BLOG 2026 SEPTEMBER 2026 2025 2024 2023
AI blog APT blog Attack blog BigBrother blog BotNet blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
2026 January(89) February(123) March(106) April(119) May(126) June(97) July(101) August(348) September(454) October(99) November(0) December(0)
DATE |
NAME |
Info |
CATEG. |
WEB |
|
30.9.26 |
OpenAI agents go rogue: AI agent governance lessons | Recently and rather quietly, there have been reports that describe an alarming case where thousands of AI agents used a dormant wiki as a coordination mechanism. On the surface, it’s a fascinating technical story. | AI blog | Barracuda Networks Blog |
|
30.9.26 |
SOCRadar Attack Surface Management Now Integrates with ArmorCode ASPM | Your team has a process for triaging vulnerabilities. The question is whether findings from your external attack surface ever reach it. An internet-facing asset carrying a critical CVE may be sitting outside the system your application security team reviews each day. | Hacking blog | SOCRADAR |
|
30.9.26 |
The 2026 U.S. Midterms Election Cyber Landscape | In late April 2026, Army General Joshua Rudd, the head of U.S. Cyber Command and the NSA, testified before the Senate Armed Services Committee that foreign adversaries would likely attempt to interfere in the upcoming midterm elections. When pressed on whether the joint Election Security Group had been stood up, he said he was not sure. | BigBrother blog | SOCRADAR |
|
30.9.26 |
Hacker-for-Hire Economy: Inside Cyber Mercenaries | Somewhere on the dark web, a threat actor is running a business with published prices, customer reviews, communication channels, and an escrow system, much like legitimate online businesses. | Hacking blog | Flare |
|
30.9.26 |
Beware of Malware infection in Facebook Ads Offering Cryptocurrency Rewards | Just because it’s a familiar tactic doesn’t mean you can let your guard down. A similar attack method using cryptocurrency rewards as bait has recently been identified again. This time, a case was confirmed in which the Node.Js-based malware JSCEAL was distributed through Facebook ads impersonating a cryptocurrency exchange. | Cryptocurrency blog | ASEC |
|
30.9.26 |
Zecurit RMM Abuse: DocuSign Phishing Campaign | ZeroBEC investigated a phishing email that impersonated a document-signing workflow and ultimately delivered the Windows agent for Zecurit, a legitimate remote monitoring and management platform. | Phishing blog | ZeroBEC |
|
30.9.26 |
Linux endpoint management without MDM via Elastic Workflows | Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Codex config onto new laptops without piling up duplicate actions on offline hosts, and it works for other config too. | OS Blog | Elastic Security Labs |
|
30.9.26 |
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | On August 31, 2026, eSentire's Threat Response Unit (TRU) detected exploitation of zero-day vulnerabilities disclosed in our security advisory, PaperCut Discloses Zero-Day Vulnerabilities (CVE-2026-82078 and CVE-2026-81578), published on September 3, 2026 affecting a customer in the Education industry. | Vulnerebility blog | eSentire |
|
30.9.26 |
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report | Ransomware is no longer defined only by how many organizations get hit. The most important shifts are happening beneath the headline victim counts; in how attackers gain access, who they target first, and how much data they steal once they’re in. | Ransom blog | Zscaler |
|
30.9.26 |
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) | NetScaler, from Citrix (now under Cloud Software Group), is an application delivery controller - some believe it qualifies to be described as a security appliance. | Vulnerebility blog | LABS WATCHTOWR |
|
30.9.26 |
Star Blizzard refines phishing and malware delivery with the RedFlick technique | Microsoft Security Blog | Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. | APT blog | Microsoft blog |
|
30.9.26 |
TOPHIT Part 2: Renting the Attack Surface | CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code. | Malware blog | CloudSEK |
|
30.9.26 |
TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2 | CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed. | Malware blog | CloudSEK |
|
30.9.26 |
MALFEX - A malicious npm postinstall no advisory has caught for fourteen months | CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months. | Malware blog | CloudSEK |
|
29.9.26 |
Browser-Based Threat Intelligence & Research | We all know the routine. You’re deep into a new threat report or a breaking blog post, and the tab management anxiety starts to kick in. You find a suspicious indicator, copy it, pivot to your internal tools to see if you’ve seen it before, paste it into a notepad, and then—maybe—try to get it into an actual investigation. | Cyber blog | Securonix SynQ |
|
29.9.26 |
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 | Citrix has released emergency security updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days already exploited in the wild. | Vulnerebility blog | SOCRADAR |
|
29.9.26 |
Metree, WuBook, SonicWall Access and Data Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Metree e-commerce database leak, an alleged WuBook customer data leak, and an alleged SonicWall-based access auction for a U.S. automotive engineering firm. Other posts advertised alleged student records from campus.gov.il and an alleged Kenyan vehicle valuation database containing more than 1.2 million records. | CyberCrime blog | SOCRADAR |
|
29.9.26 |
Citrix NetScaler Zero-Day RCE vulnerabilities: FAQ | CVE-2026-88771 and CVE-2026-88772, two zero-day vulnerabilities in Citrix NetScaler, have been confirmed as exploited in the wild. Citrix released patches on September 27, 2026. | Vulnerebility blog | TENABLE |
|
29.9.26 |
PhantomSub: Malicious npm Campaign Hits WhatsApp Users | 490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp. | Malware blog | OX SECURITY |
|
29.9.26 |
Beyond DICOM: 1,057 FHIR & 656 HL7 Systems Exposures | For a decade, everyone hunting exposed healthcare infrastructure has looked at the same protocol: DICOM. Open PACS servers spilling X-rays onto the public internet make for a good headline, and the research has been thorough. | Incident blog | Flare |
|
29.9.26 |
Aviation Infrastructure DNS Exposure: A Sector-Wide Look | An airport is a large industrial facility that has runways. It runs flight information displays, credential and badging platforms, baggage handling, airfield lighting, fuel farms, parking revenue control, weather observing, license plate recognition, stormwater monitoring, and building automation. Most aviation cybersecurity research has focused on radio protocols, rather than external measurement of that landslide layer. | Hacking blog | Flare |
|
29.9.26 |
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability | The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second incident, the attacker ran a scanner tool to search for additional Attack Targets. | Vulnerebility blog | ASEC |
|
29.9.26 |
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix | Attackers are abusing ChatGPT Custom GPTs to impersonate legitimate product offerings, then directing victims to a malicious "backup" site through a trusted ChatGPT-hosted interface. Huntress researchers found two Custom GPTs linked to the same campaign that were being used in this manner. | AI blog | Huntress |
|
29.9.26 |
Phishing incident response with Elastic and Sublime Security | The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response can tie a quarantined email to what happens next on the endpoint and pull the threat from every mailbox it reached. | Phishing blog | Elastic Security Labs |
|
29.9.26 |
Russian and Allied Government Systems Compromised in Targeted Campaigns | Three exposed operator workspaces reveal confirmed access to Russian and Kyrgyz government systems, a Syrian Customs C2 inventory, stolen data and wider targeting of Russian state and industrial organisations. | APT blog | Ctrl-Alt-Intel |
|
29.9.26 |
Attackers Target Ledger Users Via Google Ads | In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes. | Cryptocurrency blog | ThreatLabz |
|
27.9.26 |
A stalker in the box: infrastructure linking PandorahVNC and Mesh Central | Hidden Virtual Network Computing (HVNC) is a sophisticated form of remote access designed for stealthy control over an infected system. Unlike traditional VNC tools, HVNC operates covertly, ensuring that the infected user’s desktop environment remains unchanged and unsuspecting while the attacker manipulates a hidden desktop session. | Malware blog | INTRINSEC |
|
27.9.26 |
Inside Corp MDM, the Android spyware targeting logistics companies | A malware campaign targeting the logistics sector used fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file disguised as a system service. The delivered app, package com.corp.mdm, is a compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service. | Malware blog | Have I Been Squatted |
|
27.9.26 |
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. | Exploit blog | GTI |
|
27.9.26 |
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites | This blog post is about a Cross-Site Request Forgery vulnerability in the Elementor Website Builder plugin. One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an administrator clicking the link creates a second administrator account for the attacker. | Vulnerebility blog | Patchstack |
|
26.9.26 |
See No EvilTokens: Disrupting the EvilTokens PhaaS Platform | EvilTokens – a top PhaaS platform that first commoditized the device code phishing technique – was disrupted through a collaborative public-private partnership led by Microsoft. | Phishing blog | SPYCLOUD |
|
26.9.26 |
How Aikido finds more vulnerabilities than Claude Security with Mythos at half the cost | Claude Mythos is arguably the strongest cybersecurity model that Anthropic has built. But we know that model capability is only part of what determines how well an AI vulnerability product performs. | AI blog | AIKIDO.DEV |
|
26.9.26 |
Could OpenClaw have actually hacked that Australian gym? We decided to test it. | Earlier this month, Australian journalists reported on an OpenClaw AI assistant hacking into a gym website in what was described as the “first known Australian autonomous cyber attack”. Reportedly, in response to benign requests for assistance booking gym sessions, the AI agent identified vulnerabilities in the gym booking system to book classes months in advance and kick another gymgoer off a waitlist to advance the user’s position. | AI blog | AIKIDO.DEV |
|
26.9.26 |
MemTensor npm and PyPI Packages Hit by a Go Worm - Real-time Open Source Software Supply Chain Security | On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs in the background each time the package loads. | Hacking blog | SAFEDEP.IO |
|
26.9.26 |
Mini Shai-Hulud Is Still Infecting GitHub Repositories - Real-time Open Source Software Supply Chain Security | The May 2026 Mini Shai-Hulud worm is still infecting new GitHub repositories. The payload is byte-identical to the May build. | Hacking blog | SAFEDEP.IO |
|
26.9.26 |
H1 Trends in the Phishing Landscape Targeting the Financial Sector | Netcraft identified almost 40,000 unique phishing URLs relevant to the US financial services sector in H1 2026. This field of view includes attacks using 645 distinct hosting providers and 576 distinct domain registrars. Data within this time period shows the wind down of a Darcula campaign targeting Fidelity, with a 7x drop from Q1 to Q2. Additionally, the data shows a continued trend toward abuse of cloud platforms and free hosting services for phishing infrastructure targeting this sector. | Phishing blog | NETCRAFT |
|
26.9.26 |
Slovenian .SI Domain Registrations Outpace .AI | Registrations of Slovenian .si domains overtook .ai in the 25 hours after President Trump told the UN General Assembly on September 22 that the U.S. would call AI “super intelligence” (SI). | AI blog | NETCRAFT |
|
26.9.26 |
MCP Config Poisoning: Text file to RCE | Attackers can weaponize your AI agent tooling just by sneaking a text file into the right place on your system, putting developers and other users at risk. Learn how this works and how to protect yourself and your organization. | Vulnerebility blog | Checkmarx Zero |
|
26.9.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | WordPress 7.1.1 fixes CVE-2026-93485, an unauthenticated stored XSS in wpautop(). The fix was backported to every supported branch from 4.7 onward, so a site below its own branch's patched version is still affected. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
Brevo delivered ClickFix through its own infrastructure | Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered the attack to customer sites. | Hacking blog | ADAMNET |
|
26.9.26 |
Securing what your Bedrock AgentCore agents actually do | An AI agent is software that can act on your behalf. It may read documents, emails, and web pages, then use the systems you connected to complete a task. | AI blog | Cato Networks |
|
26.9.26 |
2026 LATAM Crypto Adoption: Latin America Grew 9.8% | Latin America bucked the bear market. The region’s crypto economy saw $593.8 billion in activity, with an overall growth of 9.8%. This growth points to sustained demand for crypto, even in a year when global markets faced headwinds. | Cryptocurrency blog | Chainalysis |
|
26.9.26 |
2026 Global Crypto Adoption Index: Brazil Ranks No. 1 - | Crypto economy overcame worst market since 2022: Even as crypto’s total market cap fell about 50% (a $2.1 trillion contraction), on-chain economic activity slipped just 1.6%, from $9.5 trillion to $9.4 trillion. A growing diversity of use cases, not price speculation, kept the economy steady. | Cryptocurrency blog | Chainalysis |
|
26.9.26 |
Apple Internals: Endpoint Security ships in iOS 27.2 beta | While doing my usual ipsw diffing for the community, I compared iOS 27.0 (24A437) against the 27.2 beta (24B5084k) and found a new KEXT (kernel extension): com.apple.iokit.EndpointSecuritySE. That is Endpoint Security (ES), the framework endpoint-detection-and-response (EDR) vendors build on for macOS. Apple documents the public API here. Does this mean antivirus is coming to iOS? | OS Blog | Calif |
|
26.9.26 |
PCI DSS Gap: Relying on SAQ A Changes Exposes E-commerce | Cyberattacks targeting e-commerce payment flows continue to escalate, exposing a critical flaw in how online retailers manage client-side security. Ongoing Magecart campaigns are abusing dynamic hosting, ranging from decentralized blockchain infrastructure to trusted third-party platforms, to inject stealthy skimming code across payment networks. | Vulnerebility blog | JSCRAMBLE |
|
26.9.26 |
How Automated Moving Target Defense Stops Attacks Before Execution | Automated Moving Target Defense (AMTD) is a prevention-first security technology that constantly morphs the runtime memory environment so attackers cannot find or exploit their targets. | Security blog | Morphisec Blog |
