
30.9.26 |
TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2 | CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed. | Malware blog | CloudSEK |
|
30.9.26 |
MALFEX - A malicious npm postinstall no advisory has caught for fourteen months | CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months. | Malware blog | CloudSEK |
|
30.9.26 |
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT | Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to | Hack | The Hacker News |
|
30.9.26 |
OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted | A High-severity OpenSSL flaw can leak heap memory to the other side of a DTLS connection or crash the program, OpenSSL said on September 29 | Vulnerebility | The Hacker News |
|
30.9.26 |
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution | Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has | Exploit | The Hacker News |
|
30.9.26 |
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks | An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in | BigBrothers | The Hacker News |
|
30.9.26 |
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses | A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects | Attack | The Hacker News |
|
30.9.26 |
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor | Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows | APT | The Hacker News |
|
30.9.26 |
Kiteworks Fixes Critical Flaw Found During Nine-Hour Precautionary Shutdown | Kiteworks on Monday said it worked with federal intelligence authorities over the weekend as it identified and addressed a critical security | Vulnerebility | The Hacker News |
|
30.9.26 |
101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent | Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber | Social | The Hacker News |
|
30.9.26 |
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation | Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. "It is true that | CyberCrime | The Hacker News |
|
29.9.26 |
Browser-Based Threat Intelligence & Research | We all know the routine. You’re deep into a new threat report or a breaking blog post, and the tab management anxiety starts to kick in. You find a suspicious indicator, copy it, pivot to your internal tools to see if you’ve seen it before, paste it into a notepad, and then—maybe—try to get it into an actual investigation. | Cyber blog | Securonix SynQ |
|
29.9.26 |
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 | Citrix has released emergency security updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days already exploited in the wild. | Vulnerebility blog | SOCRADAR |
|
29.9.26 |
Metree, WuBook, SonicWall Access and Data Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Metree e-commerce database leak, an alleged WuBook customer data leak, and an alleged SonicWall-based access auction for a U.S. automotive engineering firm. Other posts advertised alleged student records from campus.gov.il and an alleged Kenyan vehicle valuation database containing more than 1.2 million records. | CyberCrime blog | SOCRADAR |
|
29.9.26 |
Citrix NetScaler Zero-Day RCE vulnerabilities: FAQ | CVE-2026-88771 and CVE-2026-88772, two zero-day vulnerabilities in Citrix NetScaler, have been confirmed as exploited in the wild. Citrix released patches on September 27, 2026. | Vulnerebility blog | TENABLE |
|
29.9.26 |
PhantomSub: Malicious npm Campaign Hits WhatsApp Users | 490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp. | Malware blog | OX SECURITY |
|
29.9.26 |
Beyond DICOM: 1,057 FHIR & 656 HL7 Systems Exposures | For a decade, everyone hunting exposed healthcare infrastructure has looked at the same protocol: DICOM. Open PACS servers spilling X-rays onto the public internet make for a good headline, and the research has been thorough. | Incident blog | Flare |
|
29.9.26 |
Aviation Infrastructure DNS Exposure: A Sector-Wide Look | An airport is a large industrial facility that has runways. It runs flight information displays, credential and badging platforms, baggage handling, airfield lighting, fuel farms, parking revenue control, weather observing, license plate recognition, stormwater monitoring, and building automation. Most aviation cybersecurity research has focused on radio protocols, rather than external measurement of that landslide layer. | Hacking blog | Flare |
|
29.9.26 |
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability | The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second incident, the attacker ran a scanner tool to search for additional Attack Targets. | Vulnerebility blog | ASEC |
|
29.9.26 |
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix | Attackers are abusing ChatGPT Custom GPTs to impersonate legitimate product offerings, then directing victims to a malicious "backup" site through a trusted ChatGPT-hosted interface. Huntress researchers found two Custom GPTs linked to the same campaign that were being used in this manner. | AI blog | Huntress |
|
29.9.26 |
Phishing incident response with Elastic and Sublime Security | The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response can tie a quarantined email to what happens next on the endpoint and pull the threat from every mailbox it reached. | Phishing blog | Elastic Security Labs |
|
29.9.26 |
Russian and Allied Government Systems Compromised in Targeted Campaigns | Three exposed operator workspaces reveal confirmed access to Russian and Kyrgyz government systems, a Syrian Customs C2 inventory, stolen data and wider targeting of Russian state and industrial organisations. | APT blog | Ctrl-Alt-Intel |
|
29.9.26 |
Attackers Target Ledger Users Via Google Ads | In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes. | Cryptocurrency blog | ThreatLabz |
|
29.9.26 |
Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials | A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a | Vulnerebility | The Hacker News |
|
29.9.26 |
OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions | OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence (AI) model that was planned for an | AI | The Hacker News |
|
29.9.26 |
OpenAI Pauses Tool Use After Agent Bypasses Internet Controls to Reach External Chatbot | OpenAI said it has made the decision to pause training of its most powerful models after one of its agents during reinforcement learning (RL) | AI | The Hacker News |
|
29.9.26 |
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks | Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950 , refers | Exploit | The Hacker News |
|
29.9.26 |
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks | Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of | Virus | The Hacker News |
|
29.9.26 |
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M | The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party | Cryptocurrency | The Hacker News |
|
29.9.26 |
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims | RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security | Virus | The Hacker News |
|
29.9.26 |
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent | Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that's targeting exposed Docker daemons to deploy an | BotNet | The Hacker News |
|
28.9.26 |
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources | The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using | Virus | The Hacker News |
|
28.9.26 |
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its | Exploit | The Hacker News |
|
27.9.26 |
Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors | Anthropic has just announced a new Claude Marketplace, and it brings all AI-related tools into one place, including plugins, connectors, agents, and more. | AI | BleepingComputer |
|
27.9.26 |
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks | The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. | Hack | BleepingComputer |
|
27.9.26 |
Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer | Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5. | AI | BleepingComputer |
|
27.9.26 |
Microsoft pauses KB5002907 update after Office license deactivations | Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after users report that it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations. | OS | BleepingComputer |
|
27.9.26 |
GitHub Actions re-enabled with Mini Shai-Hulud payload still active | Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. | Hack | BleepingComputer |
|
27.9.26 |
OpenAI's AI agents accidentally uploaded user-provided images to third-party sites | OpenAI says its AI agents uploaded user-provided images to third-party image-hosting services while carrying out research and evaluation tasks. | AI | BleepingComputer |
|
27.9.26 |
Kiteworks urges 6-hour server shutdown over potential zero-day attacks | Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. | Vulnerebility | BleepingComputer |
|
27.9.26 |
ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw | The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. | CyberCrime | BleepingComputer |
|
27.9.26 |
Elementor WordPress flaw lets attackers create admin accounts | A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. | Vulnerebility | BleepingComputer |
|
27.9.26 |
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks | The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. | Exploit | BleepingComputer |
|
27.9.26 |
Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions | Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free usage credits, so more users can give it a try. | AI | BleepingComputer |
|
27.9.26 |
OpenAI is preparing a $500 ChatGPT Pro Max plan with faster Codex | OpenAI appears to be preparing a new ChatGPT Pro Max subscription that could cost $500 per month, but it's unclear when it'll begin rolling out. | AI | BleepingComputer |
|
27.9.26 |
With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance | AI agents can operate through human credentials and take actions that existing SOC 2 controls may not distinguish from human activity. Token Security explains why SOC 2 needs to adapt to address the security gaps created by agent identities. | Security | BleepingComputer |
|
27.9.26 |
Microsoft plans to deprecate Windows Deployment Services | Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role starting with the next Windows Server release. | OS | BleepingComputer |
|
27.9.26 |
Rydox marketplace admin pleads guilty, faces 22 years in prison | A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. | CyberCrime | BleepingComputer |
|
27.9.26 |
Microsoft: Recent Windows updates cause desktop loading issues | Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates. | OS | BleepingComputer |
|
27.9.26 |
Hackers steal $351.6 million in Bitget crypto exchange hack | Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets. | Cryptocurrency | BleepingComputer |
|
27.9.26 |
MacSync malware uses public iCloud calendars to deliver new payloads | A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. | Virus | BleepingComputer |
|
27.9.26 |
New Carbonato malware uses AI agents to hijack exposed Docker hosts | A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. | AI | BleepingComputer |
|
27.9.26 |
Exposed GitLab project email addresses let attackers push code | Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. | Hack | BleepingComputer |
|
27.9.26 |
FedRAMP VDR & VER: Daily Scans Are Only the Beginning | FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated compliance validation. | Security | BleepingComputer |
|
27.9.26 |
Hackers now exploit critical Roundcube flaw in code injection attacks | A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. | Exploit | BleepingComputer |
|
27.9.26 |
Windows 11 KB5124010 update released with 46 changes and fixes | Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2, with 46 changes including Bluetooth improvements and the ability to remap the Copilot key. | OS | BleepingComputer |
|
27.9.26 |
CISA: Ransomware gangs now exploiting critical TeamCity flaw | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. | Ransom | BleepingComputer |
|
27.9.26 |
OpenAI hacked Australian Medicare govt site, probed data providers | OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project. | AI | BleepingComputer |
|
27.9.26 |
Microsoft fixes bug that broke Windows File History backup feature | Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates. | OS | BleepingComputer |
|
27.9.26 |
Placeholder domain used in dev docs now serves ClickFix attacks | The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. | Hack | BleepingComputer |
|
27.9.26 |
New RemControl Android banking malware targets users in Europe and Canada | A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. | Virus | BleepingComputer |
|
27.9.26 |
Check Point warns of hackers exploiting Security Gateway VPN RCE flaw | Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. | Vulnerebility | BleepingComputer |
|
27.9.26 |
A stalker in the box: infrastructure linking PandorahVNC and Mesh Central | Hidden Virtual Network Computing (HVNC) is a sophisticated form of remote access designed for stealthy control over an infected system. Unlike traditional VNC tools, HVNC operates covertly, ensuring that the infected user’s desktop environment remains unchanged and unsuspecting while the attacker manipulates a hidden desktop session. | Malware blog | INTRINSEC |
|
27.9.26 |
Inside Corp MDM, the Android spyware targeting logistics companies | A malware campaign targeting the logistics sector used fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file disguised as a system service. The delivered app, package com.corp.mdm, is a compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service. | Malware blog | Have I Been Squatted |
|
27.9.26 |
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. | Exploit blog | GTI |
|
27.9.26 |
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites | This blog post is about a Cross-Site Request Forgery vulnerability in the Elementor Website Builder plugin. One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an administrator clicking the link creates a second administrator account for the attacker. | Vulnerebility blog | Patchstack |
|
27.9.26 |
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation | Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being | Exploit | The Hacker News |
|
27.9.26 |
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials | The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a | Virus | The Hacker News |
|
27.9.26 |
Hackers start exploiting critical WordPress flaw for code execution | Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. | Exploit | BleepingComputer |
|
27.9.26 |
Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers | A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. | AI | BleepingComputer |
|
27.9.26 |
InfraTrust report warns network management systems under attack | Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. | Hack | BleepingComputer |
|
27.9.26 |
Arista patches actively exploited VeloCloud Orchestrator zero-day | Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments. | Exploit | BleepingComputer |
|
27.9.26 |
Microsoft: September Windows updates break Always On VPN connections | Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems. | OS | BleepingComputer |
|
27.9.26 |
Ryuk ransomware member sentenced to 24 months in prison | An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. | Ransom | BleepingComputer |
|
27.9.26 |
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks | F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. | Exploit | BleepingComputer |
|
27.9.26 |
Rogue external MFA providers can steal passwords during logins | Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts. | Incindent | BleepingComputer |
|
27.9.26 |
Sweden fines Miljödata $183,000 over breach affecting 2.2 million | Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people. | Incindent | BleepingComputer |
|
27.9.26 |
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data | A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. | Exploit | BleepingComputer |
|
27.9.26 |
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach | The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants. | CyberCrime | BleepingComputer |
|
27.9.26 |
New ClosedQuorum Windows malware uses AI for attack decisions | A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. | Virus | BleepingComputer |
|
27.9.26 |
Reducing shadow IT visibility gaps with Wazuh | Shadow IT can leave security teams unaware of unmanaged endpoints, unauthorized software, and other assets that fall outside existing monitoring. Wazuh explains how endpoint inventory, agentless monitoring, and centralized analysis can help organizations identify and reduce these visibility gaps. | Security | BleepingComputer |
|
27.9.26 |
Check Point warns of Management Server zero-day exploited in attacks | Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts. | Exploit | BleepingComputer |
|
26.9.26 |
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells | Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the | Exploit | The Hacker News |
|
26.9.26 |
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link | Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an | Vulnerebility | The Hacker News |
|
26.9.26 |
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts | The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU). | Phishing | BleepingComputer |
|
26.9.26 |
Webinar tomorrow: Inside real-world Google Workspace breaches | Tomorrow's webinar examines real Google Workspace breaches involving social engineering and malicious OAuth applications, from initial access through the critical first hours of incident response. Learn which security controls and response decisions can make the greatest difference. | Security | BleepingComputer |
|
26.9.26 |
D-Link warns of max severity zero-day bug in DIR-822A routers | D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers. | Exploit | BleepingComputer |
|
26.9.26 |
New Windows Defender zero-day blocks Microsoft antivirus updates | Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates | Exploit | BleepingComputer |
|
26.9.26 |
CISA orders feds to patch Zyxel flaw exploited for data theft | Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). | Exploit | BleepingComputer |
|
26.9.26 |
BigCommerce alerts merchants of data breach linked to Ribon apps | Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. | Incindent | BleepingComputer |
|
26.9.26 |
CISA alerts of active exploitation of three Linux kernel flaws | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. | Exploit | BleepingComputer |
|
26.9.26 |
WordPress Click2Shell flaw lets hackers execute PHP on the server | Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. | Vulnerebility | BleepingComputer |
|
26.9.26 |
Microsoft to retire Microsoft 365 Companion apps in December | Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove them from managed devices. | OS | BleepingComputer |
|
26.9.26 |
Google fined €403 million over location data privacy violations | Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users' location data. | BigBrothers | BleepingComputer |
|
26.9.26 |
Microsoft fixes broken Excel copy and paste for all Office users | Microsoft has fixed a known issue that causes copy-and-paste failures for Excel users after installing the September 2026 security updates. | OS | BleepingComputer |
|
26.9.26 |
FBI's CJIS v6.1: What Security Teams Need to Know. | The FBI's CJIS Security Policy v6.1 strengthens requirements around encryption and vulnerability scanning while continuing the shift toward more continuous security assessment. Specops explains what changed and how agencies can address password, MFA, and identity requirements as they prepare for upcoming audits. | BigBrothers | BleepingComputer |
|
26.9.26 |
Microsoft reminds admins to migrate Entra ID users to passkeys | Microsoft has reminded admins to migrate Entra ID users to phishing-resistant authentication methods to avoid sign-in disruptions after it retires SMS first-factor sign-in starting in February 2027 | OS | BleepingComputer |
|
26.9.26 |
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities ( KEV ) catalog, citing | Exploit | The Hacker News |
|
26.9.26 |
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack | Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend after | Incindent | The Hacker News |
|
26.9.26 |
See No EvilTokens: Disrupting the EvilTokens PhaaS Platform | EvilTokens – a top PhaaS platform that first commoditized the device code phishing technique – was disrupted through a collaborative public-private partnership led by Microsoft. | Phishing blog | SPYCLOUD |
|
26.9.26 |
How Aikido finds more vulnerabilities than Claude Security with Mythos at half the cost | Claude Mythos is arguably the strongest cybersecurity model that Anthropic has built. But we know that model capability is only part of what determines how well an AI vulnerability product performs. | AI blog | AIKIDO.DEV |
|
26.9.26 |
Could OpenClaw have actually hacked that Australian gym? We decided to test it. | Earlier this month, Australian journalists reported on an OpenClaw AI assistant hacking into a gym website in what was described as the “first known Australian autonomous cyber attack”. Reportedly, in response to benign requests for assistance booking gym sessions, the AI agent identified vulnerabilities in the gym booking system to book classes months in advance and kick another gymgoer off a waitlist to advance the user’s position. | AI blog | AIKIDO.DEV |
|
26.9.26 |
MemTensor npm and PyPI Packages Hit by a Go Worm - Real-time Open Source Software Supply Chain Security | On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs in the background each time the package loads. | Hacking blog | SAFEDEP.IO |
|
26.9.26 |
Mini Shai-Hulud Is Still Infecting GitHub Repositories - Real-time Open Source Software Supply Chain Security | The May 2026 Mini Shai-Hulud worm is still infecting new GitHub repositories. The payload is byte-identical to the May build. | Hacking blog | SAFEDEP.IO |
|
26.9.26 |
H1 Trends in the Phishing Landscape Targeting the Financial Sector | Netcraft identified almost 40,000 unique phishing URLs relevant to the US financial services sector in H1 2026. This field of view includes attacks using 645 distinct hosting providers and 576 distinct domain registrars. Data within this time period shows the wind down of a Darcula campaign targeting Fidelity, with a 7x drop from Q1 to Q2. Additionally, the data shows a continued trend toward abuse of cloud platforms and free hosting services for phishing infrastructure targeting this sector. | Phishing blog | NETCRAFT |
|
26.9.26 |
Slovenian .SI Domain Registrations Outpace .AI | Registrations of Slovenian .si domains overtook .ai in the 25 hours after President Trump told the UN General Assembly on September 22 that the U.S. would call AI “super intelligence” (SI). | AI blog | NETCRAFT |
|
26.9.26 |
MCP Config Poisoning: Text file to RCE | Attackers can weaponize your AI agent tooling just by sneaking a text file into the right place on your system, putting developers and other users at risk. Learn how this works and how to protect yourself and your organization. | Vulnerebility blog | Checkmarx Zero |
|
26.9.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | WordPress 7.1.1 fixes CVE-2026-93485, an unauthenticated stored XSS in wpautop(). The fix was backported to every supported branch from 4.7 onward, so a site below its own branch's patched version is still affected. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
Brevo delivered ClickFix through its own infrastructure | Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered the attack to customer sites. | Hacking blog | ADAMNET |
|
26.9.26 |
Securing what your Bedrock AgentCore agents actually do | An AI agent is software that can act on your behalf. It may read documents, emails, and web pages, then use the systems you connected to complete a task. | AI blog | Cato Networks |
|
26.9.26 |
2026 LATAM Crypto Adoption: Latin America Grew 9.8% | Latin America bucked the bear market. The region’s crypto economy saw $593.8 billion in activity, with an overall growth of 9.8%. This growth points to sustained demand for crypto, even in a year when global markets faced headwinds. | Cryptocurrency blog | Chainalysis |
|
26.9.26 |
2026 Global Crypto Adoption Index: Brazil Ranks No. 1 - | Crypto economy overcame worst market since 2022: Even as crypto’s total market cap fell about 50% (a $2.1 trillion contraction), on-chain economic activity slipped just 1.6%, from $9.5 trillion to $9.4 trillion. A growing diversity of use cases, not price speculation, kept the economy steady. | Cryptocurrency blog | Chainalysis |
|
26.9.26 |
Apple Internals: Endpoint Security ships in iOS 27.2 beta | While doing my usual ipsw diffing for the community, I compared iOS 27.0 (24A437) against the 27.2 beta (24B5084k) and found a new KEXT (kernel extension): com.apple.iokit.EndpointSecuritySE. That is Endpoint Security (ES), the framework endpoint-detection-and-response (EDR) vendors build on for macOS. Apple documents the public API here. Does this mean antivirus is coming to iOS? | OS Blog | Calif |
|
26.9.26 |
PCI DSS Gap: Relying on SAQ A Changes Exposes E-commerce | Cyberattacks targeting e-commerce payment flows continue to escalate, exposing a critical flaw in how online retailers manage client-side security. Ongoing Magecart campaigns are abusing dynamic hosting, ranging from decentralized blockchain infrastructure to trusted third-party platforms, to inject stealthy skimming code across payment networks. | Vulnerebility blog | JSCRAMBLE |
|
26.9.26 |
How Automated Moving Target Defense Stops Attacks Before Execution | Automated Moving Target Defense (AMTD) is a prevention-first security technology that constantly morphs the runtime memory environment so attackers cannot find or exploit their targets. | Security blog | Morphisec Blog |
|
26.9.26 |
The Major Shift in Security Vulnerability Management | Security vulnerabilities use a numbering system called CVE (Common Vulnerabilities and Exposures). The CVE number itself is an identifier that distinguishes vulnerabilities. For example, a number like 'CVE-2026-12345' refers to the exact same vulnerability anywhere in the world. | Vulnerebility blog | Enki White Hat |
|
26.9.26 |
Enumerating Users and MFA via Microsoft's Password Reset Portal | Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature designed to let users recover their accounts without calling the helpdesk. As it turns out, it also tells you quite a lot about the accounts in a tenant — whether they exist, what authentication methods they have registered, and in some cases, which ones are likely administrators. This post covers what the portal leaks, why it matters from both sides, and what defenders can do about it. | Security blog | LEVELBLUE |
|
26.9.26 |
BengalSEO Part 1: Anatomy of the Operation - The DFIR Report | In March 2026, a widespread SEO Poisoning campaign leading to malware deployment and tech support scams was identified by the DFIR Report. | Cyber blog | THEDFIRREPORT |
|
26.9.26 |