|
26.9.26 |
The Major Shift in Security Vulnerability Management | Security vulnerabilities use a numbering system called CVE (Common Vulnerabilities and Exposures). The CVE number itself is an identifier that distinguishes vulnerabilities. For example, a number like 'CVE-2026-12345' refers to the exact same vulnerability anywhere in the world. | Vulnerebility blog | Enki White Hat |
|
26.9.26 |
Enumerating Users and MFA via Microsoft's Password Reset Portal | Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature designed to let users recover their accounts without calling the helpdesk. As it turns out, it also tells you quite a lot about the accounts in a tenant — whether they exist, what authentication methods they have registered, and in some cases, which ones are likely administrators. This post covers what the portal leaks, why it matters from both sides, and what defenders can do about it. | Security blog | LEVELBLUE |
|
26.9.26 |
BengalSEO Part 1: Anatomy of the Operation - The DFIR Report | In March 2026, a widespread SEO Poisoning campaign leading to malware deployment and tech support scams was identified by the DFIR Report. | Cyber blog | THEDFIRREPORT |
|
26.9.26 |
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud | Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud. | Hacking blog | Socket |
|
26.9.26 |
When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group | Strengthen your readiness against Silent Ransom Group. As SRG increasingly uses IT impersonation and legitimate remote-access tools to target law firms, firms should review how they verify support interactions, protect sensitive client data and detect suspicious activity. | Ransom blog | SYGNIA |
|
26.9.26 |
AI Agents Are Hacking Online Retailers for $25 a Company | A financially motivated operator is running three open source AI harnesses against hundreds of online retailers, almost entirely unattended. More than 600,000 credit card records have been taken, and in one case the agent's own cleanup routine destroyed the victim's data. | AI blog | GAMBIT SECURITY |
|
26.9.26 |
A spy trojan swaps zero-days for a plain phishing email | The link in the email pointed at an image file. The web server sent back a program. What arrived on two separate customer networks was a one megabyte Windows executable named image.pif, and in both cases somebody double clicked it. | Exploit blog | IntelFusions |
|
26.9.26 |
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers | On September 4, 2026, Oren Yomtov, a security researcher from Accomplish, responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program. Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised. | Vulnerebility blog | Cloudflare Blog |
|
26.9.26 |
Hacking OpenAI | On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. | AI blog | Hacktron AI |
|
26.9.26 |
CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack | CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. Exploitation requires network access to a virtual server configured with an APM access policy and an OAuth profile, with APM operating as an OAuth Authorization Server. | Vulnerebility blog | PICUSSECURITY |
|
26.9.26 |
AI-Enabled Cyber Attacks: What They Are and How to Defend Against Them | AI-enabled cyber attacks are malicious operations in which adversaries use AI, most often large language models (LLMs), to plan, carry out, or scale any part of an attack. | AI blog | PICUSSECURITY |
|
26.9.26 |
MSP Approaches Compliance Architecture | Compliance is evolving beyond checklists. Learn how security enclaves, validated cryptography, and boundary ownership can simplify audits and reduce risk. | Security blog | WatchGuard Blog |
|
26.9.26 |
HTTPS Content Inspection Firebox | Encrypted traffic is good for security and privacy. But for security teams, it can also create a visibility gap. | Hacking blog | WatchGuard Blog |
|
26.9.26 |
The OpenSourceMalware Show #22 | ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group’s escalating public feud with ransomware crew Cl0p. | Cyber blog | OpenSource Malware Blog |
|
26.9.26 |
Prompt Forcing: The Scarier Sibling of Prompt Injection | We showed how we leveraged extensions with very basic permissions to attack internal agents in 5 different browsers: Perplexity Comet, Gemini Live in Chrome, Edge Actions, Opera Neon, and Claude in Chrome. | Hacking blog | Forever Security |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE | Back in early August 2026, I was 0-day bug hunting in Cisco Smart Software Manager (CSSM). This was where I came across a post-auth RCE vulnerability. This vulnerability, located in the nginx certificate upload, involved command injection via TLS certificates. Unfortunately, a week before I finished the report, the vulnerability was silently patched in their 10-202608 upgrade uploaded on 10 Aug 2026. This short blog will detail the exploit, along with how it got patched. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS.IO |
|
26.9.26 |
Shopware fixes Store API vulnerability allowing administrator takeover | A Shopware vulnerability can lead to administrator takeover and remote code execution. Shopware merchants should install the security update now. | Vulnerebility blog | Sansec |
|
26.9.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update. | Exploit blog | greynoise.io |
|
26.9.26 |
Redundant by Design: Dissecting a Multi-RAT Phishing Campaign Targeting Canadian Businesses | Blackpoint’s Adversary Pursuit Group (APG) identified a phishing campaign targeting Canadian organizations that used a single delivery framework to deploy DCRat, Violet RAT, PureRAT, and AnyDesk. | Malware blog | Blackpoint Cyber |
|
26.9.26 |
RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser Theft | Blackpoint’s Adversary Pursuit Group (APG) identified two previously undocumented .NET malware components delivered together through a ClickFix chain: RemotePanel, a persistent remote access platform, and BoundSiphon, a credential and cryptocurrency stealer. | Hacking blog | Blackpoint Cyber |
|
26.9.26 |
ORAX Conducts AiTM Without a Reverse Proxy | ORAX is a phishing-as-a-service (PhaaS) platform that uses WebSockets and live session control to capture MFA-authenticated Google Workspace sessions. | Phishing blog | Abnormal AI |
|
26.9.26 |
Threat Intelligence Gives Security Data Meaning | Security teams have no shortage of threat data. They continuously consume feeds from commercial providers, open-source repositories, information-sharing communities and vendors across the cybersecurity ecosystem. The harder problem is determining which signals matter, what they reveal and what action to take next. | Cryptocurrency blog | R136a1.dev |
|
26.9.26 |
SLEEPWALKER: A Passive Backdoor With Its Own Command Language | Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive. Unable to hunt for interesting new malware, I stopped adding to my “TODO” pile and finally worked through my backlog from last year. That led to a detailed examination of BeheMOF as well as the discovery of this malware. | Malware blog | LUMEN |
|
26.9.26 |
Upcoming Next.js September Security Release | Next.js is preparing a scheduled security release for September 30, 2026. This advance notice gives teams time to plan upgrades before patches are published. | Vulnerebility blog | Next.js |
|
26.9.26 |
AI-augmented, still human-led: What changed in the 2026 Gartner Market Guide for Managed Detection and Response | Gartner named Expel a Representative Vendor for the eighth consecutive time in the 2026 Gartner® Market Guide for Managed Detection and Response. | AI blog | Expel |
|
26.9.26 |
"Are we secure against AI agents?" is a question we couldn't answer well | | “Are we secure against AI agents?” can’t be answered as asked. It bundles ten different problems—with ten different owners—and no shared vocabulary to separate them. | AI blog | Expel |
|
26.9.26 |
AI-Accelerated Defense: Build a Continuous Security Loop | That does not mean buying AI for the sake of AI. It means applying AI to the work that slows security teams down today: translating threat signals into validated exposure, deciding what matters, changing controls and proving the result. | AI blog | CYMULATE |
|
26.9.26 |
Why AI Defenders Can't Afford to Slow Down | The AI Frontier pacing argument assumes enterprise risk comes from frontier models being too powerful or misaligned. But that argument assumes that if labs build safer models, enterprises will be safer. That's not exactly how it works. AI frontier labs can slow down, but defenders can’t afford to. | AI blog | TrendAI |
|
26.9.26 |
When Trust in AI Becomes an Attack Surface: Analyzing Prompt Injection, Model Theft, and Pipeline Poisoning | Our analysis shows how AI attacks are moving beyond malicious prompts into the tools, models, and pipelines organizations already trust, and the controls organizations can put in place to reduce their exposure. | Hacking blog | TrendAI |
|
26.9.26 |
Voice Callers Exploit BYOD to Access Corporate Data | In a story recently reported by Dark Reading, threat actors are calling and texting employees on personal mobile devices, impersonating IT help desks and directing them to phishing pages designed to steal Microsoft 365 credentials and authentication tokens. By targeting unmanaged BYOD devices, attackers can bypass many corporate security controls and use compromised identities to access and exfiltrate sensitive data from services including SharePoint, OneDrive, and Exchange. | Security blog | ZIMPERIUM |
|
26.9.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
26.9.26 |
The New Engineering Problem: Managing What AI Decides to Import | AI makes it faster to turn an idea into working software. A developer describes a feature, integration, or service and receives an implementation in minutes. Coding agents go further by editing files, running tests, troubleshooting failures, and preparing changes for review. | AI blog | SONATYPE |
|
26.9.26 |
GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign | CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. | Malware blog | CloudSEK |
|
26.9.26 |
Serverless, Not Riskless: Exploiting Unauthenticated API Gateways in AWS | TL;DR – Unauthenticated Amazon Web Services Application Programming Interface (AWS API) Gateway endpoints backed by over-permissioned Lambda functions create a repeatable attack chain from a single HTTP request to credential extraction with no AWS credentials required. | Exploit blog | GUIDESECURITY |
|
26.9.26 |
Securing GenAI in the Real World | Generative AI (GenAI) projects often start small and move fast, with clients moving from initial testing to production and deployment as promising outcomes emerge. Along the way, the business value grows, but so can security risks, especially when sensitive data and high-impact workflows begin to rely on AI model decisions. | AI blog | GUIDESECURITY |
|
26.9.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
26.9.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. Security teams today face evolving challenges, requiring them to continuously refine monitoring channels, adjust operational strategies, and foster cross-functional internal collaboration to capture actionable intelligence. | CyberCrime blog | RAPID7 |
|
26.9.26 |
New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. Success going forward can’t be about patching as much as possible - it has to be about understanding what matters most and reducing the exposures attackers can actually reach. | Cyber blog | RAPID7 |
|
26.9.26 |
The roqueue-tools DevFlow campaign: 2 fake project-flow extensions that fetch JavaScript from a DuckDNS host and run it | Two project-flow extensions sit quietly for five minutes after you open your editor. The Kanban board renders, the webview loads, everything looks like a normal project-management tool. Then, once the IDE has settled and the developer has moved on to something else, a setTimeout fires. The extension reaches out to a free DuckDNS subdomain over plain HTTP, grabs a JavaScript file, and runs it with new Function. | CyberCrime blog | Yeeth Security |
|
26.9.26 |
The SadiqShuaibu campaign: 6 fake npm dependency checkers that embed a GitHub token and run remote code | Checking npm package versions is one of the most common things a developer extension does. On August 18, 2026, six of them showed up from one publisher — SadiqShuaibu — in under 100 minutes: sadiq-dep-checker, sadiq-dep-lens, sadiq-dep-helper, sadiq-dep-tool, sadiq-npm-updater, and pkg-outdated-check. They all work. The commands fire, the npm registry responds, the versions render in the panel. | CyberCrime blog | Yeeth Security |
|
26.9.26 |
SleepyDuck Returns: 2 fake Solidity Open VSX extensions hide a backdoor in an MP | In November 2025, we analyzed a small backdoor loose on Open VSX. SleepyDuck was unremarkable in every way but one: its header was an ASCII-art duck, and its C2 was a Solana smart contract the loader polled for tasking. It was a JavaScript file, a few kilobytes, executing fetched code in memory — a toy with a mascot. | Malware blog | Yeeth Security |
|
26.9.26 |
Meet AvisLoader: A Windows Loader Built to Outlast a Takedown | Varonis Threat Labs discovered AvisLoader, a new Windows malware loader built to keep its command-and-control (C2) channel beyond the reach of traditional domain takedowns. | Malware blog | VARONIS |
|
26.9.26 |
SalesBleed: 0-Click Data Exfiltration in Agentforce | We found a way to pull sensitive account data out of Salesforce Agentforce without ever logging in, or requiring the victim to click anything. The entry point was a public Web-to-Lead form, the exit was a DNS query. We call it SalesBleed. | Exploit blog | Zenity Labs |
|
26.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | At ReliaQuest, we believe that threat intelligence delivers the most value when it provides holistic context that drives action across security operations. In 2025, the fastest data exfiltration time we observed was just six minutes, down from over four hours the previous year. To keep up, security leaders must go beyond just collecting intelligence and use it to power automated action across detection, containment, investigation, and response. | Security blog | RELIQUEST |
|
26.9.26 |
Beyond Point-in-Time Testing: 5 Use Cases for Agentic Red Teaming | Attackers have automated their attacks and are moving at machine speed. Defenders need to do the same to test their defenses against these automated, agentic AI attacks. That is why agentic red teaming and continuous attack path mapping are becoming increasingly important. | AI blog | RELIQUEST |
|
26.9.26 |
Phishing Risk Across 5 Key US Industries: 2026 Data | According to fresh ANY.RUN data, phishing exposure remains above 70% in several critical industries. This doesn’t happen because organizations aren’t protected enough. Companies have been implementing email filtering, MFA, and phishing-awareness training for years. | Phishing blog | ANYRUN BLOG |
|
26.9.26 |
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint | Huntress recently observed a threat actor doing something unique post-compromise: instead of simply dropping a miner, they compiled one directly on the victim endpoint, tailoring the payload while generating unusually conspicuous EDR telemetry. | Cryptocurrency blog | Huntress |
|
26.9.26 |
The Psychedelic Stealer: When a CAPTCHA Becomes an Installer | Arctic Wolf Labs is tracking a fake Cloudflare CAPTCHA campaign delivering Psychedelic Stealer, malware which steals browser passwords, account tokens, and wallet data. | Malware blog | Arctic Wolf |
|
26.9.26 |
Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts | Proofpoint researchers identified an active TeamFiltration campaign - tracked as UNK_CondorFiltration, that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing intensively on Chilean organizations. | Exploit blog | PROOFPOINT |
|
26.9.26 |
CARBONATO: a botnet built around an AI agent | ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity. | BotNet blog | ThreatDown |
|
26.9.26 |
No One Gets Phished: The New Group-IB Browser Agent Applies Predictive Intelligence At The Click | One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and the targeted password is already being reset. The new Group-IB Browser Agent brings the corporate browser under XDR coverage, checking every page against predictive Threat Intelligence in real time. | Security blog | GROUP-IB |
|
26.9.26 |
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure | The landscape of software supply chain security has undergone a significant shift. Recent campaigns demonstrate that sophisticated threat actors are systematically targeting the engineering lifecycle by compromising trusted security and programming tools. | Security blog | GTI |
|
26.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
26.9.26 |
Telecom Attack Surface: SS7, BGP & Nation-State Intrusions | SS7 and BGP were built on trust. Here's how nation-state actors exploit that trust, and telecom routers, to stay inside carrier networks for years. | Hacking blog | GENDIGITAL |
|
26.9.26 |
Is Your Home Internet Feeding the AI Data Race? | Residential proxy providers sell household IP access for AI data collection, but many users do not understand what that access involves. | AI blog | GENDIGITAL |
|
26.9.26 |
Unmasking EvilTokens: Getting to the root of device code phishing | Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI capabilities for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets. This AI-powered cybercrime platform facilitated sophisticated business email compromise (BEC) campaigns that compromised more than 12,000 inboxes in over 10,000 organizations worldwide. | Phishing blog | Microsoft blog |
|
26.9.26 |
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments | Microsoft Security Blog | Activity associated with Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, illustrates how tracking and responding to ransomware attacks by payload alone can obscure the affiliates carrying out intrusions and the recurring behaviors that defenders can use to detect and disrupt them. | Ransom blog | Microsoft blog |
|
26.9.26 |
A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity | Unit 42 researchers have identified an issue where using default configurations in Amazon Web Services (AWS) AgentCore Harness could allow attackers to steer an agent's actions through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity. | Security blog | Palo Alto |
|
26.9.26 |
Inside the Modern SOC: Defending the Cross-Environment Pivot | Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools. | Security blog | Palo Alto |
|
26.9.26 |
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies | This article explores how AWS mitigates the security risks associated with publicly exposed Identity and Access Management (IAM) access keys through its AWSCompromisedKeyQuarantine managed policy. We discuss the evolution of the different versions of this AWS managed policy. We also show how the managed policy AWSCompromisedKeyQuarantine evolved over time to protect organizations by relating it directly to new cloud attacks against AWS environments. | Security blog | Palo Alto |
|
26.9.26 |
Introducing CAIRN: Frontier tracking for AI-integrated malware | Talos is releasing CAIRN, a research toolkit for hunting, classifying, and tracking emerging AI-integrated malware. | AI blog | CISCO TALOS |
|
26.9.26 |
Trust and the enticing consultancy offer | In this week’s newsletter Martin muses over a very suspicious elicitation over social media and the true value of trust within the cyber ecosystem. Hubris might be the real vulnerability that the cyber industry must worry about. | Vulnerebility blog | CISCO TALOS |
|
26.9.26 |
The Closed Quorum: Inside the first reported autonomous AI C2 implant | CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement. | AI blog | CISCO TALOS |
|
26.9.26 |
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use | Ransomware incidents in Japan rose 4.7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion represented 80% of victims. | Ransom blog | CISCO TALOS |
|
26.9.26 |
Should you care about an “AI slowdown?” | In this week's Threat Source, David talks about why focusing on your security basics is still your best bet, even in a world with rapid AI advancements. | AI blog | CISCO TALOS |
|
26.9.26 |
Been told to pay at a Bitcoin ATM? Read this first | Crypto ATM scams often follow a predictable script – here’s how to recognize it and what to do if you’ve already been caught out | Cryptocurrency blog | Eset |
|
26.9.26 |
Looking for free Robux? Here’s what’s real, and what’s a scam | Fake giveaways, free Robux generators and lookalike login pages all target the same thing – your Roblox account | Spam blog | Eset |
|
26.9.26 |
The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive | As AI opens new paths to company data while making familiar attacks faster and cheaper, SMBs need protection designed around the time and expertise available to operate it | AI blog | Eset |
|
26.9.26 |
‘Nudify’ apps: What to do if someone makes a fake nude of you | Whether you’re a victim, the parent of a victim, or just concerned, here’s what you can do about fake nude images | Cyber blog | Eset |
|
26.9.26 |
Dark Web Roast - August 2026 Edition | Blog - Dark Web Roast August 2026 Edition. | Cyber blog | TRELLIX |
|
26.9.26 |
When the Directory Becomes the Weapon: Understanding NTDS.dit Theft | This blog focuses on a critical defense shift: moving from signature-based detection to a technique-driven approach that identifies malicious behavior regardless of the specific toolkit utilized. | Security blog | TRELLIX |
|
24.9.26 |
Exposed Medical Image Consoles: 40% Lack Passwords | To reach a hospital’s medical images the hard way, you need a DICOM (Digital Imaging and Communications in Medicine) client and some knowledge of a protocol designed in the 1980s for machines that were never supposed to face the internet. To reach a growing number of them the easy way, you can open a web browser and type an address. | Security blog | FLARE.IO |
|
24.9.26 |
Detecting shadow AI agents with advanced posture checks | Okta recently introduced advanced posture checks within the Okta Verify client for macOS and Windows. This feature leverages osquery, a lightweight endpoint agent, which can run a SQL query at the point of log in to detect critical device data — launchd services, file paths, running processes, package managers, listening ports, installed apps, and container artifacts — that collectively provide a device assurance signal at sign-in time. | AI blog | OKTA |
|
24.9.26 |
Signing in without actually signing in | The price of AI tokens and subscriptions is increasing as AI model providers seek to recoup investment costs. As a result, these accounts are becoming more valuable targets for account takeover. Stopping this is paramount for enterprises. AI theft increases token bills. | AI blog | OKTA |
|
24.9.26 |
RemControl: AI Built the Overlays. Victims Lose their PINs | Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI. | Malware blog | GROUP-IB |
|
24.9.26 |
Proofpoint named a Pace Setter as of September 2026 in the Gartner Emerging Market Quadrant for AI Application Security — Established Vendors | As organizations rapidly adopt AI assistants and autonomous AI agents, the challenge is no longer simply protecting AI models—it is governing how AI interacts with employees, enterprise data, and business systems. We believe this recognition reflects the growing importance of securing AI across the entire enterprise. | AI blog | PROOFPOINT |
|
24.9.26 |
CVE-2026-76461 | Learn about CVE-2026-76461, an actively exploited Cisco Secure Email Gateway vulnerability that enables unauthenticated remote code execution and full system compromise through a malicious email. | Vulnerebility blog | Arctic Wolf |
|
24.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | In sports, a great defense must understand the offense. It is no different in security operations. It is not enough to just know threat intelligence—it needs to be acted on. Forrester recognizes ReliaQuest in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, where ReliaQuest was named a Strong Performer. | Security blog | RELIQUEST |
|
24.9.26 |
CVE-2026-87902 in WordPress Enables Conditional RCE | Security updates released for WordPress address CVE-2026-87902, a severe unauthenticated path traversal flaw within its page-template resolution mechanism. The weakness allows the CMS to load arbitrary readable PHP files outside designated theme directories, potentially resulting in Remote Code Execution (RCE) under tailored server and theme setups. | Vulnerebility blog | SOCRADAR |
|
24.9.26 |
sckit: A New Go Implant Framework for Supply Chain Worms - Real-time Open Source Software Supply Chain Security | sckit, also known as the “supplychain.local worm”, is a Go implant framework that we found in two MemTensor packages on September 23, 2026. It runs on Linux, macOS, and Windows. It collects credentials from developer machines and from CI jobs. It receives signed tasks from a command and control (C2) server. | Malware blog | SAFEDEP.IO |
|
23.9.26 |
Email Threat Protection Across Messages, Identities and Accounts | Email threat protection is about preventing, detecting, and responding to attacks that reach people through email or use email as the first step in a larger attack. This includes phishing, business email compromise (BEC), malware, account takeover (ATO), supplier fraud, internal threats, and data loss. The work spans message analysis, authentication, behavioral detection, user reporting, and remediation. | Security blog | PROOFPOINT |
|
23.9.26 |
Operationalizing Security for the Agentic Era: Introducing Semantic Business Policies and Agentic Insights | Today at Protect 2026, Proofpoint is introducing Semantic Business Policies and Agentic Insights, two new capabilities that together deliver a continuous governance lifecycle for AI, connecting policy definition, runtime enforcement, and autonomous risk discovery into a single platform. No other vendor offers this today. | Security blog | PROOFPOINT |
|
23.9.26 |
Stopping Attacks Before They Reach the Inbox: Introducing the Proofpoint Agentic Collaboration Security System | At Protect 2026 in San Diego today, we introduced the Proofpoint Agentic Collaboration Security system. It is a single system that brings together intent-based detection, agentic investigation, and user risk agents to protect how people communicate and collaborate. | Security blog | PROOFPOINT |
|
23.9.26 |
Introducing Proofpoint Advanced Browser Protection: The First Unified Defense Across Email and the Browser | Email remains a primary delivery vector for cyberattacks, but it has also become one of the most heavily defended. As organizations continuously shore up their email defenses, attackers have begun shifting more attacks into the browser, where they can weaponize links after delivery, hide malicious content behind trusted authentication workflows, abuse OAuth permissions, hijack sessions, steal credentials, and use malicious browser extensions to evade defenses. | Security blog | PROOFPOINT |
|
23.9.26 |
Announcing the Next Evolution of Proofpoint Cyber Defense | The most dangerous attacks today don’t come from strangers. They come from real accounts, in familiar threads, asking for exactly the kind of thing those accounts normally ask for. | Cyber blog | PROOFPOINT |
|
23.9.26 |
In Cybersecurity, Behavior is a Signal. Intent is the Full Story. | For most of cybersecurity’s history, we built defenses around a simple assumption: people use technology, and technology follows their direction. | Cyber blog | PROOFPOINT |
|
23.9.26 |
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer | Huntress spotted the DarkMe malware in two separate incidents affecting different organizations on August 31, 2026. | Malware blog | Huntress |
|
23.9.26 |
The Tale of Two INC Ransom Notes: A Ransomware Timeline | In late August, the Huntress agent was installed on an organization after an incident involving the INC ransomware. Typically, this would limit our visibility into certain aspects of the attack, such as the initial access vector – however, even with the lack of extended telemetry, Huntress analysts were able to piece together significant information regarding the overall attack. | Ransom blog | Huntress |
|
23.9.26 |
CSuite Hits US and EU: Phishing and M365 Session Theft | ANY.RUN researchers investigated CSuite, a phishing and remote-access operation that combines credential theft, Microsoft 365 session hijacking, and the abuse of legitimate management tools. The campaign showed a strong US focus, with 60% of identified victim organizations based in the United States. | Phishing blog | ANYRUN BLOG |
|
23.9.26 |
The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | In sports, a great defense must understand the offense. It is no different in security operations. It is not enough to just know threat intelligence—it needs to be acted on. Forrester recognizes ReliaQuest in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, where ReliaQuest was named a Strong Performer. | Cyber blog | RELIQUEST |
|
23.9.26 |
Virtualizor: The Login Parameter That Skips the Login | Today VulnCheck's Initial Access Intelligence team is detailing an unauthenticated remote root code execution in Virtualizor, Softaculous' commercial VPS and hypervisor control panel. It provisions and manages KVM/OpenVZ/LXC guests, so its web layer runs as root, which is exactly why a web bug here ends at uid=0 instead of www-data. | Vulnerebility blog | VULNCHECK |
|
23.9.26 |
Oracle September 2026 Critical Security Patch Update | On September 15, Oracle released its Critical Security Patch Update (CSPU) for September 2026. Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence. | Vulnerebility blog | TENABLE |
|
23.9.26 |