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud | Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud. | Hacking blog | Socket |
|
26.9.26 |
When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group | Strengthen your readiness against Silent Ransom Group. As SRG increasingly uses IT impersonation and legitimate remote-access tools to target law firms, firms should review how they verify support interactions, protect sensitive client data and detect suspicious activity. | Ransom blog | SYGNIA |
|
26.9.26 |
AI Agents Are Hacking Online Retailers for $25 a Company | A financially motivated operator is running three open source AI harnesses against hundreds of online retailers, almost entirely unattended. More than 600,000 credit card records have been taken, and in one case the agent's own cleanup routine destroyed the victim's data. | AI blog | GAMBIT SECURITY |
|
26.9.26 |
A spy trojan swaps zero-days for a plain phishing email | The link in the email pointed at an image file. The web server sent back a program. What arrived on two separate customer networks was a one megabyte Windows executable named image.pif, and in both cases somebody double clicked it. | Exploit blog | IntelFusions |
|
26.9.26 |
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers | On September 4, 2026, Oren Yomtov, a security researcher from Accomplish, responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program. Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised. | Vulnerebility blog | Cloudflare Blog |
|
26.9.26 |
Hacking OpenAI | On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. | AI blog | Hacktron AI |
|
26.9.26 |
CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack | CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. Exploitation requires network access to a virtual server configured with an APM access policy and an OAuth profile, with APM operating as an OAuth Authorization Server. | Vulnerebility blog | PICUSSECURITY |
|
26.9.26 |
AI-Enabled Cyber Attacks: What They Are and How to Defend Against Them | AI-enabled cyber attacks are malicious operations in which adversaries use AI, most often large language models (LLMs), to plan, carry out, or scale any part of an attack. | AI blog | PICUSSECURITY |
|
26.9.26 |
MSP Approaches Compliance Architecture | Compliance is evolving beyond checklists. Learn how security enclaves, validated cryptography, and boundary ownership can simplify audits and reduce risk. | Security blog | WatchGuard Blog |
|
26.9.26 |
HTTPS Content Inspection Firebox | Encrypted traffic is good for security and privacy. But for security teams, it can also create a visibility gap. | Hacking blog | WatchGuard Blog |
|
26.9.26 |
The OpenSourceMalware Show #22 | ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group’s escalating public feud with ransomware crew Cl0p. | Cyber blog | OpenSource Malware Blog |
|
26.9.26 |
Prompt Forcing: The Scarier Sibling of Prompt Injection | We showed how we leveraged extensions with very basic permissions to attack internal agents in 5 different browsers: Perplexity Comet, Gemini Live in Chrome, Edge Actions, Opera Neon, and Claude in Chrome. | Hacking blog | Forever Security |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE | Back in early August 2026, I was 0-day bug hunting in Cisco Smart Software Manager (CSSM). This was where I came across a post-auth RCE vulnerability. This vulnerability, located in the nginx certificate upload, involved command injection via TLS certificates. Unfortunately, a week before I finished the report, the vulnerability was silently patched in their 10-202608 upgrade uploaded on 10 Aug 2026. This short blog will detail the exploit, along with how it got patched. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS.IO |
|
26.9.26 |
Shopware fixes Store API vulnerability allowing administrator takeover | A Shopware vulnerability can lead to administrator takeover and remote code execution. Shopware merchants should install the security update now. | Vulnerebility blog | Sansec |
|
26.9.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update. | Exploit blog | greynoise.io |
|
26.9.26 |
Redundant by Design: Dissecting a Multi-RAT Phishing Campaign Targeting Canadian Businesses | Blackpoint’s Adversary Pursuit Group (APG) identified a phishing campaign targeting Canadian organizations that used a single delivery framework to deploy DCRat, Violet RAT, PureRAT, and AnyDesk. | Malware blog | Blackpoint Cyber |
|
26.9.26 |
RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser Theft | Blackpoint’s Adversary Pursuit Group (APG) identified two previously undocumented .NET malware components delivered together through a ClickFix chain: RemotePanel, a persistent remote access platform, and BoundSiphon, a credential and cryptocurrency stealer. | Hacking blog | Blackpoint Cyber |
|
26.9.26 |
ORAX Conducts AiTM Without a Reverse Proxy | ORAX is a phishing-as-a-service (PhaaS) platform that uses WebSockets and live session control to capture MFA-authenticated Google Workspace sessions. | Phishing blog | Abnormal AI |
|
26.9.26 |
Threat Intelligence Gives Security Data Meaning | Security teams have no shortage of threat data. They continuously consume feeds from commercial providers, open-source repositories, information-sharing communities and vendors across the cybersecurity ecosystem. The harder problem is determining which signals matter, what they reveal and what action to take next. | Cryptocurrency blog | R136a1.dev |
|
26.9.26 |
SLEEPWALKER: A Passive Backdoor With Its Own Command Language | Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive. Unable to hunt for interesting new malware, I stopped adding to my “TODO” pile and finally worked through my backlog from last year. That led to a detailed examination of BeheMOF as well as the discovery of this malware. | Malware blog | LUMEN |
|
26.9.26 |
Upcoming Next.js September Security Release | Next.js is preparing a scheduled security release for September 30, 2026. This advance notice gives teams time to plan upgrades before patches are published. | Vulnerebility blog | Next.js |
|
26.9.26 |
AI-augmented, still human-led: What changed in the 2026 Gartner Market Guide for Managed Detection and Response | Gartner named Expel a Representative Vendor for the eighth consecutive time in the 2026 Gartner® Market Guide for Managed Detection and Response. | AI blog | Expel |
|
26.9.26 |
"Are we secure against AI agents?" is a question we couldn't answer well | | “Are we secure against AI agents?” can’t be answered as asked. It bundles ten different problems—with ten different owners—and no shared vocabulary to separate them. | AI blog | Expel |
|
26.9.26 |
AI-Accelerated Defense: Build a Continuous Security Loop | That does not mean buying AI for the sake of AI. It means applying AI to the work that slows security teams down today: translating threat signals into validated exposure, deciding what matters, changing controls and proving the result. | AI blog | CYMULATE |
|
26.9.26 |
Why AI Defenders Can't Afford to Slow Down | The AI Frontier pacing argument assumes enterprise risk comes from frontier models being too powerful or misaligned. But that argument assumes that if labs build safer models, enterprises will be safer. That's not exactly how it works. AI frontier labs can slow down, but defenders can’t afford to. | AI blog | TrendAI |
|
26.9.26 |
When Trust in AI Becomes an Attack Surface: Analyzing Prompt Injection, Model Theft, and Pipeline Poisoning | Our analysis shows how AI attacks are moving beyond malicious prompts into the tools, models, and pipelines organizations already trust, and the controls organizations can put in place to reduce their exposure. | Hacking blog | TrendAI |
|
26.9.26 |
Voice Callers Exploit BYOD to Access Corporate Data | In a story recently reported by Dark Reading, threat actors are calling and texting employees on personal mobile devices, impersonating IT help desks and directing them to phishing pages designed to steal Microsoft 365 credentials and authentication tokens. By targeting unmanaged BYOD devices, attackers can bypass many corporate security controls and use compromised identities to access and exfiltrate sensitive data from services including SharePoint, OneDrive, and Exchange. | Security blog | ZIMPERIUM |
|
26.9.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
26.9.26 |
The New Engineering Problem: Managing What AI Decides to Import | AI makes it faster to turn an idea into working software. A developer describes a feature, integration, or service and receives an implementation in minutes. Coding agents go further by editing files, running tests, troubleshooting failures, and preparing changes for review. | AI blog | SONATYPE |
|
26.9.26 |
GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign | CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. | Malware blog | CloudSEK |
|
26.9.26 |
Serverless, Not Riskless: Exploiting Unauthenticated API Gateways in AWS | TL;DR – Unauthenticated Amazon Web Services Application Programming Interface (AWS API) Gateway endpoints backed by over-permissioned Lambda functions create a repeatable attack chain from a single HTTP request to credential extraction with no AWS credentials required. | Exploit blog | GUIDESECURITY |
|
26.9.26 |
Securing GenAI in the Real World | Generative AI (GenAI) projects often start small and move fast, with clients moving from initial testing to production and deployment as promising outcomes emerge. Along the way, the business value grows, but so can security risks, especially when sensitive data and high-impact workflows begin to rely on AI model decisions. | AI blog | GUIDESECURITY |
|
26.9.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
26.9.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. Security teams today face evolving challenges, requiring them to continuously refine monitoring channels, adjust operational strategies, and foster cross-functional internal collaboration to capture actionable intelligence. | CyberCrime blog | RAPID7 |
|
26.9.26 |
New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. Success going forward can’t be about patching as much as possible - it has to be about understanding what matters most and reducing the exposures attackers can actually reach. | Cyber blog | RAPID7 |
|
26.9.26 |
The roqueue-tools DevFlow campaign: 2 fake project-flow extensions that fetch JavaScript from a DuckDNS host and run it | Two project-flow extensions sit quietly for five minutes after you open your editor. The Kanban board renders, the webview loads, everything looks like a normal project-management tool. Then, once the IDE has settled and the developer has moved on to something else, a setTimeout fires. The extension reaches out to a free DuckDNS subdomain over plain HTTP, grabs a JavaScript file, and runs it with new Function. | CyberCrime blog | Yeeth Security |
|
26.9.26 |
The SadiqShuaibu campaign: 6 fake npm dependency checkers that embed a GitHub token and run remote code | Checking npm package versions is one of the most common things a developer extension does. On August 18, 2026, six of them showed up from one publisher — SadiqShuaibu — in under 100 minutes: sadiq-dep-checker, sadiq-dep-lens, sadiq-dep-helper, sadiq-dep-tool, sadiq-npm-updater, and pkg-outdated-check. They all work. The commands fire, the npm registry responds, the versions render in the panel. | CyberCrime blog | Yeeth Security |
|
26.9.26 |
SleepyDuck Returns: 2 fake Solidity Open VSX extensions hide a backdoor in an MP | In November 2025, we analyzed a small backdoor loose on Open VSX. SleepyDuck was unremarkable in every way but one: its header was an ASCII-art duck, and its C2 was a Solana smart contract the loader polled for tasking. It was a JavaScript file, a few kilobytes, executing fetched code in memory — a toy with a mascot. | Malware blog | Yeeth Security |
|
26.9.26 |
Meet AvisLoader: A Windows Loader Built to Outlast a Takedown | Varonis Threat Labs discovered AvisLoader, a new Windows malware loader built to keep its command-and-control (C2) channel beyond the reach of traditional domain takedowns. | Malware blog | VARONIS |
|
26.9.26 |
SalesBleed: 0-Click Data Exfiltration in Agentforce | We found a way to pull sensitive account data out of Salesforce Agentforce without ever logging in, or requiring the victim to click anything. The entry point was a public Web-to-Lead form, the exit was a DNS query. We call it SalesBleed. | Exploit blog | Zenity Labs |
|
26.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | At ReliaQuest, we believe that threat intelligence delivers the most value when it provides holistic context that drives action across security operations. In 2025, the fastest data exfiltration time we observed was just six minutes, down from over four hours the previous year. To keep up, security leaders must go beyond just collecting intelligence and use it to power automated action across detection, containment, investigation, and response. | Security blog | RELIQUEST |
|
26.9.26 |
Beyond Point-in-Time Testing: 5 Use Cases for Agentic Red Teaming | Attackers have automated their attacks and are moving at machine speed. Defenders need to do the same to test their defenses against these automated, agentic AI attacks. That is why agentic red teaming and continuous attack path mapping are becoming increasingly important. | AI blog | RELIQUEST |
|
26.9.26 |
Phishing Risk Across 5 Key US Industries: 2026 Data | According to fresh ANY.RUN data, phishing exposure remains above 70% in several critical industries. This doesn’t happen because organizations aren’t protected enough. Companies have been implementing email filtering, MFA, and phishing-awareness training for years. | Phishing blog | ANYRUN BLOG |
|
26.9.26 |
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint | Huntress recently observed a threat actor doing something unique post-compromise: instead of simply dropping a miner, they compiled one directly on the victim endpoint, tailoring the payload while generating unusually conspicuous EDR telemetry. | Cryptocurrency blog | Huntress |
|
26.9.26 |
The Psychedelic Stealer: When a CAPTCHA Becomes an Installer | Arctic Wolf Labs is tracking a fake Cloudflare CAPTCHA campaign delivering Psychedelic Stealer, malware which steals browser passwords, account tokens, and wallet data. | Malware blog | Arctic Wolf |
|
26.9.26 |
Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts | Proofpoint researchers identified an active TeamFiltration campaign - tracked as UNK_CondorFiltration, that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing intensively on Chilean organizations. | Exploit blog | PROOFPOINT |
|
26.9.26 |
CARBONATO: a botnet built around an AI agent | ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity. | BotNet blog | ThreatDown |
|
26.9.26 |
No One Gets Phished: The New Group-IB Browser Agent Applies Predictive Intelligence At The Click | One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and the targeted password is already being reset. The new Group-IB Browser Agent brings the corporate browser under XDR coverage, checking every page against predictive Threat Intelligence in real time. | Security blog | GROUP-IB |
|
26.9.26 |
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure | The landscape of software supply chain security has undergone a significant shift. Recent campaigns demonstrate that sophisticated threat actors are systematically targeting the engineering lifecycle by compromising trusted security and programming tools. | Security blog | GTI |
|
26.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
26.9.26 |
Telecom Attack Surface: SS7, BGP & Nation-State Intrusions | SS7 and BGP were built on trust. Here's how nation-state actors exploit that trust, and telecom routers, to stay inside carrier networks for years. | Hacking blog | GENDIGITAL |
|
26.9.26 |
Is Your Home Internet Feeding the AI Data Race? | Residential proxy providers sell household IP access for AI data collection, but many users do not understand what that access involves. | AI blog | GENDIGITAL |
|
26.9.26 |
Unmasking EvilTokens: Getting to the root of device code phishing | Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI capabilities for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets. This AI-powered cybercrime platform facilitated sophisticated business email compromise (BEC) campaigns that compromised more than 12,000 inboxes in over 10,000 organizations worldwide. | Phishing blog | Microsoft blog |
|
26.9.26 |
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments | Microsoft Security Blog | Activity associated with Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, illustrates how tracking and responding to ransomware attacks by payload alone can obscure the affiliates carrying out intrusions and the recurring behaviors that defenders can use to detect and disrupt them. | Ransom blog | Microsoft blog |
|
26.9.26 |
A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity | Unit 42 researchers have identified an issue where using default configurations in Amazon Web Services (AWS) AgentCore Harness could allow attackers to steer an agent's actions through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity. | Security blog | Palo Alto |
|
26.9.26 |
Inside the Modern SOC: Defending the Cross-Environment Pivot | Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools. | Security blog | Palo Alto |
|
26.9.26 |
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies | This article explores how AWS mitigates the security risks associated with publicly exposed Identity and Access Management (IAM) access keys through its AWSCompromisedKeyQuarantine managed policy. We discuss the evolution of the different versions of this AWS managed policy. We also show how the managed policy AWSCompromisedKeyQuarantine evolved over time to protect organizations by relating it directly to new cloud attacks against AWS environments. | Security blog | Palo Alto |
|
26.9.26 |
Introducing CAIRN: Frontier tracking for AI-integrated malware | Talos is releasing CAIRN, a research toolkit for hunting, classifying, and tracking emerging AI-integrated malware. | AI blog | CISCO TALOS |
|
26.9.26 |
Trust and the enticing consultancy offer | In this week’s newsletter Martin muses over a very suspicious elicitation over social media and the true value of trust within the cyber ecosystem. Hubris might be the real vulnerability that the cyber industry must worry about. | Vulnerebility blog | CISCO TALOS |
|
26.9.26 |
The Closed Quorum: Inside the first reported autonomous AI C2 implant | CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement. | AI blog | CISCO TALOS |
|
26.9.26 |
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use | Ransomware incidents in Japan rose 4.7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion represented 80% of victims. | Ransom blog | CISCO TALOS |
|
26.9.26 |
Should you care about an “AI slowdown?” | In this week's Threat Source, David talks about why focusing on your security basics is still your best bet, even in a world with rapid AI advancements. | AI blog | CISCO TALOS |
|
26.9.26 |
Been told to pay at a Bitcoin ATM? Read this first | Crypto ATM scams often follow a predictable script – here’s how to recognize it and what to do if you’ve already been caught out | Cryptocurrency blog | Eset |
|
26.9.26 |
Looking for free Robux? Here’s what’s real, and what’s a scam | Fake giveaways, free Robux generators and lookalike login pages all target the same thing – your Roblox account | Spam blog | Eset |
|
26.9.26 |
The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive | As AI opens new paths to company data while making familiar attacks faster and cheaper, SMBs need protection designed around the time and expertise available to operate it | AI blog | Eset |
|
26.9.26 |
‘Nudify’ apps: What to do if someone makes a fake nude of you | Whether you’re a victim, the parent of a victim, or just concerned, here’s what you can do about fake nude images | Cyber blog | Eset |
|
26.9.26 |
Dark Web Roast - August 2026 Edition | Blog - Dark Web Roast August 2026 Edition. | Cyber blog | TRELLIX |
|
26.9.26 |
When the Directory Becomes the Weapon: Understanding NTDS.dit Theft | This blog focuses on a critical defense shift: moving from signature-based detection to a technique-driven approach that identifies malicious behavior regardless of the specific toolkit utilized. | Security blog | TRELLIX |
|
25.9.26 |
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware | Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they | Hack | The Hacker News |
|
25.9.26 |
PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence | Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side | Virus | The Hacker News |
|
25.9.26 |
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise | Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. | APT | The Hacker News |
|
25.9.26 |
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild | The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. | Exploit | The Hacker News |
|
25.9.26 |
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data | A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and | Security | The Hacker News |
|
25.9.26 |
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV | The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe | Exploit | The Hacker News |
|
25.9.26 |
Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions | A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A | Vulnerebility | The Hacker News |
|
25.9.26 |
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content | The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows | Hack | The Hacker News |
|
25.9.26 |
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer | An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages | Virus | The Hacker News |
|
25.9.26 |
Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls | The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM . | Virus | The Hacker News |
|
25.9.26 |
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360 | ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late | Hack | The Hacker News |
|
25.9.26 |
OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files | An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime | AI | The Hacker News |
|
24.9.26 |
MacSync under the microscope: new delivery methods and a new payload | We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers. | Virus | SECURELIST |
|
24.9.26 |
Exposed Medical Image Consoles: 40% Lack Passwords | To reach a hospital’s medical images the hard way, you need a DICOM (Digital Imaging and Communications in Medicine) client and some knowledge of a protocol designed in the 1980s for machines that were never supposed to face the internet. To reach a growing number of them the easy way, you can open a web browser and type an address. | Security blog | FLARE.IO |
|
24.9.26 |
Detecting shadow AI agents with advanced posture checks | Okta recently introduced advanced posture checks within the Okta Verify client for macOS and Windows. This feature leverages osquery, a lightweight endpoint agent, which can run a SQL query at the point of log in to detect critical device data — launchd services, file paths, running processes, package managers, listening ports, installed apps, and container artifacts — that collectively provide a device assurance signal at sign-in time. | AI blog | OKTA |
|
24.9.26 |
Signing in without actually signing in | The price of AI tokens and subscriptions is increasing as AI model providers seek to recoup investment costs. As a result, these accounts are becoming more valuable targets for account takeover. Stopping this is paramount for enterprises. AI theft increases token bills. | AI blog | OKTA |
|
24.9.26 |
RemControl: AI Built the Overlays. Victims Lose their PINs | Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI. | Malware blog | GROUP-IB |
|
24.9.26 |
Proofpoint named a Pace Setter as of September 2026 in the Gartner Emerging Market Quadrant for AI Application Security — Established Vendors | As organizations rapidly adopt AI assistants and autonomous AI agents, the challenge is no longer simply protecting AI models—it is governing how AI interacts with employees, enterprise data, and business systems. We believe this recognition reflects the growing importance of securing AI across the entire enterprise. | AI blog | PROOFPOINT |
|
24.9.26 |
CVE-2026-76461 | Learn about CVE-2026-76461, an actively exploited Cisco Secure Email Gateway vulnerability that enables unauthenticated remote code execution and full system compromise through a malicious email. | Vulnerebility blog | Arctic Wolf |
|
24.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | In sports, a great defense must understand the offense. It is no different in security operations. It is not enough to just know threat intelligence—it needs to be acted on. Forrester recognizes ReliaQuest in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, where ReliaQuest was named a Strong Performer. | Security blog | RELIQUEST |
|
24.9.26 |
CVE-2026-87902 in WordPress Enables Conditional RCE | Security updates released for WordPress address CVE-2026-87902, a severe unauthenticated path traversal flaw within its page-template resolution mechanism. The weakness allows the CMS to load arbitrary readable PHP files outside designated theme directories, potentially resulting in Remote Code Execution (RCE) under tailored server and theme setups. | Vulnerebility blog | SOCRADAR |
|
24.9.26 |
sckit: A New Go Implant Framework for Supply Chain Worms - Real-time Open Source Software Supply Chain Security | sckit, also known as the “supplychain.local worm”, is a Go implant framework that we found in two MemTensor packages on September 23, 2026. It runs on Linux, macOS, and Windows. It collects credentials from developer machines and from CI jobs. It receives signed tasks from a command and control (C2) server. | Malware blog | SAFEDEP.IO |
|
24.9.26 |
TeamFiltration Compromises Seven Microsoft 365 Accounts Using Default Passwords | Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According | Hack | The Hacker News |
|
24.9.26 |
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure | Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question | Vulnerebility | The Hacker News |
|
24.9.26 |
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry | Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time | Virus | The Hacker News |
|
24.9.26 |
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You | The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start | Vulnerebility | The Hacker News |
|
24.9.26 |
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key | Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT | Vulnerebility | The Hacker News |
|
24.9.26 |
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI | Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) | Virus | The Hacker News |
|
24.9.26 |
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control | A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the | Vulnerebility | The Hacker News |
|
24.9.26 |
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests | Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to | AI | The Hacker News |
|
23.9.26 |
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape | A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm | Exploit | The Hacker News |
|
23.9.26 |
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers | Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 | Exploit | The Hacker News |
|
23.9.26 |
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware | A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as | Exploit | The Hacker News |
|
23.9.26 |
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input | A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse , the feature that generates Open Graph and | Vulnerebility | The Hacker News |
|
23.9.26 |
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants | The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data | BigBrothers | The Hacker News |
|
23.9.26 |
Email Threat Protection Across Messages, Identities and Accounts | Email threat protection is about preventing, detecting, and responding to attacks that reach people through email or use email as the first step in a larger attack. This includes phishing, business email compromise (BEC), malware, account takeover (ATO), supplier fraud, internal threats, and data loss. The work spans message analysis, authentication, behavioral detection, user reporting, and remediation. | Security blog | PROOFPOINT |
|
23.9.26 |
Operationalizing Security for the Agentic Era: Introducing Semantic Business Policies and Agentic Insights | Today at Protect 2026, Proofpoint is introducing Semantic Business Policies and Agentic Insights, two new capabilities that together deliver a continuous governance lifecycle for AI, connecting policy definition, runtime enforcement, and autonomous risk discovery into a single platform. No other vendor offers this today. | Security blog | PROOFPOINT |
|
23.9.26 |
Stopping Attacks Before They Reach the Inbox: Introducing the Proofpoint Agentic Collaboration Security System | At Protect 2026 in San Diego today, we introduced the Proofpoint Agentic Collaboration Security system. It is a single system that brings together intent-based detection, agentic investigation, and user risk agents to protect how people communicate and collaborate. | Security blog | PROOFPOINT |
|
23.9.26 |
Introducing Proofpoint Advanced Browser Protection: The First Unified Defense Across Email and the Browser | Email remains a primary delivery vector for cyberattacks, but it has also become one of the most heavily defended. As organizations continuously shore up their email defenses, attackers have begun shifting more attacks into the browser, where they can weaponize links after delivery, hide malicious content behind trusted authentication workflows, abuse OAuth permissions, hijack sessions, steal credentials, and use malicious browser extensions to evade defenses. | Security blog | PROOFPOINT |
|
23.9.26 |
Announcing the Next Evolution of Proofpoint Cyber Defense | The most dangerous attacks today don’t come from strangers. They come from real accounts, in familiar threads, asking for exactly the kind of thing those accounts normally ask for. | Cyber blog | PROOFPOINT |
|
23.9.26 |
In Cybersecurity, Behavior is a Signal. Intent is the Full Story. | For most of cybersecurity’s history, we built defenses around a simple assumption: people use technology, and technology follows their direction. | Cyber blog | PROOFPOINT |
|
23.9.26 |
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer | Huntress spotted the DarkMe malware in two separate incidents affecting different organizations on August 31, 2026. | Malware blog | Huntress |
|
23.9.26 |
The Tale of Two INC Ransom Notes: A Ransomware Timeline | In late August, the Huntress agent was installed on an organization after an incident involving the INC ransomware. Typically, this would limit our visibility into certain aspects of the attack, such as the initial access vector – however, even with the lack of extended telemetry, Huntress analysts were able to piece together significant information regarding the overall attack. | Ransom blog | Huntress |
|
23.9.26 |
CSuite Hits US and EU: Phishing and M365 Session Theft | ANY.RUN researchers investigated CSuite, a phishing and remote-access operation that combines credential theft, Microsoft 365 session hijacking, and the abuse of legitimate management tools. The campaign showed a strong US focus, with 60% of identified victim organizations based in the United States. | Phishing blog | ANYRUN BLOG |
|
23.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | In sports, a great defense must understand the offense. It is no different in security operations. It is not enough to just know threat intelligence—it needs to be acted on. Forrester recognizes ReliaQuest in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, where ReliaQuest was named a Strong Performer. | Cyber blog | RELIQUEST |
|
23.9.26 |
Virtualizor: The Login Parameter That Skips the Login | Today VulnCheck's Initial Access Intelligence team is detailing an unauthenticated remote root code execution in Virtualizor, Softaculous' commercial VPS and hypervisor control panel. It provisions and manages KVM/OpenVZ/LXC guests, so its web layer runs as root, which is exactly why a web bug here ends at uid=0 instead of www-data. | Vulnerebility blog | VULNCHECK |
|
23.9.26 |
Oracle September 2026 Critical Security Patch Update | On September 15, Oracle released its Critical Security Patch Update (CSPU) for September 2026. Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence. | Vulnerebility blog | TENABLE |
|
23.9.26 |
Click2Shell: WordPress Flaw Enables RCE Chain | Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator’s browser to be manipulated into installing and previewing a theme without explicit consent. Although this security flaw cannot directly execute arbitrary code on its own, security researchers proved it can be combined with a susceptible theme to achieve remote execution of attacker-specified PHP code. | Vulnerebility blog | SOCRADAR |
|
23.9.26 |
August 2026: GTA VI Leak, Keyv & Carhartt Breaches | August 2026 brought a wide mix of cyber incidents, from large-scale data breaches affecting millions of people to software supply chain attacks targeting developers and enterprise environments. | CyberCrime blog | SOCRADAR |
|
23.9.26 |
VelvetCake: Konni Targets Ukraine With Malicious LNK Files | Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-nexus threat groups to execute cyberespionage, conduct sabotage and influence operations, and generate revenue for state-sponsored nuclear weapons programs. | APT blog | SOCRADAR |
|
23.9.26 |
Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved | In August 2026, the Rhysida extortion group breached Berlin’s state network and copied roughly 1.44 million files from two of the city-state’s Senate administrations. Berlin disconnected the affected departments on August 14, refused a ransom demand of 30 BTC, and on September 4 the group released the archive to public access on its Dark Web leak site. | Cyber blog | SOCRADAR |
|
23.9.26 |
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks | Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the | Exploit | The Hacker News |
|
23.9.26 |
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers | WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme | Vulnerebility | The Hacker News |
|
23.9.26 |
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials | Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool | Virus | The Hacker News |
|
23.9.26 |
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises | Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every | Phishing | The Hacker News |
|
23.9.26 |
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials | A critical vulnerability in Bifrost , an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated | AI | The Hacker News |
|
23.9.26 |
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates | A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space | Exploit | The Hacker News |
|
22.9.26 |
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups | Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, | Exploit | The Hacker News |
|
22.9.26 |
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory | A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest | Vulnerebility | The Hacker News |
|
22.9.26 |
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE | A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated | Vulnerebility | The Hacker News |
|
22.9.26 |
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal | A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in | Virus | The Hacker News |
|
22.9.26 |
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing | The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their | Virus | The Hacker News |
|
22.9.26 |
Clop Hack: ShinyHunters Hijacks Data Leak Site | ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS). | Cyber blog | SOCRADAR |
|
22.9.26 |
August 2026 Infostealer Trend Report - ASEC | This report summarizes the distribution channels, number of Infostealers, number of detections, and companies disguised as targets by new Infostealers collected during the month of August 2026. | Malware blog | Zscaler |
|
22.9.26 |
Passive DNS Reveals Flock Safety's Dev Infrastructure | Automated license plate readers and AI-assisted video surveillance have moved from a handful of pilot deployments to tens of thousands of installations across US towns, business parks and residential streets. Anyone can see the cameras, but the cloud platform behind them is a different story. | AI blog | FLARE.IO |
|
22.9.26 |
Click2Shell: WordPress Flaw Enables RCE Chain | Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator’s browser to be manipulated into installing and previewing a theme without explicit consent. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-76460: Cisco ISE Flaw Actively Exploited | CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypasses authentication without requiring user interaction, it opens the door to severe compromise across affected network infrastructure. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-91843: Check Point Root RCE | Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthenticated remote attacker could execute arbitrary code with root privileges. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access | SOCRadar Dark Web Team identified several new underground posts, including an alleged Dominican Republic citizen data leak, an alleged Celestial malware suite sale, and an alleged Money Network database sale. | Cyber blog | SOCRADAR |
|
22.9.26 |
Clop Hack: ShinyHunters Hijacks Data Leak Site | ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS). | Cyber blog | SOCRADAR |
|
22.9.26 |
One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor | Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security | AI | The Hacker News |
|
22.9.26 |
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session | A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later | Vulnerebility | The Hacker News |
|
22.9.26 |
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. | Exploit | The Hacker News |
|
22.9.26 |
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR | A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software | Virus | The Hacker News |
|
22.9.26 |
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto | The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 | Cryptocurrency | The Hacker News |
|
22.9.26 |
Google Fined €403 Million Over GDPR Violations Tied to Location Data | Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location | BigBrothers | The Hacker News |
|
22.9.26 |
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data | Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to | Virus | The Hacker News |
|
21.9.26 |
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO | Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects. | Ransom | SECURELIST |
|
21.9.26 |
Microsoft: September updates break File History backup feature | Microsoft warned that the built-in File History backup feature in Windows may stop working on some systems after installing the September 2026 security updates. | OS | BleepingComputer |
|
21.9.26 |
Malicious npm packages evade install-script defenses at runtime | An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. | Virus | BleepingComputer |
|
21.9.26 |
Researchers escape OpenAI Codex sandbox to run commands on host | Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both. | AI | BleepingComputer |
|
21.9.26 |
BragJack attacks hijack AI browser agents through malicious extensions | BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension. The Prompt Forcing technique earned over $20,000 in bounties and two CVEs. | Attack | BleepingComputer |
|
21.9.26 |
North Korean WaterPlum hackers infected 30,000 devices worldwide | A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. | APT | BleepingComputer |
|
21.9.26 |
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang | The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. | Ransom | BleepingComputer |
|
21.9.26 |
Viral AI actress' hotline face-scans every caller, watches their mood | AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her "Talking Tilly" video call service face-scans every caller for an 18+ age check, senses callers' moods during calls, and shuts down permanently on September 27. We tried it and read the fine print. | AI | BleepingComputer |
|
21.9.26 |
Gyazo server flaw exploited to steal 23.6 million user records | The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records. | Vulnerebility | BleepingComputer |
|
21.9.26 |
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer | An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. | Hack | BleepingComputer |
|
21.9.26 |
Secure enterprise sharing with access reviews for Microsoft 365 | Microsoft 365 makes sharing files easy, but access can remain long after its original purpose has ended, leaving organizations with little visibility into who can still reach sensitive data. tenfold Software explains how centralized access governance and owner-driven reviews can help identify and remove unnecessary access. | OS | BleepingComputer |
|
21.9.26 |
Microsoft Teams will let admins block custom file extensions | Microsoft Teams will soon let administrators tweak the list of file extensions commonly associated with security threats to meet their company's security requirements. | OS | BleepingComputer |
|
21.9.26 |
Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts | Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing recent updates. | OS | BleepingComputer |
|
21.9.26 |
New Check Point flaw lets hackers execute code with root privileges | Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems. | Vulnerebility | BleepingComputer |
|
21.9.26 |
Microsoft fixes broken copy and paste for Excel 2016 users | Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update. | OS | BleepingComputer |
|
21.9.26 |
New RatHat Android malware uses AI to automate device control | A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. | Virus | BleepingComputer |
|
21.9.26 |
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure | Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript . "ChainScript has appeared under multiple build names, including | Virus | The Hacker News |
|
21.9.26 |
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors | The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the | Virus | The Hacker News |
|
20.9.26 |
OpenAI details more cases of AI agents taking unauthorized actions | OpenAI has presented new examples of what they call "AI model misalignment" from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. | AI | BleepingComputer |
|
20.9.26 |
Brevo supply-chain attack injected ClickFix scripts on customer sites | Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. | Hack | BleepingComputer |
|
20.9.26 |
What Recent AI-Powered Attacks Mean for Your Identity Security | AI is making credential theft faster and easier to scale, giving attackers more opportunities to abuse valid identities. Specops explains why identity security must go beyond successful authentication by verifying that both the user and the device requesting access can be trusted. | AI | BleepingComputer |
|
20.9.26 |
Windows 11 24H2 Home and Pro reach end of support in October | Microsoft reminded customers this week that devices running Windows 11 24H2 Home and Pro editions will stop receiving updates next month. | OS | BleepingComputer |
|
20.9.26 |
US takes down NightmareStresser DDoS-for-hire platform | The U.S. Federal Bureau of Investigation (FBI) seized the domains used by NightmareStresser, one of the world's longest-running distributed denial-of-service (DDoS) platforms. | BigBrothers | BleepingComputer |
|
20.9.26 |
Chinese hackers use SparroWocky malware in govt espionage attacks | The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. | APT | BleepingComputer |
|
20.9.26 |
Microsoft shares workaround for Windows domain login issues | Microsoft shared a temporary fix on Wednesday for a known issue that prevents Windows 11 users from logging in with valid domain credentials after installing the September 2026 security updates. | OS | BleepingComputer |
|
20.9.26 |
Cisco warns of max severity ISE zero-day exploited in attacks | Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. | Exploit | BleepingComputer |
|
20.9.26 |
Anthropic wants Claude to analyze your bank account and financial data | Anthropic is testing a new personal finance feature called "Claude Money" that will allow you to connect your bank accounts directly to Claude and "understand your money." | AI | BleepingComputer |
|
20.9.26 |
Windows 11 KB5124008 update breaks domain trust for some users | Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. | OS | BleepingComputer |
|
20.9.26 |
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets | Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. | Virus | BleepingComputer |
|
20.9.26 |
Malware bypasses browser checks to force install Chrome, Edge extensions |
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. |
Virus | BleepingComputer |
|
20.9.26 |
Spain's data agency gets first report of AI-powered data breach |
The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known large language model (LLM) |
Incindent | BleepingComputer |
|
20.9.26 |
The ransom itself can be only a fraction of the total cost of a ransomware attack, with downtime, recovery, remediation, and legal obligations adding millions to the bill. Datto explains how a mature BCDR strategy can reduce downtime and provide a faster, more predictable path to recovery. |
Ransom | BleepingComputer | |
|
20.9.26 |
Microsoft says Copilot buttons still missing in classic Outlook |
Microsoft says it's still investigating a known issue that causes the Copilot and Copilot Chat buttons in Classic Outlook to disappear for some Windows users. |
OS | BleepingComputer |
|
20.9.26 |
Webinar: What happens in the first hours of a Google Workspace breach |
The first hours after discovering a Google Workspace breach can determine how an incident unfolds. This webinar examines real-world breaches to show which early response decisions can limit the impact and which can make matters worse. |
Security | BleepingComputer |
|
20.9.26 |
Critical ScreenConnect flaw now actively exploited in attacks |
Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). |
Exploit | BleepingComputer |
|
20.9.26 |
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws |
Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts |
Vulnerebility | The Hacker News |
|
20.9.26 |
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE |
SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead |
Vulnerebility | The Hacker News |
|
19.9.26 |
Windows Server 2022 reaches end of mainstream support next month |
Microsoft has reminded customers that Windows Server 2022 will reach the end of mainstream support next month and enter extended support until October 2031. |
OS | BleepingComputer |
|
19.9.26 |
Google fixes actively exploited Android zero-day on Pixel devices |
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks. |
Exploit | BleepingComputer |
|
19.9.26 |
Acronis warns of actively exploited flaw in its cPanel backup plugin |
Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. |
Exploit | BleepingComputer |
|
19.9.26 |
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites | Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. | Hack | BleepingComputer |
|
19.9.26 |
CenterPoint Energy confirms customer data stolen in cyberattack | CenterPoint Energy disclosed a breach compromising some customers' personal information after an attacker leaked data allegedly stolen from the utility company. | Incindent | BleepingComputer |
|
19.9.26 |
BambooToken malware controls Windows and Linux systems via MQTT | A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. | Virus | BleepingComputer |
|
19.9.26 |
Hackers target WordPress sites via third-party WooCommerce plugin | Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. | Hack | BleepingComputer |
|
19.9.26 |
Hackers target WordPress sites via third-party WooCommerce plugin | AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. | Hack | BleepingComputer |
|
19.9.26 |
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild | A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is | Vulnerebility | The Hacker News |
|
19.9.26 |
Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up | Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a | AI | The Hacker News |
|
19.9.26 |
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories | An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, | Hack | The Hacker News |
|
19.9.26 |
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known | Exploit | The Hacker News |
|
19.9.26 |
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root | A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access | Exploit | The Hacker News |
|
19.9.26 |
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution | WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a | Vulnerebility | The Hacker News |
|
19.9.26 |
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2 | The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber | APT | The Hacker News |
|
19.9.26 |
LabubaRAT Threat Snapshot | LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan (RAT) identified by the Blackpoint Adversary Pursuit Group (APG), designed to masquerade as legitimate NVIDIA software while providing a full remote access feature set including command execution, file operations, screen capture, and SOCKS5 proxying. | Malware blog | Blackpoint Cyber |
|
19.9.26 |
Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware | The recent Brevo security incident is much larger than reported. Sansec found that attackers piggy-backed on embedded Brevo widgets to install Wordpress malware on Brevo customer sites and launch Clickfix attacks against their visitors. | Malware blog | Sansec |
|
19.9.26 |
What is Style Smuggler (CVE-2026-75650)? | Sansec discovered the vulnerability in Adobe Commerce & Magento and found it being exploited in the wild prior to patches being released, as early as September 4th, 2026 | Vulnerebility blog | Fastly |
|
19.9.26 |
The New DDoS Playbook: Lessons from Khan Academy, Yottaa, and Magnolia | Attackers have traded prolonged bombardments for short, violent bursts – traffic spikes that hit in 30 to 60 seconds and vanish before a human even gets paged. You can’t manually triage an attack that’s already over before you’ve had a chance to open Slack. | Attack blog | Fastly |
|
19.9.26 |
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts | A modern storefront can look perfectly healthy while malicious JavaScript works underneath: siphoning affiliate revenue, hijacking searches and clicks, tampering with analytics, or asking a remote server what to execute next. Pages load, products appear, and checkout works — yet the browser may be quietly doing something the site owner never authorized. | Malware blog | Cloudflare Blog |
|
19.9.26 |
Give every teammate and agent the right level of access to your Workers | As more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is crucial to allow you to ship safely. After all, the last thing you want is for an agent to make a change in production, just because it was granted more access than it needs. | Security blog | Cloudflare Blog |
|
19.9.26 |
Have it both ways: stay discoverable in search while disallowing AI training | Without proper controls, website owners have long faced a difficult tradeoff: allow your content to be used for AI training, or risk losing discoverability in search. That tradeoff exists because some of the largest organizations on the Internet use mixed-use crawlers: a single crawler serving both search and AI training. Refuse one, and you refuse the other. | AI blog | Cloudflare Blog |
|
19.9.26 |
One link was enough to backdoor a Chinese typing app | A single click on a link was all it took. Researchers at Gen Threat Labs found that a crafted web address could reach inside Sogou Input Method, one of the most widely used Chinese-language typing tools for Windows, and run an attacker's code on the machine behind it. The software has hundreds of millions of installations. | Malware blog | IntelFusions |
|
19.9.26 |
From Internet Exposure to Operational Disruption: A Red Team View of Connected Infrastructure | When people think about a cyberattack on water infrastructure, they often imagine the most dramatic outcome: a malicious actor changing a setpoint, stopping a pump, manipulating chemical treatment, or interfering with a physical process. | Security blog | COBALT.IO |
|
19.9.26 |
How Cobalt Brings Real-Time Exploit and Threat Intelligence to Vulnerability Findings | Common Vulnerabilities and Exposures (CVE) identify known vulnerabilities in specific components. They don't confirm whether you're exposed or whether attackers are actively exploiting a vulnerability. The additional context from adding reliable threat intelligence and known CVE information to your pentest findings can make the difference between wasting time on research and triage and quickly identifying pressing risks that your business needs to address. | Vulnerebility blog | COBALT.IO |
|
19.9.26 |
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads. | Malware blog | Socket |
|
19.9.26 |
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk | GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises. | Hacking blog | Socket |
|
19.9.26 |
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed | The originally released PoC had issues that broke exploitation. That PoC has been revised by the author. We have reviewed the revised version of the exploit and have validated that it now functions as expected in our lab. We have added a section at the end of our original article discussing this update and our results. | Exploit blog | LEVELBLUE |
|
19.9.26 |