Click2Shell: WordPress Flaw Enables RCE Chain | Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator’s browser to be manipulated into installing and previewing a theme without explicit consent. Although this security flaw cannot directly execute arbitrary code on its own, security researchers proved it can be combined with a susceptible theme to achieve remote execution of attacker-specified PHP code. | Vulnerebility blog | SOCRADAR |
|
23.9.26 |
August 2026: GTA VI Leak, Keyv & Carhartt Breaches | August 2026 brought a wide mix of cyber incidents, from large-scale data breaches affecting millions of people to software supply chain attacks targeting developers and enterprise environments. | CyberCrime blog | SOCRADAR |
|
23.9.26 |
VelvetCake: Konni Targets Ukraine With Malicious LNK Files | Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-nexus threat groups to execute cyberespionage, conduct sabotage and influence operations, and generate revenue for state-sponsored nuclear weapons programs. | APT blog | SOCRADAR |
|
23.9.26 |
Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved | In August 2026, the Rhysida extortion group breached Berlin’s state network and copied roughly 1.44 million files from two of the city-state’s Senate administrations. Berlin disconnected the affected departments on August 14, refused a ransom demand of 30 BTC, and on September 4 the group released the archive to public access on its Dark Web leak site. | Cyber blog | SOCRADAR |
|
22.9.26 |
Clop Hack: ShinyHunters Hijacks Data Leak Site | ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS). | Cyber blog | SOCRADAR |
|
22.9.26 |
August 2026 Infostealer Trend Report - ASEC | This report summarizes the distribution channels, number of Infostealers, number of detections, and companies disguised as targets by new Infostealers collected during the month of August 2026. | Malware blog | Zscaler |
|
22.9.26 |
Passive DNS Reveals Flock Safety's Dev Infrastructure | Automated license plate readers and AI-assisted video surveillance have moved from a handful of pilot deployments to tens of thousands of installations across US towns, business parks and residential streets. Anyone can see the cameras, but the cloud platform behind them is a different story. | AI blog | FLARE.IO |
|
22.9.26 |
Click2Shell: WordPress Flaw Enables RCE Chain | Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator’s browser to be manipulated into installing and previewing a theme without explicit consent. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-76460: Cisco ISE Flaw Actively Exploited | CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypasses authentication without requiring user interaction, it opens the door to severe compromise across affected network infrastructure. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-91843: Check Point Root RCE | Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthenticated remote attacker could execute arbitrary code with root privileges. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access | SOCRadar Dark Web Team identified several new underground posts, including an alleged Dominican Republic citizen data leak, an alleged Celestial malware suite sale, and an alleged Money Network database sale. | Cyber blog | SOCRADAR |
|
22.9.26 |
Clop Hack: ShinyHunters Hijacks Data Leak Site | ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS). | Cyber blog | SOCRADAR |
|
19.9.26 |
LabubaRAT Threat Snapshot | LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan (RAT) identified by the Blackpoint Adversary Pursuit Group (APG), designed to masquerade as legitimate NVIDIA software while providing a full remote access feature set including command execution, file operations, screen capture, and SOCKS5 proxying. | Malware blog | Blackpoint Cyber |
|
19.9.26 |
Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware | The recent Brevo security incident is much larger than reported. Sansec found that attackers piggy-backed on embedded Brevo widgets to install Wordpress malware on Brevo customer sites and launch Clickfix attacks against their visitors. | Malware blog | Sansec |
|
19.9.26 |
What is Style Smuggler (CVE-2026-75650)? | Sansec discovered the vulnerability in Adobe Commerce & Magento and found it being exploited in the wild prior to patches being released, as early as September 4th, 2026 | Vulnerebility blog | Fastly |
|
19.9.26 |
The New DDoS Playbook: Lessons from Khan Academy, Yottaa, and Magnolia | Attackers have traded prolonged bombardments for short, violent bursts – traffic spikes that hit in 30 to 60 seconds and vanish before a human even gets paged. You can’t manually triage an attack that’s already over before you’ve had a chance to open Slack. | Attack blog | Fastly |
|
19.9.26 |
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts | A modern storefront can look perfectly healthy while malicious JavaScript works underneath: siphoning affiliate revenue, hijacking searches and clicks, tampering with analytics, or asking a remote server what to execute next. Pages load, products appear, and checkout works — yet the browser may be quietly doing something the site owner never authorized. | Malware blog | Cloudflare Blog |
|
19.9.26 |
Give every teammate and agent the right level of access to your Workers | As more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is crucial to allow you to ship safely. After all, the last thing you want is for an agent to make a change in production, just because it was granted more access than it needs. | Security blog | Cloudflare Blog |
|
19.9.26 |
Have it both ways: stay discoverable in search while disallowing AI training | Without proper controls, website owners have long faced a difficult tradeoff: allow your content to be used for AI training, or risk losing discoverability in search. That tradeoff exists because some of the largest organizations on the Internet use mixed-use crawlers: a single crawler serving both search and AI training. Refuse one, and you refuse the other. | AI blog | Cloudflare Blog |
|
19.9.26 |
One link was enough to backdoor a Chinese typing app | A single click on a link was all it took. Researchers at Gen Threat Labs found that a crafted web address could reach inside Sogou Input Method, one of the most widely used Chinese-language typing tools for Windows, and run an attacker's code on the machine behind it. The software has hundreds of millions of installations. | Malware blog | IntelFusions |
|
19.9.26 |
From Internet Exposure to Operational Disruption: A Red Team View of Connected Infrastructure | When people think about a cyberattack on water infrastructure, they often imagine the most dramatic outcome: a malicious actor changing a setpoint, stopping a pump, manipulating chemical treatment, or interfering with a physical process. | Security blog | COBALT.IO |
|
19.9.26 |
How Cobalt Brings Real-Time Exploit and Threat Intelligence to Vulnerability Findings | Common Vulnerabilities and Exposures (CVE) identify known vulnerabilities in specific components. They don't confirm whether you're exposed or whether attackers are actively exploiting a vulnerability. The additional context from adding reliable threat intelligence and known CVE information to your pentest findings can make the difference between wasting time on research and triage and quickly identifying pressing risks that your business needs to address. | Vulnerebility blog | COBALT.IO |
|
19.9.26 |
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads. | Malware blog | Socket |
|
19.9.26 |
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk | GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises. | Hacking blog | Socket |
|
19.9.26 |
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed | The originally released PoC had issues that broke exploitation. That PoC has been revised by the author. We have reviewed the revised version of the exploit and have validated that it now functions as expected in our lab. We have added a section at the end of our original article discussing this update and our results. | Exploit blog | LEVELBLUE |
|
19.9.26 |
S&P Global Agrees to Buy OpenZeppelin and Fold Smart Contract Audits Into Ratings | The ratings firm that cut Tether’s stability grade to its lowest level last year is buying the security company behind the open source smart contract libraries widely used across DeFi, and it is placing the business under S&P Global Ratings. | Cyber blog | UNCHAINEDCRYPTO |
|
19.9.26 |
Chainalysis Says State Hackers Now Write Half of the Malware Hidden on Blockchains | Chainalysis says state-backed operators now account for about half of the malicious code written to public chains, storing command-server addresses in smart contracts and transaction data that no registrar or host can take down. | APT blog | UNCHAINEDCRYPTO |
|
19.9.26 |
NFC Relay Goes Local: How AI Is Accelerating a New Wave of Independent Malware Developers | The Cleafy Threat Intelligence team has identified and analyzed two new Android NFC relay malware families: DevilNFC and NFCMultiPay. While these families are developed by distinct, unrelated actors with no shared code or infrastructure, both are actively used to successfully launch NFC relay attacks targeting European and LATAM banking customers. | AI blog | Cleafy |
|
19.9.26 |
Unpacking the Unpackable: Malformed APKs as an Anti-Analysis Technique | APK malformation is the intentional creation of technically broken or non-standard APK files that still install and run on Android, but confuse or break analysis tools. | Hacking blog | Cleafy |
|
19.9.26 |
Malware That Rewrites Itself Every Hour: AI-Powered Polymorphic Threats Break Signature-Based Defense | AI-powered polymorphic malware is malicious code that uses artificial intelligence to automatically rewrite itself — often every hour or on every execution — so that no two copies share the same signature, hash, or structure. Because traditional antivirus and signature-based detection depend on recognizing a known pattern, malware that never holds still is effectively invisible to them until after it has already run. | AI blog | Morphisec Blog |
|
19.9.26 |
Top 14 JavaScript Libraries and Frameworks Compared | JavaScript, one of the most popular programming languages, has a wide ecosystem of libraries and frameworks that enhance its functionality and streamline development. With the rapid growth of the web and the increasing demand for more dynamic, interactive, and scalable applications, developers rely on these tools to build everything from simple websites to complex applications. | Security blog | JSCRAMBLER |
|
19.9.26 |
CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai | We have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability. | Vulnerebility blog | AKAMAI |
|
19.9.26 |
Lemmings: A Russian Industrialized Persona Provisioning And Management for Active Measures Campaigns | Data posted to a darknet forum by an account named okenit_hackers in October 2025 reveals that Russian actors have potentially upgraded their disinformation methods through the automated creation and management of fake personae. | APT blog | DomainTools Investigations |
|
19.9.26 |
Stop Fraudulent Hires | You can't out-verify a stolen identity at the door. What you can do is make the enterprise a place where behavior that doesn't match the story surfaces early, before access is ever granted. | Cyber blog | Abnormal AI |
|
19.9.26 |
ORAX Conducts AiTM Without a Reverse Proxy | ORAX is a phishing-as-a-service (PhaaS) platform that uses WebSockets and live session control to capture MFA-authenticated Google Workspace sessions. | Phishing blog | Abnormal AI |
|
19.9.26 |
The banana stand: brokering and managing infections across Asia using MQTT | Black Lotus Labs®, the threat research division at Lumen, uncovered BambooToken, an emerging malware family using the Message Queueing and Telemetry Transport (MQTT) to quietly control infected Windows and Linux systems. | Malware blog | LUMEN |
|
19.9.26 |
MacOS ClickFix AMOS Campaign | A Fake “Bot Protection” Prompt Is Stealing Mac Users’ Crypto Wallets, and the Cleanup Is Not Keeping Up | Ransom blog | Ransom-ISAC |
|
19.9.26 |
Zero Breaches Out of 50: TrendAI Vision One™ Endpoint Security Essentials Earns AV-Comparatives Certified Leader Status | When your endpoint defense is tested against 50 sophisticated attack scenarios—the kinds of attacks that compromise enterprises—the measure is simple: did anything get through? For TrendAI Vision One™ Endpoint Security Essentials in AV-Comparatives' 2026 Endpoint Prevention & Response (EPR) Test, the answer is no. | AI blog | Trend Micro |
|
19.9.26 |
Global Public Sector Under Siege: Threat Intelligence for Q2 2026 | In the second quarter of 2026, threats to the public sector have become increasingly persistent: from AI-generated ransomware, nation-state espionage, supply chain attacks, and many more, critical institutions face a rapidly growing range of risks. | Cyber blog | Trend Micro |
|
19.9.26 |
Cyber Threats in Times of Conflict | The image of powerful nations releasing their cyber-arsenal to disrupt or cripple their victims’ infrastructure, military capabilities or economy during times of conflict has been largely a matter of speculation and Hollywood movies until recently. | Cyber blog | EMISISOFT |
|
19.9.26 |
The Risks Behind AI | There’s a hot new technology hitting the streets: it’s called AI, it’s AMAZING, and it’ll make the world a better place by solving all of your problems. Whether it’s finding a lost mountaineer, the early detection of cancers in radiological images, modeling proteins to speed the development of new drugs, or weather prediction, the capabilities of this thing seem limitless! | AI blog | EMISISOFT |
|
19.9.26 |
App Cloning Campaign Expands Mobile Banking Fraud | A recent investigation uncovered a mobile fraud campaign using cloned versions of Vietnam’s vWork application to distribute Gigabud, an Android banking malware linked to the GoldFactory threat group. Attackers impersonate legitimate services and use social engineering to convince victims to install malicious apps outside official stores. | Malware blog | ZIMPERIUM |
|
19.9.26 |
India Just Raised the Bar on Mobile App Security | India processes more than 10 billion UPI transactions every month. That scale made one thing inevitable: attackers would follow the money to mobile. | Malware blog | ZIMPERIUM |
|
19.9.26 |
Why Are OSS Attackers Always After CI/CD Credentials? | CI/CD credentials are a prime target of malicious open source packages because of the sheer authority those credentials carry. Depending on their privileges, they can provide access to source code, build systems, package registries, cloud infrastructure, and production delivery. | Security blog | SONATYPE |
|
19.9.26 |
SETTRA RANSOMWARE | NOTE: This is a Continuous Analysis Report of Settra Ransomware Group. The frequent updates of the group shall be found in this same article chronologically. | Ransom blog | THE RAVEN FILE |
|
19.9.26 |
Acronis Cyberthreats Update, September 2026 | The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in August 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. | Cyber blog | ACRONIS |