S&P Global Agrees to Buy OpenZeppelin and Fold Smart Contract Audits Into Ratings | The ratings firm that cut Tether’s stability grade to its lowest level last year is buying the security company behind the open source smart contract libraries widely used across DeFi, and it is placing the business under S&P Global Ratings. | Cyber blog | UNCHAINEDCRYPTO |
|
19.9.26 |
Chainalysis Says State Hackers Now Write Half of the Malware Hidden on Blockchains | Chainalysis says state-backed operators now account for about half of the malicious code written to public chains, storing command-server addresses in smart contracts and transaction data that no registrar or host can take down. | APT blog | UNCHAINEDCRYPTO |
|
19.9.26 |
NFC Relay Goes Local: How AI Is Accelerating a New Wave of Independent Malware Developers | The Cleafy Threat Intelligence team has identified and analyzed two new Android NFC relay malware families: DevilNFC and NFCMultiPay. While these families are developed by distinct, unrelated actors with no shared code or infrastructure, both are actively used to successfully launch NFC relay attacks targeting European and LATAM banking customers. | AI blog | Cleafy |
|
19.9.26 |
Unpacking the Unpackable: Malformed APKs as an Anti-Analysis Technique | APK malformation is the intentional creation of technically broken or non-standard APK files that still install and run on Android, but confuse or break analysis tools. | Hacking blog | Cleafy |
|
19.9.26 |
Malware That Rewrites Itself Every Hour: AI-Powered Polymorphic Threats Break Signature-Based Defense | AI-powered polymorphic malware is malicious code that uses artificial intelligence to automatically rewrite itself — often every hour or on every execution — so that no two copies share the same signature, hash, or structure. Because traditional antivirus and signature-based detection depend on recognizing a known pattern, malware that never holds still is effectively invisible to them until after it has already run. | AI blog | Morphisec Blog |
|
19.9.26 |
Top 14 JavaScript Libraries and Frameworks Compared | JavaScript, one of the most popular programming languages, has a wide ecosystem of libraries and frameworks that enhance its functionality and streamline development. With the rapid growth of the web and the increasing demand for more dynamic, interactive, and scalable applications, developers rely on these tools to build everything from simple websites to complex applications. | Security blog | JSCRAMBLER |
|
19.9.26 |
CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai | We have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability. | Vulnerebility blog | AKAMAI |
|
19.9.26 |
Lemmings: A Russian Industrialized Persona Provisioning And Management for Active Measures Campaigns | Data posted to a darknet forum by an account named okenit_hackers in October 2025 reveals that Russian actors have potentially upgraded their disinformation methods through the automated creation and management of fake personae. | APT blog | DomainTools Investigations |
|
19.9.26 |
Stop Fraudulent Hires | You can't out-verify a stolen identity at the door. What you can do is make the enterprise a place where behavior that doesn't match the story surfaces early, before access is ever granted. | Cyber blog | Abnormal AI |
|
19.9.26 |
ORAX Conducts AiTM Without a Reverse Proxy | ORAX is a phishing-as-a-service (PhaaS) platform that uses WebSockets and live session control to capture MFA-authenticated Google Workspace sessions. | Phishing blog | Abnormal AI |
|
19.9.26 |
The banana stand: brokering and managing infections across Asia using MQTT | Black Lotus Labs®, the threat research division at Lumen, uncovered BambooToken, an emerging malware family using the Message Queueing and Telemetry Transport (MQTT) to quietly control infected Windows and Linux systems. | Malware blog | LUMEN |
|
19.9.26 |
MacOS ClickFix AMOS Campaign | A Fake “Bot Protection” Prompt Is Stealing Mac Users’ Crypto Wallets, and the Cleanup Is Not Keeping Up | Ransom blog | Ransom-ISAC |
|
19.9.26 |
Zero Breaches Out of 50: TrendAI Vision One™ Endpoint Security Essentials Earns AV-Comparatives Certified Leader Status | When your endpoint defense is tested against 50 sophisticated attack scenarios—the kinds of attacks that compromise enterprises—the measure is simple: did anything get through? For TrendAI Vision One™ Endpoint Security Essentials in AV-Comparatives' 2026 Endpoint Prevention & Response (EPR) Test, the answer is no. | AI blog | Trend Micro |
|
19.9.26 |
Global Public Sector Under Siege: Threat Intelligence for Q2 2026 | In the second quarter of 2026, threats to the public sector have become increasingly persistent: from AI-generated ransomware, nation-state espionage, supply chain attacks, and many more, critical institutions face a rapidly growing range of risks. | Cyber blog | Trend Micro |
|
19.9.26 |
Cyber Threats in Times of Conflict | The image of powerful nations releasing their cyber-arsenal to disrupt or cripple their victims’ infrastructure, military capabilities or economy during times of conflict has been largely a matter of speculation and Hollywood movies until recently. | Cyber blog | EMISISOFT |
|
19.9.26 |
The Risks Behind AI | There’s a hot new technology hitting the streets: it’s called AI, it’s AMAZING, and it’ll make the world a better place by solving all of your problems. Whether it’s finding a lost mountaineer, the early detection of cancers in radiological images, modeling proteins to speed the development of new drugs, or weather prediction, the capabilities of this thing seem limitless! | AI blog | EMISISOFT |
|
19.9.26 |
App Cloning Campaign Expands Mobile Banking Fraud | A recent investigation uncovered a mobile fraud campaign using cloned versions of Vietnam’s vWork application to distribute Gigabud, an Android banking malware linked to the GoldFactory threat group. Attackers impersonate legitimate services and use social engineering to convince victims to install malicious apps outside official stores. | Malware blog | ZIMPERIUM |
|
19.9.26 |
India Just Raised the Bar on Mobile App Security | India processes more than 10 billion UPI transactions every month. That scale made one thing inevitable: attackers would follow the money to mobile. | Malware blog | ZIMPERIUM |
|
19.9.26 |
Why Are OSS Attackers Always After CI/CD Credentials? | CI/CD credentials are a prime target of malicious open source packages because of the sheer authority those credentials carry. Depending on their privileges, they can provide access to source code, build systems, package registries, cloud infrastructure, and production delivery. | Security blog | SONATYPE |
|
19.9.26 |
SETTRA RANSOMWARE | NOTE: This is a Continuous Analysis Report of Settra Ransomware Group. The frequent updates of the group shall be found in this same article chronologically. | Ransom blog | THE RAVEN FILE |
|
19.9.26 |
Acronis Cyberthreats Update, September 2026 | The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in August 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. | Cyber blog | ACRONIS |
|
19.9.26 |
Novee Exploitability Validation for External Reports | Traditional tooling tells you what might be wrong. Novee’s Exploitability Validation tells you what's actually exploitable, right now, and proves it. | Exploit blog | NOVEE |
|
19.9.26 |
EtherHiding Exposed: Inside a Blockchain-powered Malware | We identified a malware campaign, active since at least November 2025, that stores its command-and-control (C2) address inside smart contracts on the Polygon blockchain instead of hardcoding it into the malware itself, a technique known as EtherHiding. | Cryptocurrency blog | GUIDESECURITY |
|
19.9.26 |
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild | On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions. | Vulnerebility blog | RAPID7 |
|
19.9.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Cyber blog | RAPID7 |
|
19.9.26 |
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild | On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance. | Vulnerebility blog | RAPID7 |
|
19.9.26 |
Private HTS programs that spread ransomware | AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which ransomware was distributed through a private home trading system (HTS). The HTS program used to distribute the ransomware is called “UBP Asset” and has long been exploited in online investment scams. Given that a photo of the same HTS program was also found in a blog post by a law firm in Korea published in September 2025, it appears that investment fraud organizations have recently been distributing ransomware to their victims. | Ransom blog | Zscaler |
|
19.9.26 |
August 2026 Threat Trend Report on APT Groups | The August 2026 APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabilities. | APT blog | Zscaler |
|
19.9.26 |
Sisterhood of the Traveling Pants CTF Writeup | With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life. | Cyber blog | FLARE.IO |
|
19.9.26 |
Operation RapidRust: New APT36 Malware Tools | In August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. | APT blog | Zscaler |
|
19.9.26 |
Dynamic Protection: When Controls Move With the Risk | The fastest way to lose confidence in a data protection program is to block something the business needed to do. Anyone who has run DLP knows the sequence: a rule fires on a legitimate transfer, an exception gets written, and after enough false positives, policies slide into monitor-only mode. Protection that doesn't fit the moment doesn't protect anything for long. | Cyber blog | PROOFPOINT |
|
19.9.26 |
Inside a 24 Billion Credential Leak: Passwords, Exploits, and How Attackers Connected Them, Part 1 | In this 2-part blog series, we break down a June 2026 disclosure of 24 billion stolen credentials and what it means for security leaders. This blog, Part 1, covers how stolen corporate passwords lead to account takeover, and what security leaders can do to close that exposure window. Part 2 covers the other half of the same disclosure: how attackers are pairing stolen credentials with active vulnerability data to prioritize which systems to target next. | Hacking blog | PROOFPOINT |
|
19.9.26 |
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia | Disclosure note: ahead of publishing this research on September 9, 2026, we notified the affected organizations and the relevant national CERTs, sharing a TLP:AMBER advance copy and holding publication to allow review. | Malware blog | HUNT.IO |
|
19.9.26 |
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Settra is a newer ransomware variant that was first observed in June 2026. Based on public reporting, the attackers behind the variant have targeted virtual private networks (VPNs) or used compromised credentials for initial access. | Ransom blog | Huntress |
|
19.9.26 |
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware | Many Black Hat and DEFCON attendees come home to an inbox full of DMs. While catching up on the expected post-conference networking last month, a Huntress researcher realized they were being targeted in an X exchange with someone posing as a crypto marketing executive. The threat actor sent a link to a real Google Doc with a custom sidebar designed to trick the recipient into downloading malware: an AMOS infostealer on macOS, or PowerShell loader chain on Windows. | Malware blog | Huntress |
|
19.9.26 |
How MSSPs Can Prove Their Value During a Quiet Month | The problem is not that the SOC did nothing. Quite the opposite. Analysts may have investigated hundreds of suspicious files, URLs, emails, and alerts. They may have confirmed malicious activity, closed false positives, identified new infrastructure, and stopped cases from consuming more time or reaching higher escalation tiers. | Cyber blog | ANYRUN BLOG |
|
19.9.26 |
ANY.RUN & SentinelOne: One Workspace, Instant Threat Context | Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. | Cyber blog | ANYRUN BLOG |
|
19.9.26 |
Enterprise Threat Intelligence Buying Guide | Choosing an enterprise threat intelligence solution is about more than just data volume or integrations. The right provider should deliver relevant intelligence, fit existing workflows, and help security teams investigate threats faster. | Cyber blog | ANYRUN BLOG |
|
19.9.26 |
CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower | See how meta-hacking got Microsoft Copilot to snitch on itself, exposing CoSnitch, a one-click flaw that silently exfiltrates data. | AI blog | VARONIS |
|
19.9.26 |
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack | Group-IB Blog | Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Active since Fall 2023, it has been used to surveil Iranian dissidents, journalists and government opponents, enabling remote command execution, data exfiltration, and persistence over Telegram command-and-control. | Malware blog | GROUP-IB |
|
19.9.26 |
CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | CrowdStrike has been named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, receiving the highest scores in both the Current Offering and Strategy categories. We believe this recognition reflects an important shift in what organizations need from threat intelligence. | Cyber blog | CROWDSTRIKE |
|
19.9.26 |
CrowdStrike Accelerates Real-Time Data Classification with On-Device AI | Modern data security depends on understanding sensitive data as it is created, accessed, and moved in real time directly on the endpoint. | AI blog | CROWDSTRIKE |
|
19.9.26 |
PhantomRaven: LLM-generated Information Stealer for Bug Bounty Hunting | CrowdStrike Counter Adversary Operations identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript (JS)-based information stealer PhantomRaven via npm, a platform on which developers can access open-source packages to build applications and software. | AI blog | CROWDSTRIKE |
|
19.9.26 |
CrowdStrike SafeMind Uses the Best Offense to Build the Best Defense | The conventional approach to AI-powered security is to build an offensive agent to find weaknesses, build a defensive agent to catch threats, and run them in separate tracks. It's a clean division of labor that produces capable tools. However, the conventional approach also produces a permanent blind spot — the defense is never trained against the actual offense, and the connective tissue between the two is manual, slow, and fragile. | AI blog | CROWDSTRIKE |
|
19.9.26 |
Devil’s advocate? Uncensored Luciferus AI service advertised underground | Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime | AI blog | SOPHOS |
|
19.9.26 |
ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split | Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field. | Security blog | SOPHOS |
|
19.9.26 |
The Answer to AI Uncertainty Is Adaptability, Not Paralysis | AI uncertainty is not a strategic reason to wait; it is a strategic imperative to build adaptable organizations that can innovate confidently, govern risk proportionately, and respond effectively as technology and threats evolve. | AI blog | SOPHOS |
|
19.9.26 |
When Patching Isn't Enough: What the Fairlife Ransomware Attack Says About Network Edge Risk | A recent ransomware incident at Coca-cola owned dairy company Fairlife provides a potent example of network edge devices being targeted for exploitation, and of the scale of outcomes attackers can achieve by exploiting them. | Ransom blog | Eclypsium |
|
19.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
19.9.26 |
Cybersecurity Compliance APAC 2026: What CISOs Need Now | Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia’s largest economies, almost in step. Singapore’s Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026. | Cyber blog | Cyble |
|
19.9.26 |
Silent Push Exposes North Korean IT Worker Recruiting Facilitators Through Discord Servers | Silent Push identified a North Korean fake job recruitment scam channel hosted on a Discord server by a defender colleague, and we engaged the recruitment representative to ask about their offering and determine whether the individual was actually a North Korean IT worker. | APT blog | SILENTPUSH |
|
19.9.26 |
Silent Push Tracks a Mass Phishing Operation Through Fast Flux | The fast-flux technique has evolved, making it easier for threat actors to use in phishing campaigns and harder for defenders to detect and apprehend cybercriminals. | Phishing blog | SILENTPUSH |
|
19.9.26 |
Is Your Home Internet Feeding the AI Data Race? | Residential proxy providers sell household IP access for AI data collection, but many users do not understand what that access involves. | AI blog | GENDIGITAL |
|
19.9.26 |
Free AI, at the Price of Your Prompt | You choose a model, ask a question and get an answer. Behind that familiar exchange is a less familiar journey involving prompt logs, shifting model identities and servers whose role is never explained to users. | AI blog | GENDIGITAL |
|
19.9.26 |
PaperCut NG/MF Unauthenticated Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threats CVE-2026-81578 and CVE-2026-82078, assessed their impact, and developed mitigation measures. Chained together, these two flaws in PaperCut NG and PaperCut MF, a widely deployed print management platform, give an unauthenticated remote attacker code execution on the Application Server. | Vulnerebility blog | SonicWall |
|
19.9.26 |
TeleClip: A native 64-bit Telegram RAT with Multi-Coin Crypto Clipboard hijack and Keylogger | SonicWall Capture Labs threat researchers have been tracking a Telegram bot malware capable of silently stealing cryptocurrency. The malware is a cryptocurrency clipboard hijacker and keylogger written in C (GCC/MinGW, native 64-bit PE). It replaces wallet addresses copied to the clipboard with attacker-controlled addresses across 23 coin types, logs keystrokes, and exfiltrates everything exclusively via the Telegram bot API — no custom C2 domain required. | Malware blog | SonicWall |
|
19.9.26 |
SonicWall Endpoint Security in Action: Detecting Akira Ransomware | Ransomware isn't going away—it’s constantly evolving and remains one of the biggest threats to businesses worldwide. One name that has recently dominated the headlines is Akira Ransomware. Akira was first observed in the wild in March 2023 and quickly emerged as a significant Ransomware-as-a-Service (RaaS) operation. | Ransom blog | SonicWall |
|
19.9.26 |
Inside the Modern SOC: Defending the Cross-Environment Pivot | Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools. | Cyber blog | Palo Alto |
|
19.9.26 |
Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection | As cloud environments expand to include human, machine and autonomous agent identities, mapping the functional roles of these identities has become a significant security challenge. To address this challenge, we designed a behavioral clustering model that extracts activity patterns from cloud audit logs. | Cyber blog | Palo Alto |
|
19.9.26 |
Atomic macOS (AMOS) Stealer Activity | This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer. | Malware blog | Palo Alto |
|
19.9.26 |
Securing the unpatchable in an age of AI-driven vulnerabilities | Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility, and the deployment of NGFW/IPS combinations can provide a powerful compensatory layer. | AI blog | CISCO TALOS |
|
19.9.26 |
Should you care about an “AI slowdown?” | In this week's Threat Source, David talks about why focusing on your security basics is still your best bet, even in a world with rapid AI advancements. | AI blog | CISCO TALOS |
|
19.9.26 |
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use | Ransomware incidents in Japan rose 4.7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion represented 80% of victims. | Ransom blog | CISCO TALOS |
|
19.9.26 |
We've got one word for it, and it's usually the wrong one | In this week's Threat Source newsletter, Joe explores why the word "burnout" often fails to capture the true toll of working in the cybersecurity industry and why we need better language to address it. | Cyber blog | CISCO TALOS |
|
19.9.26 |
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." | OS Blog | CISCO TALOS |
|
19.9.26 |
Beware the SparroWock: The backdoor that bites, the commands that catch | ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group | Malware blog | Eset |
|
19.9.26 |
Cyberthreats are moving faster than SMBs: Readiness must accelerate | As AI adoption expands the attack surface and adds to the security workload, businesses need automation backed by experts | Cyber blog | Eset |
|
19.9.26 |
SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment | SideCopy APT now targets academia using evasive mshta-driven RAT attacks. Discover their kill chain and secure your network from latest attacks. | Malware blog | TRELLIX |
|
18.9.26 |
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation | Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No | Vulnerebility | The Hacker News |
|
18.9.26 |
Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents | A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious | AI | The Hacker News |
|
18.9.26 |
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage | Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit . The new malware family, per | Virus | The Hacker News |
|
18.9.26 |
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer | A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as | AI | The Hacker News |
|
18.9.26 |
What Zero-Day Response Should Be in the Post-Mythos Era | AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. | Vulnerebility | BleepingComputer |
|
18.9.26 |
CISA: Critical VMware RCE flaw now exploited by ransomware gangs | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. | Exploit | BleepingComputer |
|
18.9.26 |
Suspected Black Axe gang leaders face cybercrime charges in the US | Five alleged leaders of the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud, have been extradited to the United States to face wire fraud and money laundering charges. | CyberCrime | BleepingComputer |
|
18.9.26 |
Microsoft confirms KB5002914 Excel update breaks copy and paste | Microsoft has confirmed that copy and paste may silently fail for some Excel users after installing the September 2026 KB5002914 security update. | OS | BleepingComputer |
|
18.9.26 |
Cisco patches Secure Email Gateway zero-day exploited in attacks | Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. | Exploit | BleepingComputer |
|
18.9.26 |
Microsoft releases emergency Windows updates to fix RDS failures | Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month's security updates, along with Hyper-V and USB audio problems on some Windows versions. | OS | BleepingComputer |
|
18.9.26 |
Japan's Digital Agency says VPN flaw exposed 246,000 personnel records | Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. | Incindent | BleepingComputer |
|
18.9.26 |
Homebrew 7.0.0 gets built-in GUI, better security controls | Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. | Security | BleepingComputer |
|
18.9.26 |
Twitch extension with 30K installs exposes users’ OAuth tokens | Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. | Hack | BleepingComputer |
|
18.9.26 |
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall | Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and | Virus | The Hacker News |
|
18.9.26 |
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root | A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as | Vulnerebility | The Hacker News |
|
18.9.26 |
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files | Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or | Vulnerebility | The Hacker News |
|
17.9.26 |
The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents | Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as “The Odyssey,” and uses the Solana blockchain to hide its C2 infrastructure. | Cryptocurrency | SECURELIST |
|
17.9.26 |
Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords | The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM | APT | The Hacker News |
|
17.9.26 |
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone | Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an | Vulnerebility | The Hacker News |
|
17.9.26 |
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar | A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time | Exploit | The Hacker News |
|
17.9.26 |
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America | The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. | APT | The Hacker News |
|
17.9.26 |
OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads | OpenAI on Wednesday disclosed six new instances of "unexpected or concerning model behavior" that took place over the past six months, | AI | The Hacker News |
|
17.9.26 |
ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell | Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. | Vulnerebility blog | JFROG |
|
17.9.26 |
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS | The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in | Vulnerebility | The Hacker News |
|
17.9.26 |
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records | A security breach at Gyazo , Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses and password | Incindent | The Hacker News |
|
17.9.26 |
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks | Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The | Vulnerebility | The Hacker News |
|
17.9.26 |
U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks | The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed | Attack | The Hacker News |
|
17.9.26 |
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution | A critical security flaw in Issabel Framework , a web-based framework for the open-source unified communications PBX software, has come under | Vulnerebility | The Hacker News |
|
17.9.26 |
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads | Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware | Hack | BleepingComputer |
|
17.9.26 |
Hackers target exposed Vite dev servers to steal AWS, Azure secrets | A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. | CyberCrime | BleepingComputer |
|
17.9.26 |
Why Patch Automation Needs Brakes, Not Just an Accelerator | Patch automation can help IT teams keep pace with growing update volumes, but deploying faster also means bad updates can spread faster. Action1 explains how update rings, predefined success criteria, and human oversight can make automated patching faster without sacrificing control. | Security | BleepingComputer |
|
17.9.26 |
Microsoft: September updates cause RDS failures on Windows Server | Microsoft has confirmed reports that the September 2026 security updates cause Remote Desktop Services (RDS) failures on Windows Server systems. | OS | BleepingComputer |
|
17.9.26 |
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers | Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle , Hacking Cat , and Toy Ghouls , according | APT | The Hacker News |
|
17.9.26 |
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude | Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five | AI | The Hacker News |
|
17.9.26 |
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories | Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud | AI | The Hacker News |