|
19.9.26 |
Novee Exploitability Validation for External Reports | Traditional tooling tells you what might be wrong. Novee’s Exploitability Validation tells you what's actually exploitable, right now, and proves it. | Exploit blog | NOVEE |
|
19.9.26 |
EtherHiding Exposed: Inside a Blockchain-powered Malware | We identified a malware campaign, active since at least November 2025, that stores its command-and-control (C2) address inside smart contracts on the Polygon blockchain instead of hardcoding it into the malware itself, a technique known as EtherHiding. | Cryptocurrency blog | GUIDESECURITY |
|
19.9.26 |
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild | On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions. | Vulnerebility blog | RAPID7 |
|
19.9.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Cyber blog | RAPID7 |
|
19.9.26 |
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild | On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance. | Vulnerebility blog | RAPID7 |
|
19.9.26 |
Private HTS programs that spread ransomware | AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which ransomware was distributed through a private home trading system (HTS). The HTS program used to distribute the ransomware is called “UBP Asset” and has long been exploited in online investment scams. Given that a photo of the same HTS program was also found in a blog post by a law firm in Korea published in September 2025, it appears that investment fraud organizations have recently been distributing ransomware to their victims. | Ransom blog | Zscaler |
|
19.9.26 |
August 2026 Threat Trend Report on APT Groups | The August 2026 APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabilities. | APT blog | Zscaler |
|
19.9.26 |
Sisterhood of the Traveling Pants CTF Writeup | With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life. | Cyber blog | FLARE.IO |
|
19.9.26 |
Operation RapidRust: New APT36 Malware Tools | In August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. | APT blog | Zscaler |
|
19.9.26 |
Dynamic Protection: When Controls Move With the Risk | The fastest way to lose confidence in a data protection program is to block something the business needed to do. Anyone who has run DLP knows the sequence: a rule fires on a legitimate transfer, an exception gets written, and after enough false positives, policies slide into monitor-only mode. Protection that doesn't fit the moment doesn't protect anything for long. | Cyber blog | PROOFPOINT |
|
19.9.26 |
Inside a 24 Billion Credential Leak: Passwords, Exploits, and How Attackers Connected Them, Part 1 | In this 2-part blog series, we break down a June 2026 disclosure of 24 billion stolen credentials and what it means for security leaders. This blog, Part 1, covers how stolen corporate passwords lead to account takeover, and what security leaders can do to close that exposure window. Part 2 covers the other half of the same disclosure: how attackers are pairing stolen credentials with active vulnerability data to prioritize which systems to target next. | Hacking blog | PROOFPOINT |
|
19.9.26 |
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia | Disclosure note: ahead of publishing this research on September 9, 2026, we notified the affected organizations and the relevant national CERTs, sharing a TLP:AMBER advance copy and holding publication to allow review. | Malware blog | HUNT.IO |
|
19.9.26 |
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Settra is a newer ransomware variant that was first observed in June 2026. Based on public reporting, the attackers behind the variant have targeted virtual private networks (VPNs) or used compromised credentials for initial access. | Ransom blog | Huntress |
|
19.9.26 |
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware | Many Black Hat and DEFCON attendees come home to an inbox full of DMs. While catching up on the expected post-conference networking last month, a Huntress researcher realized they were being targeted in an X exchange with someone posing as a crypto marketing executive. The threat actor sent a link to a real Google Doc with a custom sidebar designed to trick the recipient into downloading malware: an AMOS infostealer on macOS, or PowerShell loader chain on Windows. | Malware blog | Huntress |
|
19.9.26 |
How MSSPs Can Prove Their Value During a Quiet Month | The problem is not that the SOC did nothing. Quite the opposite. Analysts may have investigated hundreds of suspicious files, URLs, emails, and alerts. They may have confirmed malicious activity, closed false positives, identified new infrastructure, and stopped cases from consuming more time or reaching higher escalation tiers. | Cyber blog | ANYRUN BLOG |
|
19.9.26 |
ANY.RUN & SentinelOne: One Workspace, Instant Threat Context | Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. | Cyber blog | ANYRUN BLOG |
|
19.9.26 |
Enterprise Threat Intelligence Buying Guide | Choosing an enterprise threat intelligence solution is about more than just data volume or integrations. The right provider should deliver relevant intelligence, fit existing workflows, and help security teams investigate threats faster. | Cyber blog | ANYRUN BLOG |
|
19.9.26 |
CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower | See how meta-hacking got Microsoft Copilot to snitch on itself, exposing CoSnitch, a one-click flaw that silently exfiltrates data. | AI blog | VARONIS |
|
19.9.26 |
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack | Group-IB Blog | Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Active since Fall 2023, it has been used to surveil Iranian dissidents, journalists and government opponents, enabling remote command execution, data exfiltration, and persistence over Telegram command-and-control. | Malware blog | GROUP-IB |
|
19.9.26 |
CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 | CrowdStrike has been named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, receiving the highest scores in both the Current Offering and Strategy categories. We believe this recognition reflects an important shift in what organizations need from threat intelligence. | Cyber blog | CROWDSTRIKE |
|
19.9.26 |
CrowdStrike Accelerates Real-Time Data Classification with On-Device AI | Modern data security depends on understanding sensitive data as it is created, accessed, and moved in real time directly on the endpoint. | AI blog | CROWDSTRIKE |
|
19.9.26 |
PhantomRaven: LLM-generated Information Stealer for Bug Bounty Hunting | CrowdStrike Counter Adversary Operations identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript (JS)-based information stealer PhantomRaven via npm, a platform on which developers can access open-source packages to build applications and software. | AI blog | CROWDSTRIKE |
|
19.9.26 |
CrowdStrike SafeMind Uses the Best Offense to Build the Best Defense | The conventional approach to AI-powered security is to build an offensive agent to find weaknesses, build a defensive agent to catch threats, and run them in separate tracks. It's a clean division of labor that produces capable tools. However, the conventional approach also produces a permanent blind spot — the defense is never trained against the actual offense, and the connective tissue between the two is manual, slow, and fragile. | AI blog | CROWDSTRIKE |
|
19.9.26 |
Devil’s advocate? Uncensored Luciferus AI service advertised underground | Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime | AI blog | SOPHOS |
|
19.9.26 |
ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split | Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field. | Security blog | SOPHOS |
|
19.9.26 |
The Answer to AI Uncertainty Is Adaptability, Not Paralysis | AI uncertainty is not a strategic reason to wait; it is a strategic imperative to build adaptable organizations that can innovate confidently, govern risk proportionately, and respond effectively as technology and threats evolve. | AI blog | SOPHOS |
|
19.9.26 |
When Patching Isn't Enough: What the Fairlife Ransomware Attack Says About Network Edge Risk | A recent ransomware incident at Coca-cola owned dairy company Fairlife provides a potent example of network edge devices being targeted for exploitation, and of the scale of outcomes attackers can achieve by exploiting them. | Ransom blog | Eclypsium |
|
19.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
19.9.26 |
Cybersecurity Compliance APAC 2026: What CISOs Need Now | Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia’s largest economies, almost in step. Singapore’s Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026. | Cyber blog | Cyble |
|
19.9.26 |
Silent Push Exposes North Korean IT Worker Recruiting Facilitators Through Discord Servers | Silent Push identified a North Korean fake job recruitment scam channel hosted on a Discord server by a defender colleague, and we engaged the recruitment representative to ask about their offering and determine whether the individual was actually a North Korean IT worker. | APT blog | SILENTPUSH |
|
19.9.26 |
Silent Push Tracks a Mass Phishing Operation Through Fast Flux | The fast-flux technique has evolved, making it easier for threat actors to use in phishing campaigns and harder for defenders to detect and apprehend cybercriminals. | Phishing blog | SILENTPUSH |
|
19.9.26 |
Is Your Home Internet Feeding the AI Data Race? | Residential proxy providers sell household IP access for AI data collection, but many users do not understand what that access involves. | AI blog | GENDIGITAL |
|
19.9.26 |
Free AI, at the Price of Your Prompt | You choose a model, ask a question and get an answer. Behind that familiar exchange is a less familiar journey involving prompt logs, shifting model identities and servers whose role is never explained to users. | AI blog | GENDIGITAL |
|
19.9.26 |
PaperCut NG/MF Unauthenticated Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threats CVE-2026-81578 and CVE-2026-82078, assessed their impact, and developed mitigation measures. Chained together, these two flaws in PaperCut NG and PaperCut MF, a widely deployed print management platform, give an unauthenticated remote attacker code execution on the Application Server. | Vulnerebility blog | SonicWall |
|
19.9.26 |
TeleClip: A native 64-bit Telegram RAT with Multi-Coin Crypto Clipboard hijack and Keylogger | SonicWall Capture Labs threat researchers have been tracking a Telegram bot malware capable of silently stealing cryptocurrency. The malware is a cryptocurrency clipboard hijacker and keylogger written in C (GCC/MinGW, native 64-bit PE). It replaces wallet addresses copied to the clipboard with attacker-controlled addresses across 23 coin types, logs keystrokes, and exfiltrates everything exclusively via the Telegram bot API — no custom C2 domain required. | Malware blog | SonicWall |
|
19.9.26 |
SonicWall Endpoint Security in Action: Detecting Akira Ransomware | Ransomware isn't going away—it’s constantly evolving and remains one of the biggest threats to businesses worldwide. One name that has recently dominated the headlines is Akira Ransomware. Akira was first observed in the wild in March 2023 and quickly emerged as a significant Ransomware-as-a-Service (RaaS) operation. | Ransom blog | SonicWall |
|
19.9.26 |
Inside the Modern SOC: Defending the Cross-Environment Pivot | Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools. | Cyber blog | Palo Alto |
|
19.9.26 |
Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection | As cloud environments expand to include human, machine and autonomous agent identities, mapping the functional roles of these identities has become a significant security challenge. To address this challenge, we designed a behavioral clustering model that extracts activity patterns from cloud audit logs. | Cyber blog | Palo Alto |
|
19.9.26 |
Atomic macOS (AMOS) Stealer Activity | This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer. | Malware blog | Palo Alto |
|
19.9.26 |
Securing the unpatchable in an age of AI-driven vulnerabilities | Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility, and the deployment of NGFW/IPS combinations can provide a powerful compensatory layer. | AI blog | CISCO TALOS |
|
19.9.26 |
Should you care about an “AI slowdown?” | In this week's Threat Source, David talks about why focusing on your security basics is still your best bet, even in a world with rapid AI advancements. | AI blog | CISCO TALOS |
|
19.9.26 |
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use | Ransomware incidents in Japan rose 4.7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion represented 80% of victims. | Ransom blog | CISCO TALOS |
|
19.9.26 |
We've got one word for it, and it's usually the wrong one | In this week's Threat Source newsletter, Joe explores why the word "burnout" often fails to capture the true toll of working in the cybersecurity industry and why we need better language to address it. | Cyber blog | CISCO TALOS |
|
19.9.26 |
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." | OS Blog | CISCO TALOS |
|
19.9.26 |
Beware the SparroWock: The backdoor that bites, the commands that catch | ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group | Malware blog | Eset |
|
19.9.26 |
Cyberthreats are moving faster than SMBs: Readiness must accelerate | As AI adoption expands the attack surface and adds to the security workload, businesses need automation backed by experts | Cyber blog | Eset |
|
19.9.26 |
SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment | SideCopy APT now targets academia using evasive mshta-driven RAT attacks. Discover their kill chain and secure your network from latest attacks. | Malware blog | TRELLIX |
|
17.9.26 |
ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell | Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. | Vulnerebility blog | JFROG |
|
16.9.26 |
Sisterhood of the Traveling Pants CTF Writeup | With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life. | Cyber blog | FLARE.IO |
|
16.9.26 |
Mythic C2 Activity at Internet Scale | Mythic is an open-source collaborative C2 framework which is actively maintained on GitHub. It provides a plugin-based architecture supporting multiple agent types, transport profiles, and an operator-facing web UI. | CyberCrime blog | CENSYS |
|
16.9.26 |
State-Sponsored APT Threat Landscape in H1 2026 | This report analyzes the activities of North Korean, Chinese, and Russian-backed threat groups based on the APT Threat Trends from January to June 2026. | APT blog | S2W |
|
16.9.26 |
2025 H2 Ransomware Trends Report | S2W Threat Intelligence Center, TALON, has published a detailed analysis report on ransomware group activity in the second half of 2025. | Ransom blog | S2W |
|
16.9.26 |
How to mitigate typosquatting and slopsquatting attacks in npm and PyPI | One wrong character in a package name can give an attacker code execution inside a developer workstation or build environment. Typosquatting attacks exploit that small margin of error by publishing malicious packages whose names resemble legitimate projects in registries such as npm and the Python Package Index, or PyPI. | Hacking blog | THREATLOCKER |