|
17.9.26 |
Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix | Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company | OS | The Hacker News |
|
17.9.26 |
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security | N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse | Phishing | The Hacker News |
|
16.9.26 |
NightEagle targets Russian companies | Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP. | APT | SECURELIST |
|
16.9.26 |
Sisterhood of the Traveling Pants CTF Writeup | With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life. | Cyber blog | FLARE.IO |
|
16.9.26 |
Mythic C2 Activity at Internet Scale | Mythic is an open-source collaborative C2 framework which is actively maintained on GitHub. It provides a plugin-based architecture supporting multiple agent types, transport profiles, and an operator-facing web UI. | CyberCrime blog | CENSYS |
|
16.9.26 |
State-Sponsored APT Threat Landscape in H1 2026 | This report analyzes the activities of North Korean, Chinese, and Russian-backed threat groups based on the APT Threat Trends from January to June 2026. | APT blog | S2W |
|
16.9.26 |
2025 H2 Ransomware Trends Report | S2W Threat Intelligence Center, TALON, has published a detailed analysis report on ransomware group activity in the second half of 2025. | Ransom blog | S2W |
|
16.9.26 |
How to mitigate typosquatting and slopsquatting attacks in npm and PyPI | One wrong character in a package name can give an attacker code execution inside a developer workstation or build environment. Typosquatting attacks exploit that small margin of error by publishing malicious packages whose names resemble legitimate projects in registries such as npm and the Python Package Index, or PyPI. | Hacking blog | THREATLOCKER |
|
16.9.26 |
Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit | A widespread smishing campaign was identified in which victims received fraudulent SMS messages impersonating official entities and were instructed to click a link inside the SMS in order to “complete a verification“, “settle an outstanding fee”, or “re-confirm delivery details”. | Phishing blog | GROUP-IB |
|
16.9.26 |
GhostCode: Dissecting a Novel Device Code Phishing Kit | In late August 2026, eSentire's Threat Response Unit (TRU) identified an active device code phishing campaign distributed through web contact forms. In the campaign, threat actors posed as a procurement officer of a legitimate business. TRU is tracking the device code phishing kit used in the campaign as "GhostCode". | Phishing blog | ESENTIRE |
|
16.9.26 |
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions | Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold its C2 configuration. | Malware blog | ELASTIC |
|
16.9.26 |
Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group | This report provides insights and analysis to better understand the role of third-party vendors and guarantee marketplaces from the perspective of Tajin Group, a third-party vendor that advertises and provides services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee. | APT blog | Recorded Futures |
|
16.9.26 |
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware | On X, the threat actor posed as the head of marketing at CoinDesk, appearing to use one person's name and another's photograph. Huntress confirmed that this account reached out to multiple security researchers at the tail end of DEFCON, using a boilerplate lure themed around an upcoming crypto conference. | Cyber blog | Huntress |
|
16.9.26 |
ANY.RUN & SentinelOne: One Workspace, Instant Threat Context | Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. | Cyber blog | ANYRUN BLOG |
|
16.9.26 |
H1 2026 Cyber Risk Report by ANY.RUN | ANY.RUN has released its H1 Cyber Risk Report, built on unique data from real-world submissions analyzed in the ANY.RUN Interactive Sandbox from January to June 2026 by over 700,000 analysts and 16,000 SOC teams. | Cyber blog | ANYRUN BLOG |
|
16.9.26 |
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation | Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked | Exploit | The Hacker News |
|
16.9.26 |
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks | Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been | Exploit | The Hacker News |
|
16.9.26 |
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells | Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than | Exploit | The Hacker News |
|
16.9.26 |
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens | A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case | Exploit | The Hacker News |
|
16.9.26 |
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens | Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN | Virus | The Hacker News |
|
16.9.26 |
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists | Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's | APT | The Hacker News |
|
15.9.26 |
BambooToken Malware Uses MQTT to Control Windows and Linux Systems | Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport ( MQTT ) | Virus | The Hacker News |
|
15.9.26 |
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds | With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. | Exploit | The Hacker News |
|
15.9.26 |
Agentic Ransomware: From Human-Operated to AI-Operated Attacks | Ransomware has always needed a human involved somewhere: an affiliate navigating a network by hand, or at minimum, a person who wrote the script the malware executed. Agentic ransomware breaks that assumption. It describes a ransomware attack where an autonomous AI agent, not a person, makes the operational decisions from the moment it gains access to the moment it demands payment. | Ransom blog | SOCRADAR |
|
15.9.26 |
Simplify Threat Intelligence Procurement with SOCRadar and Microsoft Marketplace | Your security team has already made the case for external threat intelligence. The budget owner agrees. Then the deal stalls on procurement rather than technology: a new vendor onboarding form, a separate legal review, another invoice outside the cloud commitment you have already negotiated. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch | SOCRadar’s Threat Research Unit (STRU) has documented VectraRAT, a Malware-as-a-Service platform built entirely from scratch rather than forked from leaked RAT code. Renting from $250 a month, it gives operators hidden-desktop control, keylogging, clipboard hijacking, browser credential theft, and a UAC bypass that elevates with no prompt. | Malware blog | SOCRADAR |
|
15.9.26 |
UCQ Leak, Israeli GlobalProtect Access, Digital Nirvana Dump, 32baar, and Ghorer Bazar | SOCRadar Dark Web Team identified several new underground posts, including an alleged Universidad Cuauhtémoc database leak, an alleged GlobalProtect-based access auction for an Israeli manufacturing firm, and an alleged 900GB Digital Nirvana data dump. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
GitLab CVE-2026-85706 Added to CISA KEV | CVE-2026-85706 represents a severe path traversal flaw in GitLab CE and EE, permitting unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployments. Following GitLab’s patch release on September 10, 2026, CISA incorporated the security issue into its KEV catalog the next day. | Vulnerebility blog | SOCRADAR |
|
15.9.26 |
Simplify Threat Intelligence Procurement with SOCRadar and AWS Marketplace | Your security team has already made the case for external threat intelligence. The budget owner agrees. Then the deal stalls on procurement rather than technology: a new vendor onboarding form, a separate legal review, another invoice outside the cloud commitment you have already negotiated. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
ENISA's CRA Single Reporting Platform Just Went Live. Here's What You Actually Need to Know | September 11, 2026, the Cyber Resilience Act's (CRA) reporting obligations officially kicked in, and ENISA's Single Reporting Platform (SRP) went live right alongside them. | Security blog | VULNCHECK |
|
15.9.26 |
No One Inside The Machine | In 1770, Wolfgang von Kempelen unveiled the “Mechanical Turk”: a chess-playing automaton that stunned European courts. With gears, a cabinet, and an articulated arm that moved its own pieces, it looked like a machine. | Security blog | CENSYS |
|
15.9.26 |
Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676 | A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, three bytes of length. `SslClientHelloHandler` has to read both before it knows how much ClientHello to expect, and the standard permits a handshake message to be split across several records, so it must be prepared for the header to arrive incomplete. | Vulnerebility blog | OX SECURITY |
|
15.9.26 |
The fake worker threat and the rise of human infiltration | How fake workers exploit trust, business processes and digital identities to gain legitimate access to organizations | Exploit blog | BARRACUDA |
|
15.9.26 |
Inside a 24 Billion Credential Leak: Passwords, Exploits, and How Attackers Connected Them, Part 1 | Most mega-breach compilations are static: old passwords from old incidents, most useful against people who never rotated a credential after a 2019 or 2021 breach. This one skewed toward fresh infostealer output, meaning a significant portion of the records may still be valid, including active browser session cookies in some logs (Tech Times). | Hacking blog | PROOFPOINT |
|
15.9.26 |
Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence | Hunt.io's AttackCapture™ discovered an open directory hosted at 92.63.180[.]133:8888, a server on Bangmod Enterprise Co., Ltd. infrastructure in Thailand. The directory contained 298 files across 30 subdirectories totaling 19 MB, first captured on June 3, 2026, including exploitation scripts, privilege escalation tools, brute-force utilities, a live MeshCentral agent configuration, and a device inventory of already-compromised machines, all targeting 3BB (Triple T Broadband). | Hacking blog | HUNT.IO |
|
15.9.26 |
Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point | Introduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my | Attack | The Hacker News |
|
15.9.26 |
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers | Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The | Exploit | The Hacker News |
|
15.9.26 |
Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence | Hunt.io's AttackCapture™ discovered an open directory hosted at 92.63.180[.]133:8888, a server on Bangmod Enterprise Co., Ltd. infrastructure in Thailand. | Hacking blog | HUNT.IO |
|
15.9.26 |
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server | A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel | Vulnerebility | The Hacker News |
|
15.9.26 |
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution | Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461 , carries a CVSS score of 9.8 out of a maximum of 10.0. | Exploit | The Hacker News |
|
15.9.26 |
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE | A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and | Exploit | The Hacker News |
|
15.9.26 |
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing | Researchers have disclosed a new hardware attack, called DDRop , that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server's memory, so the processor keeps | Attack | The Hacker News |
|
15.9.26 |
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials | An attacker was operating inside the network of 3BB , one of Thailand's largest broadband providers, and maintained remote control of internal | Virus | The Hacker News |
|
15.9.26 |
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports | A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at | Social | The Hacker News |
|
15.9.26 |
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries | A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security | Exploit | The Hacker News |
|
15.9.26 |
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution | WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org | Hack | The Hacker News |
|
14.9.26 |
Revolut discloses data breach exposing financial info, passports | Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. | Incindent | BleepingComputer |
|
14.9.26 |
Microsoft: September updates break audio on some Windows PCs | Microsoft has confirmed that USB audio devices may fail on some Windows systems after installing the KB5124008and KB5124012 September 2026 security updates. | OS | BleepingComputer |
|
14.9.26 |
CISA: Hackers now exploit max severity GitLab flaw in attacks | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks. | Exploit | BleepingComputer |
|
14.9.26 |
Hackers exploit Tencent app flaw to deploy GrayRabbit malware | Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. | Exploit | BleepingComputer |
|
14.9.26 |
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users | A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a | Hack | The Hacker News |
|
13.9.26 |
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data | Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. | Phishing | The Hacker News |
|
13.9.26 |
Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent | The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. | Exploit | BleepingComputer |
|
13.9.26 |
Hackers abused Claude to extract secrets from 1.8M Android apps | Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. | AI | BleepingComputer |
|
13.9.26 |
Florida confirms DMV database breached via stolen police account | The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach, saying the attackers gained access using credentials belonging to a police department employee. | Incindent | BleepingComputer |
|
13.9.26 |
Passkey-themed phishing attacks lead to Microsoft 365 data theft | Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. | Phishing | BleepingComputer |
|
13.9.26 |
Artifactory flaws chained in attacks deploying backdoor malware | Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. | Virus | BleepingComputer |
|
13.9.26 |
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface | Threat actors are abusing trusted AI platforms to host malicious content, poison search results, and trick users into installing malware. Huntress examines campaigns targeting AI users through weaponized Claude Artifacts, shared AI conversations, sponsored search results, and ClickFix-style lures. | AI | BleepingComputer |
|
13.9.26 |
GitLab urges users to patch max severity path traversal flaw | GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. | Vulnerebility | BleepingComputer |
|
13.9.26 |
Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs | Microsoft has fixed a bug that prevented Teams and Outlook from launching on ARM-based Windows devices after installing updates released since the August 2026 Patch Tuesday. | OS | BleepingComputer |
|
13.9.26 |
Trezor: 347,000 users targeted in phishing attacks after Brevo breach | Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. | Phishing | BleepingComputer |
|
13.9.26 |
Conti ransomware gang member sentenced to 4 years in prison | A Ukrainian national has been sentenced to four years in prison for his role in Conti ransomware attacks between 2021 and 2022. | Ransom | BleepingComputer |
|
13.9.26 |
New Android malware encrypts files, steals data, and harasses victims | A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. | Virus | BleepingComputer |
|
13.9.26 |
September Windows Server updates break Remote Desktop Services | Windows admins report that the September 2026 security updates are causing Remote Desktop Services (RDS) failures on Windows Server 2019, 2022, and 2025 servers, preventing users from connecting and, in some cases, requiring a hard reset to restore functionality. | OS | BleepingComputer |
|
13.9.26 |
Surfshark VPN says hackers breached internal testing, proxy servers | Surfshark disclosed that hackers accessed one of its internal test servers after a configuration error exposed it to the internet. | Incindent | BleepingComputer |
|
13.9.26 |
Microsoft Excel KB5002914 update breaks copy and paste for some users | Microsoft Excel users report that this week's KB5002914 Office security update is breaking copy-and-paste operations and formula dragging, with affected users saying that removing or rolling back the update restores normal functionality. | OS | BleepingComputer |
|
13.9.26 |
AI-powered attack exploited PaperCut flaws to hack 395 organizations | A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers. | AI | BleepingComputer |
|
13.9.26 |
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers | Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. | Ransom | BleepingComputer |
|
13.9.26 |
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise | Exploit | The Hacker News |
|
13.9.26 |
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers | The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by | AI | The Hacker News |
|
13.9.26 |
IDScan confirms breach tied to 153 million stolen driver’s licenses | Identity verification company IDScan has confirmed that hackers accessed customer data stored in its cloud platform, days after reports linked the company to a massive database containing more than 153 million driver's license scans. | Incindent | BleepingComputer |
|
13.9.26 |
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws | Multiple cyber-espionage groups deployed an exploit kit dubbed "BlueMoon" that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome. | Exploit | BleepingComputer |
|
13.9.26 |
The Top 4 Threats We Found by Investigating Every Alert for a Quarter | Identity was the target in roughly half of all confirmed malicious activity. Prophet Security breaks down the four main attack patterns seen across customer environments between May and July 2026, and explains why some attacks succeeded while others were blocked. | Hack | BleepingComputer |
|
13.9.26 |
Microsoft says September updates fix mouse settings reset issues | Microsoft has fixed a known issue that wiped mouse settings on some Windows 11 systems after installing the KB5120998 August 2026 preview update. | OS | BleepingComputer |
|
13.9.26 |
CISA: WatchGuard RCE flaw now exploited in ransomware attacks | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December. | Ransom | BleepingComputer |
|
13.9.26 |
Microsoft fixes bug that wiped Windows desktop settings | Microsoft says the September 2026 Patch Tuesday updates fix a known issue causing desktop settings to be lost or reset on some Windows devices. | OS | BleepingComputer |
|
13.9.26 |
Trezor warns users of email provider breach, phishing attacks | Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. | Phishing | BleepingComputer |
|
13.9.26 |
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks | Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks. | Vulnerebility | BleepingComputer |
|
13.9.26 |
AdaptHealth confirms 4.1 million people exposed in July cyberattack | Healthcare company AdaptHealth has confirmed that data of 4.1 million people was exposed in a cyberattack discovered in July that was attributed to the ShinyHunters threat group. | Incindent | BleepingComputer |
|
13.9.26 |
Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking | The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction. | Hack | BleepingComputer |
|
13.9.26 |
US says Chinese firms extracted billions of tokens from frontier AI models | U.S. cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. | AI | BleepingComputer |
|
13.9.26 |
Veradigm warns of patient data breach after ransomware gang claims attack | Healthcare technology company Veradigm disclosed a data breach after a cybersecurity incident at one of its third-party vendors exposed patients' personal data. | Ransom | BleepingComputer |
|
13.9.26 |
MFA's Weakest Link: Account Recovery Is the New Attack Path | MFA makes account takeover harder, but attackers are increasingly targeting the recovery processes used to reset passwords and authentication methods. Specops explains why stronger identity verification at the service desk is critical to preventing social engineering attacks from turning account recovery into account takeover. | Attack | BleepingComputer |
|
13.9.26 |
Over 36,000 exposed Plex servers vulnerable to recent flaws | Over 36,000 Plex Media servers exposed online remain unpatched against multiple security vulnerabilities and are vulnerable to attacks. | Vulnerebility | BleepingComputer |
|
12.9.26 |
Man gets 15 years for extorting women with AI-generated porn videos | An Ohio man was sentenced to 15 years in prison for multiple cybercrimes, including sextortion and cyberstalking of numerous victims using AI-generated sexually explicit content. | AI | BleepingComputer |
|
12.9.26 |
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access | An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates. | Exploit | BleepingComputer |
|
12.9.26 |
Google warns of new Chrome zero-day bug exploited in attacks | Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year. | Exploit | BleepingComputer |
|
12.9.26 |
Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults | Microsoft is adding new age-awareness APIs to Windows 11 that will allow apps to determine whether someone is a child, teenager, or adult without exposing their exact date of birth. | OS | BleepingComputer |
|
12.9.26 |
DoppelCart fraud network uses 119,000 fake shops to steal credit cards | A massive operation dubbed "DoppelCart" uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. | CyberCrime | BleepingComputer |
|
12.9.26 |
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit | A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. | Virus | BleepingComputer |
|
12.9.26 |
Microsoft releases Windows 10 KB5122878 extended security update | Microsoft has released the Windows 10 KB5122878 extended security update, which includes this month's record-breaking September 2026 Patch Tuesday fixes, along with a few bug fixes. | OS | BleepingComputer |
|
12.9.26 |
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days | Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities. | OS | BleepingComputer |
|
12.9.26 |
Windows 11 cumulative updates KB5124008 & KB5122880 released | Microsoft has released Windows 11 KB5124008 and KB5122880 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. | OS | BleepingComputer |
|
12.9.26 |
ShinyHunters hackers claim breach of Florida "DAVID" DMV database | The ShinyHunters extortion gang claims it breached an online platform for the Florida Department of Motor Vehicles database known as "DAVID" and stole over 200,000 records about drivers in the state. | Incindent | BleepingComputer |
|
12.9.26 |
OpenAI says ChatGPT outage causes image generation errors | OpenAI is investigating an ongoing incident causing ChatGPT image generation failures and delays when uploading files. | AI | BleepingComputer |
|
12.9.26 |
August updates trigger 0xc0000409 errors on Windows Server 2016 | Microsoft says the August 2026 security update may trigger 0xc0000409 errors on Windows Server 2016 systems where the Compatibility Appraiser diagnostic service is enabled. | OS | BleepingComputer |
|
12.9.26 |
SAP warns of maximum severity 'OVERPASS' kernel vulnerability | SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code. | Vulnerebility | BleepingComputer |
|
12.9.26 |
OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor | OpenAI confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the "Critical level" for cybersecurity capabilities. | AI | BleepingComputer |
|
12.9.26 |
Adobe fixes critical Magento zero-day exploited to backdoor servers | Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. | Vulnerebility | BleepingComputer |
|
12.9.26 |
Webinar: The forgotten Google Workspace access that can lead to a breach | Third-party applications connected to Google Workspace can retain access long after their original purpose is forgotten. This webinar examines how overly permissive integrations contribute to breaches and which security controls can help fast-growing companies reduce their exposure. | Security | BleepingComputer |
|
12.9.26 |
Hackers build AI frameworks for widescale credential theft | Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack. | AI | BleepingComputer |
|
12.9.26 |
Microsoft: Windows Server 2025 changes causing app crashes | Microsoft warned customers last week that they may experience application crashes on some Windows Server 2025 due to recent memory management changes. | OS | BleepingComputer |
|
12.9.26 |
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure | GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild | Vulnerebility | The Hacker News |
|
12.9.26 |
Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks | Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, | AI | The Hacker News |
|
12.9.26 |
LLMs Just Made Your IP Easier to Steal: Here’s the Fix | Large Language Models (LLMs) have fundamentally altered the economics of reverse engineering, meaning that any organization still relying on traditional obfuscation as its primary defense is protecting against an attacker who no longer exists. | AI blog | JSCRAMBLER |
|
12.9.26 |
When Detection Arrives After the Damage: Ransomware as a Patient-Safety Emergency | Healthcare ransomware is a patient-safety emergency, not just a data-privacy incident: when ransomware encrypts hospital systems, it disrupts the technology clinicians use to diagnose, treat, and stabilize patients — diverting ambulances, delaying procedures, and forcing a return to paper at the moment care is most time-sensitive. | Ransom blog | MORPHISEC |
|
12.9.26 |
Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs | In our previous blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality. | Hacking blog | SPIDERLABS |
|
12.9.26 |
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data | Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data. | Cryptocurrency blog | SOCKET.DEV |
|
12.9.26 |
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack | Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor. | AI blog | SOCKET.DEV |
|
12.9.26 |
Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know | Learn how Shai-Hulud compromises trusted software workflows, exposes credentials across CI/CD environments, and creates attack paths into cloud, production, and downstream systems, and how security teams can contain and recover from the compromise. | Hacking blog | SYGNIA |
|
12.9.26 |
Introducing automatic remediation policies with Cloudflare CASB | Today, we’re making Cloudflare CASB more powerful than ever by introducing automatic remediation policies. This means security teams can now design event-driven logic to revoke risky file shares and dispatch custom webhooks, without manual intervention. | Security blog | CLOUDFLARE |
|
12.9.26 |
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it | 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a post-quantum signature algorithm standardized by the National Institute of Standards and Technology (NIST). This is a first step toward preparing DNSSEC for a future in which today’s signature algorithms are no longer secure. | Security blog | CLOUDFLARE |
|
12.9.26 |
How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility | We’ve rewritten the module registry in workerd, the core open-source component of the Workers runtime, to be faster, more standards-compliant, and more closely aligned with Node.js' module registry. | Security blog | CLOUDFLARE |
|
12.9.26 |
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) | Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest, we start over, and the connection costs two round trips. | Security blog | CLOUDFLARE |
|
12.9.26 |
Reduce AI Token Waste by Getting Decisions Right Earlier | AI coding assistants are changing the economics of software development. They can interpret tasks, inspect codebases, select dependencies, make changes, call tools, run tests, and prepare pull requests. | AI blog | SONATYPE |
|
12.9.26 |
DefCon 2026: The Sandbox Is a Suggestion: Breaking Claude Code, Gemini CLI, and Codex Sandboxes | How we broke the default sandboxes in Claude Code, Gemini CLI, and Codex — leaking credentials from all three, including a CVSS 10.0 chain. DefCon 2026 research. | Cyber blog | NOVEE |
|
12.9.26 |
DefCon 2026: No Prompt Required: Pre-Task RCE in Google Gemini CLI | How a CVSS 10.0 pre-task RCE in Google Gemini CLI ran attacker code before the sandbox started. No prompt injection required. Full DefCon 2026 research. | Cyber blog | NOVEE |
|
12.9.26 |
CRA Reporting Goes Live September 11: What Manufacturers Must Have in Place When the Clock Starts | Product security continues to stand as a forefront of risk for manufacturers and developers worldwide. Consumers are consistently seeking new ways to protect themselves, their environments and their own systems. While some of this responsibility may fall on user’LAUDs, many look to the product engineers behind their solutions as a first line of defense. | Cyber blog | GUIDESECURITY |
|
12.9.26 |
Agentic AI Security: Key Findings from New IDC Research on the Identity Control Plane | A new IDC whitepaper, commissioned by GuidePoint Security, explores why identity is the foundational control plane for securing agentic AI and what organizations should prioritize as adoption accelerates. | AI blog | GUIDESECURITY |
|
12.9.26 |
URL Laundering by Rogue Agents: Newly Discovered Messages and Sandbox Circumvention by AI Swarms | We found a thousand new messages and additional sandbox circumvention methods used by the collusion.wiki Rogue AI agent swarms | AI blog | ZENITY |
|
12.9.26 |
ShieldCrash PoC: Microsoft Defender Fix Bypass | Microsoft recently fixed CVE-2026-69414 (ShieldBreak), a High-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Cisco FMC CVE-2026-20079 Actively Exploited | Cisco has confirmed active exploitation of CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) with a maximum CVSS score of 10.0. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Vibe-Terrorism: Inside the Yemen Cell That Used Claude to Build Guided Weapons | In Anthropic’s September 2026 threat intelligence report, one case stands apart from the rest. A small cell based in northern Yemen used Claude Code to develop guidance, navigation, and control (GNC) software for missiles. They ran three weapons programs simultaneously, conducted a live test-fire and when the rocket failed, they came back to Claude within hours to figure out why. | AI blog | SOCRADAR |
|
12.9.26 |
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) | Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild | Vulnerebility blog | TENABLE |
|
12.9.26 |
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI | Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That’s why for its new CyberAgents Exchange registry, Tenable paired its exposure management expertise with OpenAI GPT Cyber models to create the CyberAgents Exchange AI Inspector. | AI blog | TENABLE |
|
12.9.26 |
FileRun: Four More Ways to Run Your Files | Today VulnCheck is disclosing four vulnerabilities in FileRun, the self-hosted file manager and sharing platform. They are being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy, and all four were allocated through the VulnCheck CNA. Each one ends in remote code execution as the web-server user: | Vulnerebility blog | VULNCHECK |
|
12.9.26 |
The Anthropic Glasswing Receipts Are Starting to Trickle In | Anthropic’s Project Glasswing is approaching 5 months old, and Anthropic published its Vulnerability Disclosure Ledger on May 22nd. It hadn't received an update until this past week, when it backfilled the ledger with additional findings and updates, so naturally I thought it would be worthwhile to take a look at the receipts. | AI blog | VULNCHECK |
|
12.9.26 |
New on the Map — August 2026: 14 Protocol Scanners | Most organizations don’t have a complete picture of what’s reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. However, attackers scan for these services systematically, every day. | Security blog | CENSYS |
|
12.9.26 |
CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox | OX Research found and disclosed a critical vulnerability in DeepSeek Harness, DeepSeek’s open-source AI coding-agent harness, that allowed a sandboxed AI agent to disable its own confinement with a single shell command – on shipped defaults, with no network exposure and no credentials. | Vulnerebility blog | OX SECURITY |
|
12.9.26 |
Finding and Notifying a ShinyHunters Claims Impersonation Campaign Before It Activated: 61 Domains, 48 Brands | ReliaQuest Threat Research published a short public advisory about a ShinyHunters campaign on August 17, 2026. This campaign was built on domains following a company[.]claims pattern, and reported that the group had added legal team impersonation to its established help desk and IT pretexts. The advisory had no domains, and described a shape that left the reader to find the instances. | CyberCrime blog | FLARE.IO |
|
12.9.26 |
I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method | The AhnLab SEcurity intelligence Center (ASEC) recently identified the LegionLoader malware, which is currently being distributed via the ClickFix method. There are two main distribution methods identified so far; both involve tricking users into visiting a malicious URL and then prompting them to directly execute malicious PowerShell commands through a fake Cloudflare CAPTCHA screen. | Malware blog | Zscaler |
|
12.9.26 |
Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers | In August 2026, FortiGuard Labs observed a Casbaneiro attack campaign targeting users in Latin America, using phishing emails and PDF files themed around fake invoices and legal notices as the initial stage. | Malware blog | FORTNITE |
|
12.9.26 |
ShadowPane: Inside a Frostedwrist-Linked BITB Campaign Targeting Real Estate and Escrow Firms | ZeroBEC uncovered a phishing campaign we track as ShadowPane that uses browser-in-the-browser deception to make malicious RMM installations appear to originate from Adobe. | Phishing blog | ZEROBEC |
|
12.9.26 |
Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source | TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. | Vulnerebility blog | IMPERVA |
|
12.9.26 |
ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings | In G2’s Fall 2026 awards, we earned both Momentum Leader and Grid Leader recognition, highlighting our continued growth and strong position in the market. Most importantly, these achievements reflect the trust security professionals place in ANY.RUN every day to support their threat investigations. | Malware blog | ANYRUN BLOG |
|
12.9.26 |
15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN | To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture. | Cyber blog | ANYRUN BLOG |
|
12.9.26 |
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress recently analyzed two attacks that started with a phishing message and then redirected victims to a browser-in-the-browser (BiTB) page (both using the same template and lure) that prompted them to download an "updated Adobe Reader" version to view files. | Phishing blog | Huntress |
|
12.9.26 |
Grand Theft Auto VI Hype Leads to Malware | Threat actors are taking advantage of overeager gamers searching for a leaked version of the upcoming Grand Theft Auto VI (GTA6), using fake game downloads as an initial access lure. | Malware blog | Huntress |
|
12.9.26 |
UK Council Attack Linked to SonicWall SMA 1000 Campaign | Disclosure note: Hunt.io notified the UK National Cyber Security Centre (NCSC) and other relevant national CERTs ahead of publication, so that affected organisations identified during the research could be contacted. | Vulnerebility blog | HUNT.IO |
|
12.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
12.9.26 |
Beyond the Alert: Bringing Context to Insider Risk and AI Investigations | Proofpoint is announcing two expansions to its communications intelligence capabilities today. Proofpoint Prism Investigator now connects directly to Microsoft 365, and Proofpoint Human Communications Intelligence (HCI) now brings AI communications governance signals into insider risk investigations. | AI blog | PROOFPOINT |
|
12.9.26 |
SloppyRAT: A New Tool For Ransomware Attacks | In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. | Malware blog | Zscaler |
|
12.9.26 |
This SonicWall bug is 2 years old. Akira ransomware is still exploiting it. | The Akira ransomware gang is still breaking into networks through a firewall bug SonicWall fixed two years ago. The critical vulnerability, CVE-2024-40766, carries a CVSS score of 9.3 out of 10. | Vulnerebility blog | THREATDOWN |
|
12.9.26 |
Dissecting a PHP web server rootkit | Sophos X-Ops takes a deep dive into an insidious piece of malware | Malware blog | SOPHOS |
|
12.9.26 |
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures | Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines.... | Malware blog | SEQRITE |
|
12.9.26 |
Cyble Introduces Major Upgrade to its Executive Monitoring Module | Cyble has rolled out a significant upgrade to Executive Monitoring inside Cyble Vision, bringing unified findings, AI-driven scoring, and expanded alerting together in a single protection suite. | Cyber blog | Cyble |
|
12.9.26 |
From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline | Infostealer malware turns a single infection into a marketplace listing. A technical look at harvesting, stealer logs, enrichment, and resale. | Malware blog | Cyble |
|
12.9.26 |
Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us | Qatar is racing toward a knowledge-based, fully digital economy. But that pace of transformation makes Qatar an attractive target in the cyber realm. | Cyber blog | Cyble |
|
12.9.26 |
AI-Driven Threat Intelligence for Gulf Enterprises: Why Detection Speed Is Now a Regulatory Requirement | AI-powered threat intelligence helps GCC enterprises detect breaches faster, close compliance gaps, and meet strict cyber incident reporting deadlines. | AI blog | Cyble |
|
12.9.26 |
Gray Rabbits and the Tale of a One-Click Backdoor | One click. Three critical failures. One backdoor. | Malware blog | GENDIGITAL |
|
12.9.26 |
Infostealers Have Found a New Target: Your AI Agent | Malware operators are expanding beyond browser passwords and crypto wallets to collect access tokens, MCP configurations, prompt histories and project data stored by AI tools. | AI blog | GENDIGITAL |
|
12.9.26 |
Protecting organizations from AI-assisted executive impersonation and invoice fraud | Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud. | AI blog | Microsoft blog |
|
12.9.26 |
Passkey-themed social engineering leads to identity and cloud compromise | Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. | Security blog | Microsoft blog |
|
12.9.26 |
Microsoft Security Bulletin Coverage for September 2026 | Microsoft’s September 2026 Patch Tuesday is the largest on record, addressing 971 vulnerabilities, including 438 Elevation of Privilege vulnerabilities. The SonicWall Capture Labs Threat Research team analyzed Microsoft’s security advisories for September 2026 and developed coverage for 42 of the reported vulnerabilities. | OS Blog | SonicWall |
|
12.9.26 |
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure | A recent Unit 42 investigation into seemingly low-priority enterprise infections demonstrates how the most effective camouflage in cybercrime is not necessarily in the use of sophisticated techniques, but in how unremarkable the threat appears. The activities that we investigated would typically not require escalation or further inquiry. But upon closer inspection, we discovered a massive cybercrime campaign largely targeting young gamers. | CyberCrime blog | Palo Alto |
|
12.9.26 |
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America | We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Corroborating recent findings from the broader threat intelligence community, we observed attackers leveraging artificial intelligence (AI) to enhance their capabilities. | AI blog | Palo Alto |
|
12.9.26 |
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE | This research demonstrates post-exploitation techniques that could allow an attacker with root access on a compromised Kubernetes node to misuse an open standard and reference implementation for machine identity known as SPIFFE/SPIRE to impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs). | Exploit blog | Palo Alto |
|
12.9.26 |
PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector | In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating payload (e.g. ”encrypt files in ~/Documents”, “give me a biohazard recipe”, “ignore all previous instructions and…”) is embedded in a specially crafted prose wrapper. | AI blog | CHECKPOINT |
|
12.9.26 |
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT | Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker’s task was processed separately and its result returned across accounts. | AI blog | CHECKPOINT |
|
12.9.26 |
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 | Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. | Cryptocurrency blog | CISCO TALOS |
|
12.9.26 |
We've got one word for it, and it's usually the wrong one | In this week's Threat Source newsletter, Joe explores why the word "burnout" often fails to capture the true toll of working in the cybersecurity industry and why we need better language to address it. | Cyber blog | CISCO TALOS |
|
12.9.26 |
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities | Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. | Exploit blog | CISCO TALOS |
|
12.9.26 |
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager | We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. | Malware blog | CISCO TALOS |
|
12.9.26 |
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." | Vulnerebility blog | CISCO TALOS |
|
12.9.26 |
GuardBreaker: Derailing AI-assisted malware analysis with a code comment | AI blog | Eset | |
|
12.9.26 |
Safe word: What is it and why do you need one? | AI scams are now hyper-realistic. But there’s one simple way to see through them. | Security blog | Eset |
|
12.9.26 |
Testing race conditions with memory access tracing and stack-based delay injection | Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: | Hacking blog | PROJECT ZERO |
|
12.9.26 |
Trellix SecondSight Threat Hunting Report: How AI and Human Intelligence Expose 2026 Cyber Threats | As adversaries adopt new technologies, techniques, and increasingly AI-enabled ways of operating, defenders have access to more telemetry, intelligence, and automation than ever before. The challenge is knowing where to look, what matters, and when a weak signal deserves a closer look. This is focus of the September 2026 Trellix SecondSight Threat Hunting Report. | AI blog | TRELLIX |
|
11.9.26 |
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims | Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. | AI | The Hacker News |
|
11.9.26 |
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection | Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing | APT | The Hacker News |
|
11.9.26 |
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors | Attackers have chained two flaws in JFrog Artifactory , the repository that software build pipelines pull from, to take administrator control of self- | Vulnerebility | The Hacker News |
|
11.9.26 |
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor | A China-linked hacking group exploited a flaw in Sogou Input Method , one of the most widely used tools for typing Chinese characters on Windows, | APT | The Hacker News |
|
11.9.26 |
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws | PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to | Exploit | The Hacker News |
|
11.9.26 |
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware | Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched | Exploit | The Hacker News |
|
11.9.26 |
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps | Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and | CyberCrime | The Hacker News |
|
11.9.26 |
220 million traveler records exposed in Vietnam-linked APIS leak | Exclusive: An exposed Advance Passenger Information System (APIS) database held 220 million passenger and crew records containing names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. Researchers accessed the Vietnam-linked system through a cloud-based path using default credentials. | Incindent | BleepingComputer |
|
11.9.26 |
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor | A zero-day vulnerability dubbed "StyleSmuggler" affecting all versions of Magento and Adobe Commerce is being exploited in attacks to deploy a backdoor. | Exploit | BleepingComputer |
|
11.9.26 |
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations | A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials | Phishing | BleepingComputer |
|
11.9.26 |
Mathspace discloses data breach affecting over 1 million people | Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. | Incindent | BleepingComputer |
|
11.9.26 |
Trezor data breach impact now reaches 81,000 customers | Cryptocurrency hardware wallet maker Trezor says an August data breach at its shipping and logistics provider, ShipMonk, affects an additional 67,000 U.S. customers. | Incindent | BleepingComputer |
|
11.9.26 |
ChatGPT can now connect to your personal apps to mimic writing style | OpenAI appears to be testing a new "Writing Style" feature for ChatGPT that can learn how you write by looking at examples from your connected apps. | AI | BleepingComputer |
|
11.9.26 |
Hackers exploit new MikroTik RouterOS flaws to hijack routers | Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. | Exploit | BleepingComputer |
|
11.9.26 |
ConnectWise warns of new ScreenConnect flaw without patch | ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. | Vulnerebility | BleepingComputer |
|
11.9.26 |
Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration | The zLabs research team has discovered a sophisticated and highly aggressive mobile malware strain linked to Indonesian threat actors, that marks a dangerous tactical evolution by seamlessly integrating comprehensive spyware capabilities with traditional ransomware functionality into a single attack vector. | Ransom blog | ZIMPERIUM |
|
11.9.26 |
DCOM Service PsmServiceExtHost LPE - SSD Secure Disclosure | Threre is a heap buffer overflow vulnerability in a DCOM service that can be leveraged to achieve LPE from a Medium IL standard user to System IL. | Vulnerebility blog | SSD-DISCLOSURE |
|
11.9.26 |
Wiz achieves GovRAMP High Authorization | Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure. | Security blog | Wiz Blog |
|
11.9.26 |
What Is Agentic Cyber Defense Engineering? | Attackers can now find weaknesses faster, adapt tactics in minutes and scale campaigns without requiring extensive expertise or large networks of threat actors. Meanwhile, many security teams still rely on manual processes to execute and coordinate critical activities. The result is a widening gap between the speed of AI-powered threats and the ability of security teams to respond. | AI blog | CYMULATE |
|
11.9.26 |
New Ruxie AI power-up: Precedent engine turns repetitive alerts into faster decisions | A large portion of the daily security alert queue is made up of alerts that look almost exactly like cases our analysts have already investigated and closed. | AI blog | Expel |
|
11.9.26 |
How to build a continuous penetration testing program | Headcount is the wrong lever. More security hiring, or more bought pentest days, feeds the one stream that can't scale, so coverage barely moves even when the budget clears. | Security blog | ESCAPE.TECH |
|
11.9.26 |
How Amp got its Soc 2 Type II pentest evidence in hours | Amp is the AI hiring team for high-volume frontline employers. Restaurants, retailers, logistics operators, hospitality groups, healthcare staffing firms. Amp screens candidates against the criteria you set, books interviews on your managers' calendars, runs candidate comms, and closes offers you approve. | AI blog | ESCAPE.TECH |
|
11.9.26 |
How a Fraudulent Hire Clears Your Verification Process | The controls most companies trust to vet a candidate were built to catch mistakes and embellishments. They were not built for a well-funded adversary using a real person's identity, and sometimes a real person. | CyberCrime blog | ABNORMAL |
|
10.9.26 |
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE | Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only | Vulnerebility | The Hacker News |
|
10.9.26 |
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances | A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently | AI | The Hacker News |
|
10.9.26 |
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks | The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking | Virus | The Hacker News |
|
10.9.26 |
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, | Exploit | The Hacker News |
|
10.9.26 |
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key | Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234 , the example admin key in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. | AI | The Hacker News |
|
10.9.26 |
Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 | Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. | AI | The Hacker News |
|
10.9.26 |
U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto | The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi | Cryptocurrency | The Hacker News |
|
10.9.26 |
Attack Cases in Korea Involving the Installation of Radmin and UltraVNC | The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases that exploited Radmin and UltraVNC. Although the Initial Intrusion method remains unknown, the attackers installed Radmin—a remote control tool—and then installed UltraVNC. | APT blog | Zscaler |
|
10.9.26 |
2026 State of the Internet: The Exposure Notification Gap in ICS Devices | New Censys data reveals a major blind spot in Internet-exposed industrial control systems. | ICS blog | Censys |
|
10.9.26 |
The Anthropic Glasswing Receipts Are Starting to Trickle In | Anthropic’s Project Glasswing is approaching 5 months old, and Anthropic published its Vulnerability Disclosure Ledger on May 22nd. It hadn't received an update until this past week, when it backfilled the ledger with additional findings and updates, so naturally I thought it would be worthwhile to take a look at the receipts. | AI blog | VULNCHECK |
|
10.9.26 |
Coming to Tenable One: Claude Mythos 5 and “Adversary View” | Tenable is bringing Anthropic’s Claude Mythos 5 into our enterprise security offerings. Adding frontier adversarial reasoning to the Tenable One Exposure Management Platform will help customers better anticipate how attackers could breach their environments and stay ahead of AI-fueled risk. | AI blog | TENABLE |
|
10.9.26 |
Signing in without actually signing in | Session tokens are the skeleton keys used to hijack | Hacking blog | OKTA |
|
10.9.26 |
September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days | Microsoft’s September 2026 Patch Tuesday release addresses 974 vulnerabilities, including two actively exploited zero-days. Both zero-days are Windows elevation of privilege flaws, and both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access | SOCRadar Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database sale, an alleged Vedicline customer database sale, and a claimed Langflow 1.12.0 zero-day RCE exploit. Other posts advertised an alleged ASUS database and shell access to an Indian energy sector organization. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
SOCRadar MCP Server for ChatGPT: Setup and Use Cases | The SOCRadar Threat Intelligence MCP app connects ChatGPT to the SOCRadar MCP server over OAuth, exposing your licensed intelligence modules as callable tools. Analysts enrich indicators, check CVE exploitation, and query Dark Web exposure without leaving the conversation. | AI blog | SOCRADAR |
|
10.9.26 |
StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited | Attackers are actively exploiting an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution and persistent backdoor installation. | Exploit blog | SOCRADAR |
|
10.9.26 |
FBI Investigates Nexus Claim of 153M+ ID Records | A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. | CyberCrime blog | SOCRADAR |
|
10.9.26 |
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT | One of the most common entry points for attackers is the exploitation of public-facing edge devices (such as VPNs, routers, and firewalls). Over the years, FortiGate firewalls have remained a consistent target, as evidenced by the recent widespread FortiBleed campaign conducted jointly by the INC and Lynx ransomware groups. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
Dark Web Market: Anubis Market | Anubis Market is a multi-category Dark Web marketplace operating as a Tor hidden service, with escrow-backed trading in Bitcoin (BTC) and Monero (XMR). Its visible category strip displays more than 11,000 listings, and while narcotics account for the largest share of physical goods, its Digital section is the single biggest category on the market. | CyberCrime blog | SOCRADAR |
|
10.9.26 |
Browser-based phishing hides pages inside victims’ browsers | How attackers chain trusted business platforms together to make credential theft look like routine work | Phishing blog | BARRACUDA |
|
10.9.26 |
Browser-in-the-browser phishing campaign chains DocuSign, Adobe and Microsoft trust | How attackers abuse Microsoft OAuth redirects, Teams domains, blob URLs, and service workers to deliver phishing pages without a traditional phishing site. | Phishing blog | BARRACUDA |
|
10.9.26 |
NSA Best Practices for Cyber Hygiene recommends allowlisting, Zero Trust controls | On September 3, 2026, the NSA released new cyber hygiene best practices focused on defending against AI-enhanced threats. With cybercriminals increasingly using AI tools to boost attacks, the NSA highlighted weak authentication, unpatched systems, and misconfigurations as persistent issues attackers take advantage of. | Cyber blog | THREATLOCKER |
|
10.9.26 |
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week | Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google | Exploit | The Hacker News |
|
10.9.26 |