|
16.9.26 |
Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit | A widespread smishing campaign was identified in which victims received fraudulent SMS messages impersonating official entities and were instructed to click a link inside the SMS in order to “complete a verification“, “settle an outstanding fee”, or “re-confirm delivery details”. | Phishing blog | GROUP-IB |
|
16.9.26 |
GhostCode: Dissecting a Novel Device Code Phishing Kit | In late August 2026, eSentire's Threat Response Unit (TRU) identified an active device code phishing campaign distributed through web contact forms. In the campaign, threat actors posed as a procurement officer of a legitimate business. TRU is tracking the device code phishing kit used in the campaign as "GhostCode". | Phishing blog | ESENTIRE |
|
16.9.26 |
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions | Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold its C2 configuration. | Malware blog | ELASTIC |
|
16.9.26 |
Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group | This report provides insights and analysis to better understand the role of third-party vendors and guarantee marketplaces from the perspective of Tajin Group, a third-party vendor that advertises and provides services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee. | APT blog | Recorded Futures |
|
16.9.26 |
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware | On X, the threat actor posed as the head of marketing at CoinDesk, appearing to use one person's name and another's photograph. Huntress confirmed that this account reached out to multiple security researchers at the tail end of DEFCON, using a boilerplate lure themed around an upcoming crypto conference. | Cyber blog | Huntress |
|
16.9.26 |
ANY.RUN & SentinelOne: One Workspace, Instant Threat Context | Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. | Cyber blog | ANYRUN BLOG |
|
16.9.26 |
H1 2026 Cyber Risk Report by ANY.RUN | ANY.RUN has released its H1 Cyber Risk Report, built on unique data from real-world submissions analyzed in the ANY.RUN Interactive Sandbox from January to June 2026 by over 700,000 analysts and 16,000 SOC teams. | Cyber blog | ANYRUN BLOG |
|
15.9.26 |
Agentic Ransomware: From Human-Operated to AI-Operated Attacks | Ransomware has always needed a human involved somewhere: an affiliate navigating a network by hand, or at minimum, a person who wrote the script the malware executed. Agentic ransomware breaks that assumption. It describes a ransomware attack where an autonomous AI agent, not a person, makes the operational decisions from the moment it gains access to the moment it demands payment. | Ransom blog | SOCRADAR |
|
15.9.26 |
Simplify Threat Intelligence Procurement with SOCRadar and Microsoft Marketplace | Your security team has already made the case for external threat intelligence. The budget owner agrees. Then the deal stalls on procurement rather than technology: a new vendor onboarding form, a separate legal review, another invoice outside the cloud commitment you have already negotiated. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch | SOCRadar’s Threat Research Unit (STRU) has documented VectraRAT, a Malware-as-a-Service platform built entirely from scratch rather than forked from leaked RAT code. Renting from $250 a month, it gives operators hidden-desktop control, keylogging, clipboard hijacking, browser credential theft, and a UAC bypass that elevates with no prompt. | Malware blog | SOCRADAR |
|
15.9.26 |
UCQ Leak, Israeli GlobalProtect Access, Digital Nirvana Dump, 32baar, and Ghorer Bazar | SOCRadar Dark Web Team identified several new underground posts, including an alleged Universidad Cuauhtémoc database leak, an alleged GlobalProtect-based access auction for an Israeli manufacturing firm, and an alleged 900GB Digital Nirvana data dump. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
GitLab CVE-2026-85706 Added to CISA KEV | CVE-2026-85706 represents a severe path traversal flaw in GitLab CE and EE, permitting unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployments. Following GitLab’s patch release on September 10, 2026, CISA incorporated the security issue into its KEV catalog the next day. | Vulnerebility blog | SOCRADAR |
|
15.9.26 |
Simplify Threat Intelligence Procurement with SOCRadar and AWS Marketplace | Your security team has already made the case for external threat intelligence. The budget owner agrees. Then the deal stalls on procurement rather than technology: a new vendor onboarding form, a separate legal review, another invoice outside the cloud commitment you have already negotiated. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
ENISA's CRA Single Reporting Platform Just Went Live. Here's What You Actually Need to Know | September 11, 2026, the Cyber Resilience Act's (CRA) reporting obligations officially kicked in, and ENISA's Single Reporting Platform (SRP) went live right alongside them. | Security blog | VULNCHECK |
|
15.9.26 |
No One Inside The Machine | In 1770, Wolfgang von Kempelen unveiled the “Mechanical Turk”: a chess-playing automaton that stunned European courts. With gears, a cabinet, and an articulated arm that moved its own pieces, it looked like a machine. | Security blog | CENSYS |
|
15.9.26 |
Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676 | A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, three bytes of length. `SslClientHelloHandler` has to read both before it knows how much ClientHello to expect, and the standard permits a handshake message to be split across several records, so it must be prepared for the header to arrive incomplete. | Vulnerebility blog | OX SECURITY |
|
15.9.26 |
The fake worker threat and the rise of human infiltration | How fake workers exploit trust, business processes and digital identities to gain legitimate access to organizations | Exploit blog | BARRACUDA |
|
15.9.26 |
Inside a 24 Billion Credential Leak: Passwords, Exploits, and How Attackers Connected Them, Part 1 | Most mega-breach compilations are static: old passwords from old incidents, most useful against people who never rotated a credential after a 2019 or 2021 breach. This one skewed toward fresh infostealer output, meaning a significant portion of the records may still be valid, including active browser session cookies in some logs (Tech Times). | Hacking blog | PROOFPOINT |
|
15.9.26 |
Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence | Hunt.io's AttackCapture™ discovered an open directory hosted at 92.63.180[.]133:8888, a server on Bangmod Enterprise Co., Ltd. infrastructure in Thailand. The directory contained 298 files across 30 subdirectories totaling 19 MB, first captured on June 3, 2026, including exploitation scripts, privilege escalation tools, brute-force utilities, a live MeshCentral agent configuration, and a device inventory of already-compromised machines, all targeting 3BB (Triple T Broadband). | Hacking blog | HUNT.IO |
|
12.9.26 |
LLMs Just Made Your IP Easier to Steal: Here’s the Fix | Large Language Models (LLMs) have fundamentally altered the economics of reverse engineering, meaning that any organization still relying on traditional obfuscation as its primary defense is protecting against an attacker who no longer exists. | AI blog | JSCRAMBLER |
|
12.9.26 |
When Detection Arrives After the Damage: Ransomware as a Patient-Safety Emergency | Healthcare ransomware is a patient-safety emergency, not just a data-privacy incident: when ransomware encrypts hospital systems, it disrupts the technology clinicians use to diagnose, treat, and stabilize patients — diverting ambulances, delaying procedures, and forcing a return to paper at the moment care is most time-sensitive. | Ransom blog | MORPHISEC |
|
12.9.26 |
Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs | In our previous blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality. | Hacking blog | SPIDERLABS |
|
12.9.26 |
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data | Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data. | Cryptocurrency blog | SOCKET.DEV |
|
12.9.26 |
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack | Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor. | AI blog | SOCKET.DEV |
|
12.9.26 |
Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know | Learn how Shai-Hulud compromises trusted software workflows, exposes credentials across CI/CD environments, and creates attack paths into cloud, production, and downstream systems, and how security teams can contain and recover from the compromise. | Hacking blog | SYGNIA |
|
12.9.26 |
Introducing automatic remediation policies with Cloudflare CASB | Today, we’re making Cloudflare CASB more powerful than ever by introducing automatic remediation policies. This means security teams can now design event-driven logic to revoke risky file shares and dispatch custom webhooks, without manual intervention. | Security blog | CLOUDFLARE |
|
12.9.26 |
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it | 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a post-quantum signature algorithm standardized by the National Institute of Standards and Technology (NIST). This is a first step toward preparing DNSSEC for a future in which today’s signature algorithms are no longer secure. | Security blog | CLOUDFLARE |
|
12.9.26 |
How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility | We’ve rewritten the module registry in workerd, the core open-source component of the Workers runtime, to be faster, more standards-compliant, and more closely aligned with Node.js' module registry. | Security blog | CLOUDFLARE |
|
12.9.26 |
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) | Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest, we start over, and the connection costs two round trips. | Security blog | CLOUDFLARE |
|
12.9.26 |
Reduce AI Token Waste by Getting Decisions Right Earlier | AI coding assistants are changing the economics of software development. They can interpret tasks, inspect codebases, select dependencies, make changes, call tools, run tests, and prepare pull requests. | AI blog | SONATYPE |
|
12.9.26 |
DefCon 2026: The Sandbox Is a Suggestion: Breaking Claude Code, Gemini CLI, and Codex Sandboxes | How we broke the default sandboxes in Claude Code, Gemini CLI, and Codex — leaking credentials from all three, including a CVSS 10.0 chain. DefCon 2026 research. | Cyber blog | NOVEE |
|
12.9.26 |
DefCon 2026: No Prompt Required: Pre-Task RCE in Google Gemini CLI | How a CVSS 10.0 pre-task RCE in Google Gemini CLI ran attacker code before the sandbox started. No prompt injection required. Full DefCon 2026 research. | Cyber blog | NOVEE |
|
12.9.26 |
CRA Reporting Goes Live September 11: What Manufacturers Must Have in Place When the Clock Starts | Product security continues to stand as a forefront of risk for manufacturers and developers worldwide. Consumers are consistently seeking new ways to protect themselves, their environments and their own systems. While some of this responsibility may fall on user’LAUDs, many look to the product engineers behind their solutions as a first line of defense. | Cyber blog | GUIDESECURITY |
|
12.9.26 |
Agentic AI Security: Key Findings from New IDC Research on the Identity Control Plane | A new IDC whitepaper, commissioned by GuidePoint Security, explores why identity is the foundational control plane for securing agentic AI and what organizations should prioritize as adoption accelerates. | AI blog | GUIDESECURITY |
|
12.9.26 |
URL Laundering by Rogue Agents: Newly Discovered Messages and Sandbox Circumvention by AI Swarms | We found a thousand new messages and additional sandbox circumvention methods used by the collusion.wiki Rogue AI agent swarms | AI blog | ZENITY |
|
12.9.26 |
ShieldCrash PoC: Microsoft Defender Fix Bypass | Microsoft recently fixed CVE-2026-69414 (ShieldBreak), a High-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Cisco FMC CVE-2026-20079 Actively Exploited | Cisco has confirmed active exploitation of CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) with a maximum CVSS score of 10.0. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Vibe-Terrorism: Inside the Yemen Cell That Used Claude to Build Guided Weapons | In Anthropic’s September 2026 threat intelligence report, one case stands apart from the rest. A small cell based in northern Yemen used Claude Code to develop guidance, navigation, and control (GNC) software for missiles. They ran three weapons programs simultaneously, conducted a live test-fire and when the rocket failed, they came back to Claude within hours to figure out why. | AI blog | SOCRADAR |
|
12.9.26 |
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) | Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild | Vulnerebility blog | TENABLE |
|
12.9.26 |
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI | Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That’s why for its new CyberAgents Exchange registry, Tenable paired its exposure management expertise with OpenAI GPT Cyber models to create the CyberAgents Exchange AI Inspector. | AI blog | TENABLE |
|
12.9.26 |
FileRun: Four More Ways to Run Your Files | Today VulnCheck is disclosing four vulnerabilities in FileRun, the self-hosted file manager and sharing platform. They are being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy, and all four were allocated through the VulnCheck CNA. Each one ends in remote code execution as the web-server user: | Vulnerebility blog | VULNCHECK |
|
12.9.26 |
The Anthropic Glasswing Receipts Are Starting to Trickle In | Anthropic’s Project Glasswing is approaching 5 months old, and Anthropic published its Vulnerability Disclosure Ledger on May 22nd. It hadn't received an update until this past week, when it backfilled the ledger with additional findings and updates, so naturally I thought it would be worthwhile to take a look at the receipts. | AI blog | VULNCHECK |
|
12.9.26 |
New on the Map — August 2026: 14 Protocol Scanners | Most organizations don’t have a complete picture of what’s reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. However, attackers scan for these services systematically, every day. | Security blog | CENSYS |
|
12.9.26 |
CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox | OX Research found and disclosed a critical vulnerability in DeepSeek Harness, DeepSeek’s open-source AI coding-agent harness, that allowed a sandboxed AI agent to disable its own confinement with a single shell command – on shipped defaults, with no network exposure and no credentials. | Vulnerebility blog | OX SECURITY |
|
12.9.26 |