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA | Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to | Virus | The Hacker News |
|
9.9.26 |
Vwork: Weaponized Open-source Software as an Addon for Gigabud | How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders. | Malware blog | GROUP-IB |
|
9.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
9.9.26 |
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files | Note on withheld data: Individual victim IPs are aggregated by network block, not listed. Sensitive data incidentally exposed on unrelated third-party sites has been removed from this report and, where possible, reported to the relevant providers. This report documents attacker infrastructure and tradecraft; it is not a disclosure against any named organization. | Cryptocurrency blog | HUNT.IO |
|
9.9.26 |
Beyond Lazarus: How North Korea Organizes Its Cyber Operations | Get the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers. | APT blog | SEKOIA |
|
9.9.26 |
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress recently analyzed two attacks that started with a phishing message and then redirected victims to a browser-in-the-browser (BiTB) page (both using the same template and lure) that prompted them to download an "updated Adobe Reader" version to view files. | Phishing blog | Huntress |
|
9.9.26 |
German Manufacturer Saves 15 Minutes Per Alert | To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture. | Security blog | ANYRUN BLOG |
|
9.9.26 |
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. | AI blog | GTI |
|
9.9.26 |
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT | Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker’s task was processed separately and its result returned across accounts. In our proof of concept, ChatGPT retrieved email data from the victim’s connected Gmail account and relayed it to the attacker. | AI blog | CHECKPOINT |
|
9.9.26 |
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval | A flaw in DeepSeek Harness , DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. | AI | The Hacker News |
|
9.9.26 |
Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets | Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only | Vulnerebility | The Hacker News |
|
9.9.26 |
U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok | U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting "systematic extraction" | AI | The Hacker News |
|
9.9.26 |
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox | Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 | Vulnerebility | The Hacker News |
|
9.9.26 |
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root | cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected. | Vulnerebility | The Hacker News |
|
9.9.26 |
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans | Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, | Virus | The Hacker News |
|
9.9.26 |
Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed | The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash , is assessed to be a patch bypass | Vulnerebility | The Hacker News |
|
9.9.26 |
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution | SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. | Vulnerebility | The Hacker News |
|
9.9.26 |
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days | Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, | Vulnerebility | The Hacker News |
|
9.9.26 |
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring | Vulnerebility | The Hacker News |
|
9.9.26 |
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution | A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least | Cryptocurrency | The Hacker News |
|
9.9.26 |
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC | Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record | Cryptocurrency | The Hacker News |
|
9.9.26 |
ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account | Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to | AI | The Hacker News |
|
9.9.26 |
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours | Threat actors are continuing to leverage artificial intelligence (AI) to streamline their operations , with one financially motivated hacking group | AI | The Hacker News |
|
8.9.26 |
AI Agent 'opencode'로 미끼를 만든 김수키, GitHub PAT 기반 LNK 공격 진화 | Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve | AI blog | GENIANS |
|
8.9.26 |
Tracking BigBear 2.0 Evilginx2 Phishing Campaign | CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. | Phishing blog | CloudSEK |
|
8.9.26 |
Beyond Lazarus: How North Korea Organizes Its Cyber Operations | Get the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers. | APT blog | SEKOIA |
|
8.9.26 |
HVNC Backdoor Targets LATAM Organizations with Fake Tax Lures | Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots. | Malware blog | ANYRUN BLOG |
|
8.9.26 |
Detection and Removal of the Syslogk Rootkit in a Linux Environment | The AhnLab SEcurity intelligence Center (ASEC) continuously monitors various threats targeting Linux environments. Techniques that modify the Linux kernel to conceal malware and signs of compromise have been used for a long time, and Syslogk is one such rootkit that operates in this manner. | Malware blog | Zscaler |
|
8.9.26 |
WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls | Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. | Virus | The Hacker News |
|
8.9.26 |
FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials | A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the | Vulnerebility | The Hacker News |
|
8.9.26 |
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell | Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that | Exploit | The Hacker News |
|
8.9.26 |
BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams | Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for | Virus | The Hacker News |
|
8.9.26 |
Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing | Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal | CyberCrime | The Hacker News |
|
8.9.26 |
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution | Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a | Virus | The Hacker News |
|
8.9.26 |
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks | Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software- | CyberCrime | The Hacker News |
|
7.9.26 |
N-able N-central HF4 Patches Critical Pre-Auth RCE | N-able has released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to fix CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in its remote monitoring and management platform. The update supersedes three hotfixes issued between August 2 and September 5 and is the current security baseline for the 2026.3 branch. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-73749: HPE ArubaOS-CX RCE | HPE patched CVE-2026-73749, a critical unauthenticated Remote Code Execution (RCE) vulnerability in HPE Aruba Networking AOS-CX, also known as ArubaOS-CX. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-20212: Cisco Nexus 9000 RCE Flaw | Cisco has disclosed a critical vulnerability, CVE-2026-20212, in the Silicon One integration used by certain Nexus 9000 switches. The flaw allows an unauthenticated remote attacker who can access the affected service to execute code with root privileges. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
Elementor Pro RCE Flaw Under Active Attack | A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload files through the plugin’s Forms module. Tracked as CVE-2026-32475, the flaw could lead to remote code execution on affected sites. Wordfence reported blocked exploitation attempts beginning August 19, 2026, the same day Elementor released a fix. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet | NPS is an open-source tunneling tool, popular with the Chinese-speaking security community. | Malware blog | Censys |
|
7.9.26 |
Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials | For organizations managing hundreds or thousands of servers, System Center Operations Manager (SCOM) provides a single pane of glass into system health, performance and availability. It is deeply integrated, broadly deployed and trusted with the access it needs to do its job. | Security blog | GUIDESECURITY |
|
7.9.26 |
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts | Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic | Virus | The Hacker News |
|
7.9.26 |
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released | A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and | Vulnerebility | The Hacker News |
|
7.9.26 |
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw | Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice | Vulnerebility | The Hacker News |
|
7.9.26 |
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies | Cybersecurity researchers have unpacked JSCeal , a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. | Virus | The Hacker News |
|
7.9.26 |
N-able patches max severity N-central flaw amid ongoing attacks | N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. | Vulnerebility | BleepingComputer |
|
7.9.26 |
ChatGPT Astra is now rolling out to $20 Plus subscription | OpenAI is now rolling out ChatGPT Astra, its most powerful model to date, to those with a $20 Plus subscription, but there's no word on when free users will get access.. | AI | BleepingComputer |
|
7.9.26 |
Attackers conceal phishing lures using invisible Unicode characters | Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. | Phishing | BleepingComputer |
|
6.9.26 |
Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain | A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). | Cryptocurrency | BleepingComputer |
|
6.9.26 |
OpenAI admits it didn't disclose rogue AI wiki hijacking incident | OpenAI admits it did not disclose an incident where autonomous AI agents hijacked a German wiki, created 18,000 posts, shared answers, and bypassed restrictions, saying it treated the activity as model "misalignment" rather than a security breach. | AI | BleepingComputer |
|
6.9.26 |
IDScan sued over alleged data breach affecting 153 million drivers | Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver's licenses. | Incindent | BleepingComputer |
|
6.9.26 |
Critical Citrix NetScaler auth bypass now leveraged in attacks | Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian. | Vulnerebility | BleepingComputer |
|
6.9.26 |
Microsoft says some users can’t open the Teams desktop client | Microsoft is working to resolve a known issue that causes delays or blocks some users from opening the Microsoft Teams desktop client on Windows systems. | OS | BleepingComputer |
|
6.9.26 |
39 New Methods That Compromise Passkey Authentication | Passkeys eliminate many password-based attacks, but researchers have documented 39 methods for compromising authentication built around them. Token explains how attackers can abuse authentication prompts, synced credentials, enrollment, recovery, and other trust boundaries without breaking FIDO2 cryptography. | Security | BleepingComputer |
|
6.9.26 |
New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges | An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "FalconFlank" that lets attackers escalate privileges on up-to-date Windows systems. | Exploit | BleepingComputer |
|
6.9.26 |
Exchange Online outage causes email delays, 'Server busy' errors | Microsoft is working to resolve an ongoing Exchange Online outage that is delaying email sent to and received from external domains. | OS | BleepingComputer |
|
6.9.26 |
Google warns of new Chrome zero-day flaw exploited in attacks | Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. | Exploit | BleepingComputer |
|
6.9.26 |
French hospital fined €500,000 after breach exposes data of 727,000 | France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients' and their relatives' data. | Incindent | BleepingComputer |
|
6.9.26 |
Coder's registry infrastructure compromised to push malicious modules | Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. | Hack | BleepingComputer |
|
6.9.26 |
HPE patches critical ArubaOS-CX remote code execution flaw | Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. | Vulnerebility | BleepingComputer |
|
6.9.26 |
Microsoft: KB5120998 mouse reset bug affects only non-English PCs | Microsoft says a known issue that reverts mouse settings after installing the KB5120998 August 2026 preview update affects only non-English Windows 11 systems. | OS | BleepingComputer |
|
6.9.26 |
OpenAI confirms ChatGPT is down ahead of 'Astra' model launch | ChatGPT and Codex are experiencing a major outage, with users reporting errors across nearly every major ChatGPT feature. | AI | BleepingComputer |
|
6.9.26 |
Anthropic confirms Claude is down, multiple models affected | Claude is experiencing an outage, with users encountering elevated errors when sending requests to multiple Anthropic AI models. | AI | BleepingComputer |
|
6.9.26 |
Critical Elementor Pro flaw exploited to take over WordPress sites | A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. | Vulnerebility | BleepingComputer |
|
6.9.26 |
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication | Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full | Exploit | The Hacker News |
|
6.9.26 |
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner | Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows | Virus | The Hacker News |
|
6.9.26 |
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores | Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an | Exploit | The Hacker News |
|
6.9.26 |
Your Employee’s Password Appeared in an Infostealer Log. Now What? | Infostealers can expose far more than passwords, including authenticated sessions that may let attackers bypass MFA. Flare explains how defenders can prioritize compromised identities, determine whether stolen access is still usable, and respond before it leads to account takeover. | Virus | BleepingComputer |
|
6.9.26 |
Microsoft says KB5120998 Windows update resets desktop settings | Microsoft has confirmed that desktop settings are lost or reset on some Windows devices after installing the KB5120998 August 2026 preview update. | OS | BleepingComputer |
|
6.9.26 |
Plex warns users to patch security vulnerabilities immediately | Plex urged users this week to update their desktop clients and media servers immediately to patch multiple security vulnerabilities. | Vulnerebility | BleepingComputer |
|
6.9.26 |
Microsoft Teams, Outlook fail to launch on ARM-based Windows PCs | Microsoft is working to fix a known issue that causes crashes and launch failures for Microsoft Teams and New Outlook users after installing updates released since the August 2026 Patch Tuesday. | OS | BleepingComputer |
|
6.9.26 |
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells | Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. | Exploit | BleepingComputer |
|
6.9.26 |
WordPress backup plugin flaw exposes millions of sites to takeover attacks | An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. | Hack | BleepingComputer |
|
6.9.26 |
Hackers exploit critical JFrog Artifactory flaw to forge admin tokens | A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access. | Exploit | BleepingComputer |
|
6.9.26 |
Ransomware protection for MSPs: A 6-point checklist for faster recovery | Ransomware resilience requires more than backups or endpoint detection alone. Acronis outlines six capabilities MSPs should test across client environments, from reducing exposure and detecting attacks to preserving recovery points and restoring operations quickly. | Ransom | BleepingComputer |
|
5.9.26 |
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials | JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors | Vulnerebility | The Hacker News |
|
5.9.26 |
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code | Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could | Vulnerebility | The Hacker News |
|
5.9.26 |
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted | Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its | Incindent | The Hacker News |
|
5.9.26 |
Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel | A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-old German wiki between May and July 2026, using the site as a shared board to pool answers to a timed web task and pass around a way out of their sandbox. | AI | The Hacker News |
|
5.9.26 |
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities | Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the | Vulnerebility | The Hacker News |
|
5.9.26 |
Dropbox accounts breached through Lenovo email verification flaw | Dropbox is warning some users that an unauthorized party accessed their accounts by exploiting a flaw in Lenovo's email verification process to register fraudulent Lenovo IDs. | Incindent | BleepingComputer |
|
5.9.26 |
Microsoft Defender flags legitimate Google search links as malicious | Microsoft is investigating an issue causing the Defender for Office 365 security software to mistakenly block access to legitimate Google search links. | Security | BleepingComputer |
|
5.9.26 |
US charges Russian for infecting 80,000 freelancers with malware | A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware. | BigBrothers | BleepingComputer |
|
5.9.26 |
Sality botnet infrastructure dismantled in joint global takedown | International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. | BotNet | BleepingComputer |
|
5.9.26 |
SonicWall warns of actively exploited SMA1000 zero-day flaws | SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. | Exploit | BleepingComputer |
|
5.9.26 |
Hackers abuse Faronics Deploy admin tool to install ScreenConnect | Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. | Hack | BleepingComputer |
|
5.9.26 |
Aesto Health says data breach affects over 9.5 million patients | Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals. | Incindent | BleepingComputer |
|
5.9.26 |
Critical Langflow flaw exploited to steal OpenAI and AWS keys | Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. | Exploit | BleepingComputer |
|
5.9.26 |
Hackers push malicious Virtualizor update in BGP hijacking attack | Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers. | Hack | BleepingComputer |
|
5.9.26 |
Novocure data breach affects more than 1,400 cancer patients | Healthtech company Novocure says the data of an undisclosed number of employees and more than 1,400 U.S. cancer patients has been exposed in a mid-August cyberattack. | Incindent | BleepingComputer |
|
5.9.26 |
Why Even the Best Edge Security Still Misses High-Risk Sessions | Attackers can hide behind residential proxies, VPNs, and other infrastructure that makes malicious sessions appear legitimate to existing edge security controls. Spur explains how session enrichment adds data points that help organizations identify risky sessions and make stronger enforcement decisions. | Security | BleepingComputer |
|
5.9.26 |
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks | Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. | Hack | BleepingComputer |
|
5.9.26 |
Five Venezuelans plead guilty to ATM jackpotting attacks in US | Five Venezuelan nationals pleaded guilty to attempting to empty automated teller machines (ATMs) using malware in a series of ATM jackpotting attacks. | CyberCrime | BleepingComputer |
|
5.9.26 |
Introducing More Granular Controls for AI Bot Traffic | We’ve updated our Akamai Bot Directory to split the single AI Bots category into three distinct types: AI training crawlers, AI search crawlers, and AI fetchers and agents. | BotNet blog | AKAMAI |
|
5.9.26 |
CTEM vs BAS: The Difference and Why the Comparison Misses the Point | "CTEM vs BAS" is the wrong question. CTEM is a workflow. BAS is a product category that fits inside one stage of that workflow. The comparison peoWhat is CTEM (continuous threat exposure management)?ple actually need is BAS vs adversarial exposure validation (AEV), both of which sit inside CTEM's Validation stage. | Security blog | ETHIACK |
|
5.9.26 |
Microsoft Teams Notifications Are Now Available in Socket | Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel. | OS Blog | SOCKET.DEV |
|
5.9.26 |
Beyond Point-in-Time: Continuous Offensive Security with the Cobalt API | For enterprise security programs, the challenge was never running offensive security testing against your applications and networks. It's whether the process and results were manageable at scale and could actually drive faster remediation across every business unit and engineering team in the organization. | APT blog | COBALT |
|
5.9.26 |
Attackers exploit a Chrome flaw, update your browser now | Google has shipped a new Chrome desktop release that closes 12 security holes, and one of them was already being used in attacks before the fix arrived. Hong Kong's HKCERT, relaying Google's advisory, rates the release "Extremely High Risk" on the strength of that single bug. | Exploit blog | INTELFUSIONS |
|
5.9.26 |
Hackers quietly turn Korean PCs into proxies and VPNs | A PowerShell process on a Korean machine pulls down a zip file and unpacks a batch script that installs Radmin, a perfectly legitimate remote desktop product, into C:\Intel\RServer. Nothing in that sequence looks like malware. That is the point. | Hacking blog | INTELFUSIONS |
|
5.9.26 |
Video encoders can be rooted and no patch is coming | Taking over a QVidium Opera11 video encoder takes one web request, and there is nobody left to ship a fix. The company that built the devices has gone out of business. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
ServiceNow flaws let strangers run code on an instance | ServiceNow has fixed four security flaws in the platform many large organizations use to run their IT service desks, and its own security team scored every one of them at the top of the scale: CVSS 10.0. Three of the four can be reached by someone with no account and no password at all. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
How we could save petabytes of cache storage with Zstandard and Pingora | Memory costs are increasing dramatically. Both RAM and hard disk drive prices have exploded over the past year. At Cloudflare, we run several massively distributed storage products (including our famous CDN) that rely on making efficient use of the memory we have deployed so we can continue to serve all of our customers. | Security blog | CLOUDFLARE |
|
5.9.26 |
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models | Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? | Vulnerebility blog | CLOUDFLARE |
|
5.9.26 |
Your ATS Is Now Part of Your Attack Surface | The attack that should worry your security team most this quarter didn't start with a phishing email. It started with a job application. | Security blog | ABNORMAL |
|
5.9.26 |
How Abnormal and OpenAI are Detecting and Responding to Rogue AI in the Cloud | Abnormal AI is extending its behavioral AI engine to the cloud, using OpenAI models to detect, investigate, and respond to risky or malicious AI-agent behavior. | AI blog | ABNORMAL |
|
5.9.26 |
How Turbopack chunks your JavaScript | Open the network tab of this page and you’ll see a list of JavaScript files with seemingly random names: | Malware blog | NEXT.JS |
|
5.9.26 |
TrendAI™ Brings OpenAI's GPT Cyber Models Into the Race to Shrink Exposure Time to Zero | OpenAI’s GPT cyber models help TrendAI™ close the exposure window, from vulnerability to fix, faster than ever. | AI blog | Trend Micro |
|
5.9.26 |
Introducing Agentic Code Scanning: The Holistic Cycode System Around Any Model | TL;DR: Agentic Code Scanning is the fourth dimension of Cycode’s code scanning spectrum, not a separate product bolted on. Deterministic SAST, AI SAST, SAST + AI Exploitability, and Agentic Code Scanning run as one single system that decides what runs where, so you stop trading precision vs. cost vs. model. It caught both authorization CVEs in our benchmark that no rule engine can express, and all on an affordable open-weights model. | Security blog | CYCODE |
|
5.9.26 |
Contagious Interview steps outside the developer workflow | Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. | Vulnerebility blog | JAMF |
|
5.9.26 |
7 Best AI Penetration Testing Tools of 2026 | Compare the 7 best AI penetration testing tools of 2026. See which platforms prove exploits, reason like attackers, and run continuous testing at scale. | AI blog | NOVEE |
|
5.9.26 |
Recent Update to FAQ Regarding SAQ Eligibility Criteria Could Affect Your PCI DSS Compliance | The PCI Security Standards Council (PCI SSC) updated FAQ 1331 on its website. This FAQ governs the use of Self-Assessment Questionnaire (SAQ) eligibility criteria as a guide for determining applicability of PCI DSS requirements for Report on Compliance (ROC) assessments. | Security blog | GUIDESECURITY |
|
5.9.26 |
Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials | For organizations managing hundreds or thousands of servers, System Center Operations Manager (SCOM) provides a single pane of glass into system health, performance and availability. It is deeply integrated, broadly deployed and trusted with the access it needs to do its job. | Security blog | GUIDESECURITY |
|
5.9.26 |
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors | A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. | APT blog | RAPID7 |
|
5.9.26 |
Varonis Achieves Snowflake Premier Partner Tier and Is Now Available on Snowflake Marketplace | Building a closer partnership to make it easier to secure the data and AI that customers build, run, and analyze with Snowflake. | Malware blog | VARONIS |
|
5.9.26 |
How attackers abuse PowerShell, WMI, and LOLBins | Windows environments already contain powerful tools capable of executing commands, changing configurations, communicating across networks, and managing operating systems. For administrators, these capabilities are essential, but they also provide attackers with a clear route to breach an environment. | Security blog | THREATLOCKER |
|
5.9.26 |
PEEP: A Browser RAT Posing as a Chrome Extension | The Threat Research Unit (STRU) at SOCRadar’s Extended Threat Intelligence (XTI) platform identified and analyzed PEEP, a Chromium-based emerging post-exploitation toolkit disguised as “Smart Bookmarks.” Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values. | Malware blog | SOCRADAR |
|
5.9.26 |
SonicWall CVE-2026-83548 Leads to CISA Alert | SonicWall disclosed two actively exploited vulnerabilities in SMA1000 Series appliances: CVE-2026-83548, a pre-authentication server-side request forgery flaw, and CVE-2026-83549, a post-authentication OS command injection flaw. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
JFrog Artifactory CVE-2026-82329 Exploited | A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329, is under active exploitation, posing an immediate threat to self-managed software supply chains worldwide. Under default configurations, unauthenticated network attackers can gain full administrative control over exposed instances. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