Finding and Notifying a ShinyHunters Claims Impersonation Campaign Before It Activated: 61 Domains, 48 Brands | ReliaQuest Threat Research published a short public advisory about a ShinyHunters campaign on August 17, 2026. This campaign was built on domains following a company[.]claims pattern, and reported that the group had added legal team impersonation to its established help desk and IT pretexts. The advisory had no domains, and described a shape that left the reader to find the instances. | CyberCrime blog | FLARE.IO |
|
12.9.26 |
I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method | The AhnLab SEcurity intelligence Center (ASEC) recently identified the LegionLoader malware, which is currently being distributed via the ClickFix method. There are two main distribution methods identified so far; both involve tricking users into visiting a malicious URL and then prompting them to directly execute malicious PowerShell commands through a fake Cloudflare CAPTCHA screen. | Malware blog | Zscaler |
|
12.9.26 |
Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers | In August 2026, FortiGuard Labs observed a Casbaneiro attack campaign targeting users in Latin America, using phishing emails and PDF files themed around fake invoices and legal notices as the initial stage. | Malware blog | FORTNITE |
|
12.9.26 |
ShadowPane: Inside a Frostedwrist-Linked BITB Campaign Targeting Real Estate and Escrow Firms | ZeroBEC uncovered a phishing campaign we track as ShadowPane that uses browser-in-the-browser deception to make malicious RMM installations appear to originate from Adobe. | Phishing blog | ZEROBEC |
|
12.9.26 |
Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source | TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. | Vulnerebility blog | IMPERVA |
|
12.9.26 |
ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings | In G2’s Fall 2026 awards, we earned both Momentum Leader and Grid Leader recognition, highlighting our continued growth and strong position in the market. Most importantly, these achievements reflect the trust security professionals place in ANY.RUN every day to support their threat investigations. | Malware blog | ANYRUN BLOG |
|
12.9.26 |
15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN | To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture. | Cyber blog | ANYRUN BLOG |
|
12.9.26 |
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress recently analyzed two attacks that started with a phishing message and then redirected victims to a browser-in-the-browser (BiTB) page (both using the same template and lure) that prompted them to download an "updated Adobe Reader" version to view files. | Phishing blog | Huntress |
|
12.9.26 |
Grand Theft Auto VI Hype Leads to Malware | Threat actors are taking advantage of overeager gamers searching for a leaked version of the upcoming Grand Theft Auto VI (GTA6), using fake game downloads as an initial access lure. | Malware blog | Huntress |
|
12.9.26 |
UK Council Attack Linked to SonicWall SMA 1000 Campaign | Disclosure note: Hunt.io notified the UK National Cyber Security Centre (NCSC) and other relevant national CERTs ahead of publication, so that affected organisations identified during the research could be contacted. | Vulnerebility blog | HUNT.IO |
|
12.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
12.9.26 |
Beyond the Alert: Bringing Context to Insider Risk and AI Investigations | Proofpoint is announcing two expansions to its communications intelligence capabilities today. Proofpoint Prism Investigator now connects directly to Microsoft 365, and Proofpoint Human Communications Intelligence (HCI) now brings AI communications governance signals into insider risk investigations. | AI blog | PROOFPOINT |
|
12.9.26 |
SloppyRAT: A New Tool For Ransomware Attacks | In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. | Malware blog | Zscaler |
|
12.9.26 |
This SonicWall bug is 2 years old. Akira ransomware is still exploiting it. | The Akira ransomware gang is still breaking into networks through a firewall bug SonicWall fixed two years ago. The critical vulnerability, CVE-2024-40766, carries a CVSS score of 9.3 out of 10. | Vulnerebility blog | THREATDOWN |
|
12.9.26 |
Dissecting a PHP web server rootkit | Sophos X-Ops takes a deep dive into an insidious piece of malware | Malware blog | SOPHOS |
|
12.9.26 |
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures | Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines.... | Malware blog | SEQRITE |
|
12.9.26 |
Cyble Introduces Major Upgrade to its Executive Monitoring Module | Cyble has rolled out a significant upgrade to Executive Monitoring inside Cyble Vision, bringing unified findings, AI-driven scoring, and expanded alerting together in a single protection suite. | Cyber blog | Cyble |
|
12.9.26 |
From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline | Infostealer malware turns a single infection into a marketplace listing. A technical look at harvesting, stealer logs, enrichment, and resale. | Malware blog | Cyble |
|
12.9.26 |
Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us | Qatar is racing toward a knowledge-based, fully digital economy. But that pace of transformation makes Qatar an attractive target in the cyber realm. | Cyber blog | Cyble |
|
12.9.26 |
AI-Driven Threat Intelligence for Gulf Enterprises: Why Detection Speed Is Now a Regulatory Requirement | AI-powered threat intelligence helps GCC enterprises detect breaches faster, close compliance gaps, and meet strict cyber incident reporting deadlines. | AI blog | Cyble |
|
12.9.26 |
Gray Rabbits and the Tale of a One-Click Backdoor | One click. Three critical failures. One backdoor. | Malware blog | GENDIGITAL |
|
12.9.26 |
Infostealers Have Found a New Target: Your AI Agent | Malware operators are expanding beyond browser passwords and crypto wallets to collect access tokens, MCP configurations, prompt histories and project data stored by AI tools. | AI blog | GENDIGITAL |
|
12.9.26 |
Protecting organizations from AI-assisted executive impersonation and invoice fraud | Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud. | AI blog | Microsoft blog |
|
12.9.26 |
Passkey-themed social engineering leads to identity and cloud compromise | Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. | Security blog | Microsoft blog |
|
12.9.26 |
Microsoft Security Bulletin Coverage for September 2026 | Microsoft’s September 2026 Patch Tuesday is the largest on record, addressing 971 vulnerabilities, including 438 Elevation of Privilege vulnerabilities. The SonicWall Capture Labs Threat Research team analyzed Microsoft’s security advisories for September 2026 and developed coverage for 42 of the reported vulnerabilities. | OS Blog | SonicWall |
|
12.9.26 |
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure | A recent Unit 42 investigation into seemingly low-priority enterprise infections demonstrates how the most effective camouflage in cybercrime is not necessarily in the use of sophisticated techniques, but in how unremarkable the threat appears. The activities that we investigated would typically not require escalation or further inquiry. But upon closer inspection, we discovered a massive cybercrime campaign largely targeting young gamers. | CyberCrime blog | Palo Alto |
|
12.9.26 |
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America | We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Corroborating recent findings from the broader threat intelligence community, we observed attackers leveraging artificial intelligence (AI) to enhance their capabilities. | AI blog | Palo Alto |
|
12.9.26 |
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE | This research demonstrates post-exploitation techniques that could allow an attacker with root access on a compromised Kubernetes node to misuse an open standard and reference implementation for machine identity known as SPIFFE/SPIRE to impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs). | Exploit blog | Palo Alto |
|
12.9.26 |
PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector | In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating payload (e.g. ”encrypt files in ~/Documents”, “give me a biohazard recipe”, “ignore all previous instructions and…”) is embedded in a specially crafted prose wrapper. | AI blog | CHECKPOINT |
|
12.9.26 |
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT | Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker’s task was processed separately and its result returned across accounts. | AI blog | CHECKPOINT |
|
12.9.26 |
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 | Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. | Cryptocurrency blog | CISCO TALOS |
|
12.9.26 |
We've got one word for it, and it's usually the wrong one | In this week's Threat Source newsletter, Joe explores why the word "burnout" often fails to capture the true toll of working in the cybersecurity industry and why we need better language to address it. | Cyber blog | CISCO TALOS |
|
12.9.26 |
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities | Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. | Exploit blog | CISCO TALOS |
|
12.9.26 |
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager | We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. | Malware blog | CISCO TALOS |
|
12.9.26 |
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." | Vulnerebility blog | CISCO TALOS |
|
12.9.26 |
GuardBreaker: Derailing AI-assisted malware analysis with a code comment | AI blog | Eset | |
|
12.9.26 |
Safe word: What is it and why do you need one? | AI scams are now hyper-realistic. But there’s one simple way to see through them. | Security blog | Eset |
|
12.9.26 |
Testing race conditions with memory access tracing and stack-based delay injection | Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: | Hacking blog | PROJECT ZERO |
|
12.9.26 |
Trellix SecondSight Threat Hunting Report: How AI and Human Intelligence Expose 2026 Cyber Threats | As adversaries adopt new technologies, techniques, and increasingly AI-enabled ways of operating, defenders have access to more telemetry, intelligence, and automation than ever before. The challenge is knowing where to look, what matters, and when a weak signal deserves a closer look. This is focus of the September 2026 Trellix SecondSight Threat Hunting Report. | AI blog | TRELLIX |
|
11.9.26 |
Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration | The zLabs research team has discovered a sophisticated and highly aggressive mobile malware strain linked to Indonesian threat actors, that marks a dangerous tactical evolution by seamlessly integrating comprehensive spyware capabilities with traditional ransomware functionality into a single attack vector. | Ransom blog | ZIMPERIUM |
|
11.9.26 |
DCOM Service PsmServiceExtHost LPE - SSD Secure Disclosure | Threre is a heap buffer overflow vulnerability in a DCOM service that can be leveraged to achieve LPE from a Medium IL standard user to System IL. | Vulnerebility blog | SSD-DISCLOSURE |
|
11.9.26 |
Wiz achieves GovRAMP High Authorization | Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure. | Security blog | Wiz Blog |
|
11.9.26 |
What Is Agentic Cyber Defense Engineering? | Attackers can now find weaknesses faster, adapt tactics in minutes and scale campaigns without requiring extensive expertise or large networks of threat actors. Meanwhile, many security teams still rely on manual processes to execute and coordinate critical activities. The result is a widening gap between the speed of AI-powered threats and the ability of security teams to respond. | AI blog | CYMULATE |
|
11.9.26 |
New Ruxie AI power-up: Precedent engine turns repetitive alerts into faster decisions | A large portion of the daily security alert queue is made up of alerts that look almost exactly like cases our analysts have already investigated and closed. | AI blog | Expel |
|
11.9.26 |
How to build a continuous penetration testing program | Headcount is the wrong lever. More security hiring, or more bought pentest days, feeds the one stream that can't scale, so coverage barely moves even when the budget clears. | Security blog | ESCAPE.TECH |
|
11.9.26 |
How Amp got its Soc 2 Type II pentest evidence in hours | Amp is the AI hiring team for high-volume frontline employers. Restaurants, retailers, logistics operators, hospitality groups, healthcare staffing firms. Amp screens candidates against the criteria you set, books interviews on your managers' calendars, runs candidate comms, and closes offers you approve. | AI blog | ESCAPE.TECH |
|
11.9.26 |
How a Fraudulent Hire Clears Your Verification Process | The controls most companies trust to vet a candidate were built to catch mistakes and embellishments. They were not built for a well-funded adversary using a real person's identity, and sometimes a real person. | CyberCrime blog | ABNORMAL |
|
10.9.26 |
Attack Cases in Korea Involving the Installation of Radmin and UltraVNC | The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases that exploited Radmin and UltraVNC. Although the Initial Intrusion method remains unknown, the attackers installed Radmin—a remote control tool—and then installed UltraVNC. | APT blog | Zscaler |
|
10.9.26 |
2026 State of the Internet: The Exposure Notification Gap in ICS Devices | New Censys data reveals a major blind spot in Internet-exposed industrial control systems. | ICS blog | Censys |
|
10.9.26 |
The Anthropic Glasswing Receipts Are Starting to Trickle In | Anthropic’s Project Glasswing is approaching 5 months old, and Anthropic published its Vulnerability Disclosure Ledger on May 22nd. It hadn't received an update until this past week, when it backfilled the ledger with additional findings and updates, so naturally I thought it would be worthwhile to take a look at the receipts. | AI blog | VULNCHECK |
|
10.9.26 |
Coming to Tenable One: Claude Mythos 5 and “Adversary View” | Tenable is bringing Anthropic’s Claude Mythos 5 into our enterprise security offerings. Adding frontier adversarial reasoning to the Tenable One Exposure Management Platform will help customers better anticipate how attackers could breach their environments and stay ahead of AI-fueled risk. | AI blog | TENABLE |
|
10.9.26 |
Signing in without actually signing in | Session tokens are the skeleton keys used to hijack | Hacking blog | OKTA |
|
10.9.26 |
September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days | Microsoft’s September 2026 Patch Tuesday release addresses 974 vulnerabilities, including two actively exploited zero-days. Both zero-days are Windows elevation of privilege flaws, and both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access | SOCRadar Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database sale, an alleged Vedicline customer database sale, and a claimed Langflow 1.12.0 zero-day RCE exploit. Other posts advertised an alleged ASUS database and shell access to an Indian energy sector organization. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
SOCRadar MCP Server for ChatGPT: Setup and Use Cases | The SOCRadar Threat Intelligence MCP app connects ChatGPT to the SOCRadar MCP server over OAuth, exposing your licensed intelligence modules as callable tools. Analysts enrich indicators, check CVE exploitation, and query Dark Web exposure without leaving the conversation. | AI blog | SOCRADAR |