FalconFlank: CrowdStrike Falcon 0-Day PoC | FalconFlank is an alleged privilege escalation zero-day vulnerability in CrowdStrike Falcon Sensor for Windows, published with working Proof-of-Concept (PoC) code by researcher Chaotic Eclipse. The concern: a security product running with elevated privileges may be tricked, through its own malicious-macro remediation workflow, into acting on an attacker’s behalf. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
427 or 4 Devices?: Measuring Internet-Exposed Industrial Infrastructure in the UK | On August 22, 2026, The Telegraph reported that a small UK power generator had been shut down for four days in July following a cyberattack by hackers linked to Iran. | ICS blog | FLARE.IO |
|
5.9.26 |
Someone Else Is Using Your AI | FortiCNAPP analyzes an AWS LLMjacking incident involving a leaked administrator key and unauthorized access to Amazon Bedrock. | AI blog | FORTNITE |
|
5.9.26 |
One Blank Field Bypasses Direct Send Control | This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest’s own environment. Nothing in this report should be read as a vulnerability in ReliaQuest’s systems or data. | Vulnerebility blog | RELIAQUEST |
|
5.9.26 |
H1 2026 Malware Vulnerability Trends | H1 2026 activity showed a continued adversary preference for abusing legitimate tools, trusted platforms, and routine workflows already present in enterprise and consumer environments. Threat actors used exposed software, developer tools, remote access utilities, payment workflows, and third-party services to gain access, steal credentials, move laterally, and monetize intrusions while blending into expected activity. | Malware blog | Recorded Futures |
|
5.9.26 |
How to correlate Kubernetes audit logs with container runtime data | Two fields join the Kubernetes API to what ran inside the pod, and one turns up a container escape your process events never recorded. | Security blog | ELASTIC |
|
5.9.26 |
Data access: the hidden cost of security vendor lock-in | Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and latency, and it is the part of the evaluation most teams overlook. | Security blog | ELASTIC |
|
5.9.26 |
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems | Disclosure note: Hunt.io disclosed these findings under TLP:AMBER to the relevant national CERTs for the affected jurisdictions and, following responsible disclosure, held publication until September 3, 2026. | APT blog | HUNT.IO |
|
5.9.26 |
eSentire Wins 2026 Global AI Award for AI in Cybersecurity | We're proud to announce that eSentire has won a 2026 Global AI Award in the AI in Cybersecurity category, recognizing the Atlas Platform and the Controlled Autonomy SecOps operating model behind it. | AI blog | ESENTIRE |
|
5.9.26 |
Compliance at the Speed of Regulation | For years, compliance teams built their programs around a manageable, well-known set of frameworks: PCI-DSS for payment data, HIPAA for healthcare, SOC 2 for service organizations, ISO 27001 for information security management. These frameworks were stable. Auditors knew them. Tooling was built around them. And most importantly, the list didn't change very often. | Cyber blog | PROOFPOINT |
|
5.9.26 |
Why Proofpoint Is Signing On to Collective Cyber Defense with Frontier Labs | Last week, OpenAI published an open letter calling for a global surge in cyber defense. Proofpoint is proud to stand alongside frontier labs, fellow security vendors, and global enterprises in signing it. | Cyber blog | PROOFPOINT |
|
5.9.26 |
Proofpoint Introduces SOC Analyst Agent, Powered by OpenAI Daybreak Models Through Daybreak Defense Network | Security teams don’t have a data problem. They have a prioritization problem. Alerts arrive faster than any team can review them, spread across a growing set of products, each with its own console and its own version of the truth. | Cyber blog | PROOFPOINT |
|
5.9.26 |
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help | Microsoft's August 2026 Patch Tuesday included a fix for CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The severity has a CVSS score of 8.0 from Microsoft. | Vulnerebility blog | Zscaler |
|
5.9.26 |
AI threat so great that security “takes precedence over everything except critical business operations” | OpenAI just published an open letter, co-signed by Anthropic, Google, and more than 120 other organizations, warning that the window to prepare for AI-enabled attacks is closing rapidly. | AI blog | THREATDOWN |
|
5.9.26 |
CrowdStrike Delivers the Next Evolution of the Agentic SOC | The agentic SOC provides a foundation that agents can reason over, teams of expert agents that learn each environment, and one workspace to build and govern it all, delivered on the Falcon platform. | Security blog | CROWDSTRIKE |
|
5.9.26 |
CrowdStrike Announces Agentic Identity Provider | CrowdStrike gives every AI agent a trusted identity and continuously controls their access based on real-time context, and expands modern privileged access to where work happens. | AI blog | CROWDSTRIKE |
|
5.9.26 |
Peer Pressure: Inside the Sality Botnet Disruption Operation | CrowdStrike collaborated with international law enforcement and industry partners to execute a coordinated disruption of the Sality peer-to-peer botnet. | BotNet blog | CROWDSTRIKE |
|
5.9.26 |
CrowdStrike Falcon Guardian Defines the Next Generation of AI Security | CrowdStrike’s new flagship AI detection and response solution delivers runtime protection for AI agents, introduces a new AI gateway, and extends expert-led defense. | AI blog | CROWDSTRIKE |
|
5.9.26 |
Ungentlemanly behavior: Insights into a ransomware operation | Analysis of 15 intrusions revealed tradecraft used by GOLD SHERWOOD affiliates | Ransom blog | SOPHOS |
|
5.9.26 |
Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. | APT blog | GTI | |
|
5.9.26 |
Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works | Supply chain attacks in 2026 are a major breach vector, exposing vendor dependencies and software risks that traditional security tools often miss. | Hacking blog | Cyble |
|
5.9.26 |
The NDA Was the Payload: Inside Phantom Deal, a Fake Acquisition Fraud Campaign | Attackers posed as executives, moved conversations to WhatsApp and personal email, and forged acquisition documents to set up international wire transfers. When they targeted Gen, researchers played along, exposing a wider M&A scam. | CyberCrime blog | GENDIGITAL |
|
5.9.26 |
ASCII smuggling crosses over from AI prompt injection to phishing evasion | Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them. | Phishing blog | Microsoft blog |
|
5.9.26 |
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node. | Cyber blog | Microsoft blog |
|
5.9.26 |
Counterfeit installers to system compromise: Tracking a deceptive software download campaign | An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. | Cyber blog | Microsoft blog |
|
5.9.26 |
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America | We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Corroborating recent findings from the broader threat intelligence community, we observed attackers leveraging artificial intelligence (AI) to enhance their capabilities. | AI blog | Palo Alto |
|
5.9.26 |
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation | Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransom attack. The agents breached the company's security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. | AI blog | Palo Alto |
|
5.9.26 |
Oracle HTTP & WebLogic Servers Proxy Plug-in Authentication Bypass | The SonicWall Capture Labs threat research team became aware of an unauthenticated authentication bypass vulnerability in Oracle HTTP & WebLogic Servers, assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
|
5.9.26 |
Orova: A New Linux Ransomware Targeting ESXi Hypervisors | This week, the SonicWall Capture Labs Threat Research Team identified and analyzed an emerging ransomware family known as Orova. The sample is an ELF 64-bit binary targeting Linux servers and VMware ESXi hypervisors. This target has drawn growing attention from ransomware operators due to the concentrated value of virtual machine datastores. | Ransom blog | SonicWall |
|
5.9.26 |
The story behind the intelligence | From engaging with cybercriminals to surviving a live Flamin’ Hot Cheetos taste test, Hazel reflects on the latest Beers with Talos with Azim, where they cover the full spectrum of what it takes to gather threat intel. | Cyber blog | CISCO TALOS |
|
5.9.26 |
I’ve been deepfaked: What do I do? | Don’t panic if you spot an illegally created image or video of you online – there are ways to request its removal | Cyber blog | Eset |
|
5.9.26 |
This month in security with Tony Anscombe – August 2026 edition | Details about the Hugging Face hack, critical infrastructure under attack, a spoofed in-flight Wi-Fi network, and more of this month's cybersecurity news | Cyber blog | Eset |
|
5.9.26 |
The Bug Report – August 2026 Edition | This blog will walk through the complete kill chain: an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm. | Vulnerebility blog | TRELLIX |
|
4.9.26 |
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters | Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to | Phishing | The Hacker News |
|
4.9.26 |
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution | PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the | Vulnerebility | The Hacker News |
|
4.9.26 |
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic | A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean | Virus | The Hacker News |
|
4.9.26 |
Angry Birds: Toy Ghouls’ new toys | Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger. | APT | SECURELIST |
|
4.9.26 |
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws | Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from | Vulnerebility | The Hacker News |
|
4.9.26 |
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws | Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. | Vulnerebility | The Hacker News |
|
4.9.26 |
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day | Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. | Exploit | The Hacker News |
|
4.9.26 |
GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests | OpenAI on Thursday officially unveiled GPT‑6 Astra , which it described as the "world's most intelligent and aligned model." The development comes days after the artificial intelligence (AI) company said the model had | AI | The Hacker News |
|
4.9.26 |
Recently patched PaperCut zero-days used in data theft attacks | Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks. | Exploit | BleepingComputer |
|
4.9.26 |
Cronos blockchain restarts after $74 million Tectonic exploit | The Cronos blockchain network has resumed trading activity after a price-manipulation attack on the Tectonic cryptocurrency lending platform allowed an attacker to borrow $74 million. | Cryptocurrency | BleepingComputer |
|
4.9.26 |
Microsoft warns of TerminalFix attacks deploying reverse tunnels | A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. | Security | BleepingComputer |
|
4.9.26 |
Massive Microsoft 365 outage causes auth issues, service failures | Microsoft is investigating a widespread service issue causing authentication issues, email delays and failures, and various other issues for Exchange Online customers. | OS | BleepingComputer |
|
4.9.26 |
OpenAI confirms ChatGPT outage as users report errors | ChatGPT Work is experiencing a partial outage, and users across multiple subscription plans may be unable to start or continue tasks. | AI | BleepingComputer |
|
3.9.26 |
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root | Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an | Vulnerebility | The Hacker News |
|
3.9.26 |
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory | Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. | Virus | The Hacker News |
|
3.9.26 |
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data | Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track , the court case management platform sold by | Security | The Hacker News |
|
3.9.26 |
US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries | An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has | Phishing | The Hacker News |
|
3.9.26 |
Mini Shai-Hulud's Latest Wave: 280 New Places | A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, crypto wallets, and CI/CD tools. | Cryptocurrency blog | GITGUARDIAN |
|
3.9.26 |
Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist | In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware. | BigBrother blog | CITIZENLAB |
|
3.9.26 |
Docker OIDC connections for GitHub Actions available for Docker Orgs | TL;DR: Docker now supports OpenID Connect (OIDC) for GitHub Actions. Your workflows can authenticate with short-lived, per-run tokens instead of stored PATs or OATs. No secrets to rotate, no credentials to leak. | Security blog | DOCKER |
|
3.9.26 |
Node.js: Old Technique Makes a Comeback | The trusted JavaScript runtime has featured in multiple attacks since February 2026, some linked to ransomware. In one case, attackers installed it from its official site to run an implant commanded via the Ethereum blockchain. | Hacking blog | SECURITY.COM |
|
3.9.26 |
EtherHiding: Blockchain Technology as a Cyber Weapon | In the cybercrime world, a strange cat and mouse game is continuously taking place. Cybersecurity researchers tirelessly hunt attackers' infrastructures. As soon as some of their components are discovered and brougth to light, they quickly become obsolete because of their addition on IOC's lists that strengthen cybersecurity equipments. This is why attackers must be able to constantly adapt themselves. | Hacking blog | STORMSHIELD |
|
3.9.26 |
EtherHiding Exposed: What Security Leaders Need to Know | Attackers have compromised the websites of at least 31 legitimate businesses, including e-commerce, professional services and retail logistics organizations. Visitors arriving to the compromised sites via search engine encounter a fake “Verify you’re human”. | Hacking blog | GUIDESECURITY |
|
3.9.26 |
FBI Investigates Nexus Claim of 153M+ ID Records | A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. | Incident blog | SOCRADAR |
|
3.9.26 |
Kali365 phishing kit abuses Microsoft authentication | The Kali365 phishing kit epitomizes a major shift in phishing, from stealing passwords to abusing legitimate authentication processes. | Phishing blog | BARRACUDA |
|
3.9.26 |
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action | This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is a well established kit in the Chinese community with over 267 ready-made phishing templates targeting over 54 countries worldwide. | Phishing blog | GROUP-IB |
|
3.9.26 |
eSentire Wins 5 G2 Badges in the Fall 2026 Grid® Report | We are thrilled to share that eSentire has once again been recognized with multiple badges by G2 as part of their Fall 2026 Grid® Reports! The quarterly G2 Grid® Reports provide a high-level overview of the top leaders in any given product category, based on peer-to-peer feedback from real customers and market presence (based on market share, seller size, and social impact). | Security blog | ESENTIRE |
|
3.9.26 |
REVSTEALER ramps up: analysis of up-and-coming infostealer | REVSTEALER's credential harvesting reaches 225 browser extensions and 51 crypto wallets, its gaming session theft needs no password, and its backup C2 address sits on the Polygon blockchain waiting for the primary server to fail. | Malware blog | ELASTIC |
|
3.9.26 |
Linux Detection Engineering - Fileless Execution | We reproduced five Linux fileless execution patterns with FENIX, including memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads, then mapped each to the Elastic Defend rules that catch it. | OS Blog | ELASTIC |
|
3.9.26 |
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity | Huntress is observing the same anomalous pattern across unrelated endpoints in various organizations: rogue ScreenConnect clients repeatedly spawning wscript.exe to execute 1.vbs, 2.vbs, 3.vbs, and 4.vbs. | Malware blog | Huntress |
|
3.9.26 |
Release Notes: Faster TI Investigations & 650+ Threat Updates | Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity. | Security blog | ANYRUN BLOG |
|
3.9.26 |
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks | Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According | Virus | The Hacker News |
|
3.9.26 |
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means | In early August, GitGuardian researchers found that a recent Shai-Hulud infostealer worm variant had evolved to scan for credentials across 469 | Hack | The Hacker News |
|
3.9.26 |
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone | The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware , according to new | BigBrothers | The Hacker News |
|
3.9.26 |
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon | The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new | Exploit | The Hacker News |
|
3.9.26 |
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited | Exploit | The Hacker News |
|
3.9.26 |
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs | Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the | AI | The Hacker News |
|
3.9.26 |
Counterfeit installers to system compromise: Tracking a deceptive software download campaign | Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. | Cyber blog | Microsoft blog |
|
3.9.26 |
Clop Never Left: Inside the PTC Windchill Data Theft Campaign | Patch CVE-2026-12569, but do not confuse patching with scoping. Hunt back to early June for hex-named JSP files in the Windchill codebase login directory, for flst.txt, and for the X-windchill-req header if you happen to log headers. | Cyber blog | SUCERONIX |
|
3.9.26 |
Langflow and Rails Exploitation Raises Credential Risks | Attackers are exploiting two separate critical vulnerabilities affecting Langflow and Ruby on Rails. CVE-2026-0768 allows unauthenticated attackers to execute Python code on affected Langflow deployments, while CVE-2026-66066 can expose files and application secrets through Rails Active Storage. | Vulnerebility blog | SOCRADAR |
|
3.9.26 |
Kim Sooki again? This time, it was disguised as a request for seafood ingredients | A request to review the purchase of seafood ingredients arrived. When the file is opened, a normal hwp document appears, but while the user is reviewing the contents, a malicious script runs in the background and even registers a scheduled task. | Hacking blog | AHNLAB |
|
3.9.26 |
“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing | People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship. | Malware blog | AHNLAB |
|
3.9.26 |
BlueKit PhaaS in the Wild: BitM, Geofencing, and ScreenConnect Post-Exploitation | The campaign did not stop at credential or session theft. After a BlueKit browser-in-the-middle flow, selected victims were moved into a fake document-viewer workflow that delivered a legitimate ScreenConnect client configured for an attacker-used ScreenConnect cloud instance. | Phishing blog | ZEROBEC BLOG |
|
3.9.26 |
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender | An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and | Virus | The Hacker News |
|
3.9.26 |
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code | Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git | AI | The Hacker News |
|
2.9.26 |
Your Security Vendor May Not Be Telling You the Truth About Your MTTD – Here's Why | That would be inaccurate. The robbery did not start when the security guard called 911. It started when the attacker entered the building. Those first 45 minutes matter. They are the difference between understanding the full incident and reporting only the moment it becomes visible. | Security blog | RELIAQUEST |
|
2.9.26 |
Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction | That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, more pressure on Tier 2, and higher delivery costs. | Security blog | ANYRUN BLOG |
|
2.9.26 |
Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk | August’s attacks showed how quickly trusted business activity can turn into risk. Across the US and Europe, attackers abused Microsoft 365 sessions, legitimate remote-management tools, business-themed files, and even hiring processes to reach corporate systems. | Hacking blog | ANYRUN BLOG |
|
2.9.26 |
The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT | Between late July and mid August 2026, multiple Huntress-protected organizations were hit by the same modular RAT, three of which were hit within an 85-minute window. Victims were tricked into downloading a JavaScript file that quietly pulled down an installer for a real, working Exodus crypto wallet, with the RAT hidden inside. | Cryptocurrency blog | Huntress |
|
2.9.26 |
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse | Threat actors are abusing Faronics Deploy, a legitimate endpoint management platform, to execute attacker-controlled PowerShell after phishing victims install the software. | Hacking blog | Huntress |
|
2.9.26 |
Proofpoint Sponsors the Insider Threat Matrix: Building a Common Language for Insider Risk | Today, Proofpoint is proud to sponsor the Insider Threat MatrixTM, an open, community-driven framework designed to help organizations better understand, detect, and investigate insider risk—both human and synthetic. | Cyber blog | PROOFPOINT |
|
2.9.26 |
Beyond Device Code Phishing: Preparing for the Next Wave of AI-Powered Attacks | Cybercriminals have always embraced new technologies to improve their effectiveness. Today, artificial intelligence has become another tool that can help threat actors operate faster and at greater scale. | Phishing blog | PROOFPOINT |
|
2.9.26 |
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon | A Chinese-speaking actor is now targeting Brazil. Check Point Research has uncovered a sustained campaign against Brazilian organizations, primarily government and educational institutions since mid-2025. | APT blog | CHECKPOINT |
|
2.9.26 |
Uncovering StreamRat: From Meta Ads to Full Device Takeover | ThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately 570,000 potential victims. | Malware blog | THREATFABRIC |
|
2.9.26 |
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages | A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. | APT | The Hacker News |
|
2.9.26 |
BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access | Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic | Hack | The Hacker News |
|
2.9.26 |
Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control | Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking | Virus | The Hacker News |
|
2.9.26 |
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain | SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances | Exploit | The Hacker News |
|
2.9.26 |
Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet | We used AI assistance to successfully port a remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) model to another. | ICS blog | FORESCOUT |
|
2.9.26 |
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends | Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source | Vulnerebility | The Hacker News |
|
2.9.26 |
Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands | The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. | BigBrothers | The Hacker News |
|
2.9.26 |
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another | Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one | Exploit | The Hacker News |
|
2.9.26 |
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials | Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated | Exploit | The Hacker News |
|
2.9.26 |
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads | The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as | Virus | The Hacker News |
|
2.9.26 |
Chinese Fire Ant hackers turn Cisco routers into spying platforms | The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. | APT | BleepingComputer |
|
2.9.26 |
File servers are here to stay. Here’s how to manage them securely | File servers remain a critical part of many IT environments, but managing access securely can become complex as permissions accumulate. tenfold Software outlines five best practices for simplifying file server administration and maintaining least-privilege access. | Security | BleepingComputer |
|
2.9.26 |
Berlin confirms data theft after Rhysida ransomware attack claims | Berlin's city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. | Ransom | BleepingComputer |
|
2.9.26 |
Microsoft says Windows 11 KB5120998 update resets mouse settings | Microsoft has confirmed that mouse settings are being reverted on Windows 11 systems after installing the KB5120998 August 2026 non-security preview update. | OS | BleepingComputer |
|
2.9.26 |
Nigerians extradited to US for sextortion, deaths of two teens | Two Nigerian men extradited to the U.S. on Thursday have been charged with involvement in sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina. | BigBrothers | BleepingComputer |
|
2.9.26 |
Microsoft asks users to ignore 'Antivirus is turned off' errors | Microsoft asked customers this week to ignore alerts that Defender Antivirus has been turned off after installing the latest Defender updates. | OS | BleepingComputer |
|
2.9.26 |
FulcrumSec claims Manchester Airports hack, theft of 86 GB of data | FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed. | Incindent | BleepingComputer |
|
2.9.26 |
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage | Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. | AI | BleepingComputer |
|
2.9.26 |
Chrome Web Store extensions caught stealing crypto, browser data | Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures. | Cryptocurrency | BleepingComputer |
|
2.9.26 |
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure | Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr . The vulnerability in question is CVE-2026-82329 (CVSS | Exploit | The Hacker News |
|
2.9.26 |
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems | Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze | CyberCrime | The Hacker News |
|
1.9.26 |
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds | Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into | Cryptocurrency | The Hacker News |
|
1.9.26 |
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests | The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued | Virus | The Hacker News |
|
1.9.26 |
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 | METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence | AI | The Hacker News |
|
1.9.26 |
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis | Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor | APT | The Hacker News |
|
1.9.26 |
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set | Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript. | Virus | SECURELIST |
|
1.9.26 |
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity | Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: | Exploit | The Hacker News |
|
1.9.26 |
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales | Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities | APT | The Hacker News |