|
10.9.26 |
StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited | Attackers are actively exploiting an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution and persistent backdoor installation. | Exploit blog | SOCRADAR |
|
10.9.26 |
FBI Investigates Nexus Claim of 153M+ ID Records | A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. | CyberCrime blog | SOCRADAR |
|
10.9.26 |
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT | One of the most common entry points for attackers is the exploitation of public-facing edge devices (such as VPNs, routers, and firewalls). Over the years, FortiGate firewalls have remained a consistent target, as evidenced by the recent widespread FortiBleed campaign conducted jointly by the INC and Lynx ransomware groups. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
Dark Web Market: Anubis Market | Anubis Market is a multi-category Dark Web marketplace operating as a Tor hidden service, with escrow-backed trading in Bitcoin (BTC) and Monero (XMR). Its visible category strip displays more than 11,000 listings, and while narcotics account for the largest share of physical goods, its Digital section is the single biggest category on the market. | CyberCrime blog | SOCRADAR |
|
10.9.26 |
Browser-based phishing hides pages inside victims’ browsers | How attackers chain trusted business platforms together to make credential theft look like routine work | Phishing blog | BARRACUDA |
|
10.9.26 |
Browser-in-the-browser phishing campaign chains DocuSign, Adobe and Microsoft trust | How attackers abuse Microsoft OAuth redirects, Teams domains, blob URLs, and service workers to deliver phishing pages without a traditional phishing site. | Phishing blog | BARRACUDA |
|
10.9.26 |
NSA Best Practices for Cyber Hygiene recommends allowlisting, Zero Trust controls | On September 3, 2026, the NSA released new cyber hygiene best practices focused on defending against AI-enhanced threats. With cybercriminals increasingly using AI tools to boost attacks, the NSA highlighted weak authentication, unpatched systems, and misconfigurations as persistent issues attackers take advantage of. | Cyber blog | THREATLOCKER |
|
9.9.26 |
Vwork: Weaponized Open-source Software as an Addon for Gigabud | How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders. | Malware blog | GROUP-IB |
|
9.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
9.9.26 |
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files | Note on withheld data: Individual victim IPs are aggregated by network block, not listed. Sensitive data incidentally exposed on unrelated third-party sites has been removed from this report and, where possible, reported to the relevant providers. This report documents attacker infrastructure and tradecraft; it is not a disclosure against any named organization. | Cryptocurrency blog | HUNT.IO |
|
9.9.26 |
Beyond Lazarus: How North Korea Organizes Its Cyber Operations | Get the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers. | APT blog | SEKOIA |
|
9.9.26 |
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress recently analyzed two attacks that started with a phishing message and then redirected victims to a browser-in-the-browser (BiTB) page (both using the same template and lure) that prompted them to download an "updated Adobe Reader" version to view files. | Phishing blog | Huntress |
|
9.9.26 |
German Manufacturer Saves 15 Minutes Per Alert | To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture. | Security blog | ANYRUN BLOG |
|
9.9.26 |
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. | AI blog | GTI |
|
9.9.26 |
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT | Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker’s task was processed separately and its result returned across accounts. In our proof of concept, ChatGPT retrieved email data from the victim’s connected Gmail account and relayed it to the attacker. | AI blog | CHECKPOINT |
|
8.9.26 |
AI Agent 'opencode'로 미끼를 만든 김수키, GitHub PAT 기반 LNK 공격 진화 | Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve | AI blog | GENIANS |
|
8.9.26 |
Tracking BigBear 2.0 Evilginx2 Phishing Campaign | CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. | Phishing blog | CloudSEK |
|
8.9.26 |
Beyond Lazarus: How North Korea Organizes Its Cyber Operations | Get the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers. | APT blog | SEKOIA |
|
8.9.26 |
HVNC Backdoor Targets LATAM Organizations with Fake Tax Lures | Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots. | Malware blog | ANYRUN BLOG |
|
8.9.26 |
Detection and Removal of the Syslogk Rootkit in a Linux Environment | The AhnLab SEcurity intelligence Center (ASEC) continuously monitors various threats targeting Linux environments. Techniques that modify the Linux kernel to conceal malware and signs of compromise have been used for a long time, and Syslogk is one such rootkit that operates in this manner. | Malware blog | Zscaler |
|
7.9.26 |
N-able N-central HF4 Patches Critical Pre-Auth RCE | N-able has released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to fix CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in its remote monitoring and management platform. The update supersedes three hotfixes issued between August 2 and September 5 and is the current security baseline for the 2026.3 branch. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-73749: HPE ArubaOS-CX RCE | HPE patched CVE-2026-73749, a critical unauthenticated Remote Code Execution (RCE) vulnerability in HPE Aruba Networking AOS-CX, also known as ArubaOS-CX. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-20212: Cisco Nexus 9000 RCE Flaw | Cisco has disclosed a critical vulnerability, CVE-2026-20212, in the Silicon One integration used by certain Nexus 9000 switches. The flaw allows an unauthenticated remote attacker who can access the affected service to execute code with root privileges. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
Elementor Pro RCE Flaw Under Active Attack | A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload files through the plugin’s Forms module. Tracked as CVE-2026-32475, the flaw could lead to remote code execution on affected sites. Wordfence reported blocked exploitation attempts beginning August 19, 2026, the same day Elementor released a fix. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet | NPS is an open-source tunneling tool, popular with the Chinese-speaking security community. | Malware blog | Censys |
|
7.9.26 |
Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials | For organizations managing hundreds or thousands of servers, System Center Operations Manager (SCOM) provides a single pane of glass into system health, performance and availability. It is deeply integrated, broadly deployed and trusted with the access it needs to do its job. | Security blog | GUIDESECURITY |
|
5.9.26 |
Introducing More Granular Controls for AI Bot Traffic | We’ve updated our Akamai Bot Directory to split the single AI Bots category into three distinct types: AI training crawlers, AI search crawlers, and AI fetchers and agents. | BotNet blog | AKAMAI |
|
5.9.26 |
CTEM vs BAS: The Difference and Why the Comparison Misses the Point | "CTEM vs BAS" is the wrong question. CTEM is a workflow. BAS is a product category that fits inside one stage of that workflow. The comparison peoWhat is CTEM (continuous threat exposure management)?ple actually need is BAS vs adversarial exposure validation (AEV), both of which sit inside CTEM's Validation stage. | Security blog | ETHIACK |
|
5.9.26 |
Microsoft Teams Notifications Are Now Available in Socket | Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel. | OS Blog | SOCKET.DEV |
|
5.9.26 |
Beyond Point-in-Time: Continuous Offensive Security with the Cobalt API | For enterprise security programs, the challenge was never running offensive security testing against your applications and networks. It's whether the process and results were manageable at scale and could actually drive faster remediation across every business unit and engineering team in the organization. | APT blog | COBALT |
|
5.9.26 |
Attackers exploit a Chrome flaw, update your browser now | Google has shipped a new Chrome desktop release that closes 12 security holes, and one of them was already being used in attacks before the fix arrived. Hong Kong's HKCERT, relaying Google's advisory, rates the release "Extremely High Risk" on the strength of that single bug. | Exploit blog | INTELFUSIONS |
|
5.9.26 |
Hackers quietly turn Korean PCs into proxies and VPNs | A PowerShell process on a Korean machine pulls down a zip file and unpacks a batch script that installs Radmin, a perfectly legitimate remote desktop product, into C:\Intel\RServer. Nothing in that sequence looks like malware. That is the point. | Hacking blog | INTELFUSIONS |
|
5.9.26 |
Video encoders can be rooted and no patch is coming | Taking over a QVidium Opera11 video encoder takes one web request, and there is nobody left to ship a fix. The company that built the devices has gone out of business. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
ServiceNow flaws let strangers run code on an instance | ServiceNow has fixed four security flaws in the platform many large organizations use to run their IT service desks, and its own security team scored every one of them at the top of the scale: CVSS 10.0. Three of the four can be reached by someone with no account and no password at all. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
How we could save petabytes of cache storage with Zstandard and Pingora | Memory costs are increasing dramatically. Both RAM and hard disk drive prices have exploded over the past year. At Cloudflare, we run several massively distributed storage products (including our famous CDN) that rely on making efficient use of the memory we have deployed so we can continue to serve all of our customers. | Security blog | CLOUDFLARE |
|
5.9.26 |
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models | Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? | Vulnerebility blog | CLOUDFLARE |
|
5.9.26 |
Your ATS Is Now Part of Your Attack Surface | The attack that should worry your security team most this quarter didn't start with a phishing email. It started with a job application. | Security blog | ABNORMAL |
|
5.9.26 |
How Abnormal and OpenAI are Detecting and Responding to Rogue AI in the Cloud | Abnormal AI is extending its behavioral AI engine to the cloud, using OpenAI models to detect, investigate, and respond to risky or malicious AI-agent behavior. | AI blog | ABNORMAL |
|
5.9.26 |
How Turbopack chunks your JavaScript | Open the network tab of this page and you’ll see a list of JavaScript files with seemingly random names: | Malware blog | NEXT.JS |
|
5.9.26 |
TrendAI™ Brings OpenAI's GPT Cyber Models Into the Race to Shrink Exposure Time to Zero | OpenAI’s GPT cyber models help TrendAI™ close the exposure window, from vulnerability to fix, faster than ever. | AI blog | Trend Micro |
|
5.9.26 |
Introducing Agentic Code Scanning: The Holistic Cycode System Around Any Model | TL;DR: Agentic Code Scanning is the fourth dimension of Cycode’s code scanning spectrum, not a separate product bolted on. Deterministic SAST, AI SAST, SAST + AI Exploitability, and Agentic Code Scanning run as one single system that decides what runs where, so you stop trading precision vs. cost vs. model. It caught both authorization CVEs in our benchmark that no rule engine can express, and all on an affordable open-weights model. | Security blog | CYCODE |
|
5.9.26 |
Contagious Interview steps outside the developer workflow | Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. | Vulnerebility blog | JAMF |
|
5.9.26 |
7 Best AI Penetration Testing Tools of 2026 | Compare the 7 best AI penetration testing tools of 2026. See which platforms prove exploits, reason like attackers, and run continuous testing at scale. | AI blog | NOVEE |
|
5.9.26 |
Recent Update to FAQ Regarding SAQ Eligibility Criteria Could Affect Your PCI DSS Compliance | The PCI Security Standards Council (PCI SSC) updated FAQ 1331 on its website. This FAQ governs the use of Self-Assessment Questionnaire (SAQ) eligibility criteria as a guide for determining applicability of PCI DSS requirements for Report on Compliance (ROC) assessments. | Security blog | GUIDESECURITY |
|
5.9.26 |
Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials | For organizations managing hundreds or thousands of servers, System Center Operations Manager (SCOM) provides a single pane of glass into system health, performance and availability. It is deeply integrated, broadly deployed and trusted with the access it needs to do its job. | Security blog | GUIDESECURITY |
|
5.9.26 |
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors | A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. | APT blog | RAPID7 |
|
5.9.26 |
Varonis Achieves Snowflake Premier Partner Tier and Is Now Available on Snowflake Marketplace | Building a closer partnership to make it easier to secure the data and AI that customers build, run, and analyze with Snowflake. | Malware blog | VARONIS |
|
5.9.26 |
How attackers abuse PowerShell, WMI, and LOLBins | Windows environments already contain powerful tools capable of executing commands, changing configurations, communicating across networks, and managing operating systems. For administrators, these capabilities are essential, but they also provide attackers with a clear route to breach an environment. | Security blog | THREATLOCKER |
|
5.9.26 |
PEEP: A Browser RAT Posing as a Chrome Extension | The Threat Research Unit (STRU) at SOCRadar’s Extended Threat Intelligence (XTI) platform identified and analyzed PEEP, a Chromium-based emerging post-exploitation toolkit disguised as “Smart Bookmarks.” Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values. | Malware blog | SOCRADAR |
|
5.9.26 |
SonicWall CVE-2026-83548 Leads to CISA Alert | SonicWall disclosed two actively exploited vulnerabilities in SMA1000 Series appliances: CVE-2026-83548, a pre-authentication server-side request forgery flaw, and CVE-2026-83549, a post-authentication OS command injection flaw. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
JFrog Artifactory CVE-2026-82329 Exploited | A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329, is under active exploitation, posing an immediate threat to self-managed software supply chains worldwide. Under default configurations, unauthenticated network attackers can gain full administrative control over exposed instances. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
FalconFlank: CrowdStrike Falcon 0-Day PoC | FalconFlank is an alleged privilege escalation zero-day vulnerability in CrowdStrike Falcon Sensor for Windows, published with working Proof-of-Concept (PoC) code by researcher Chaotic Eclipse. The concern: a security product running with elevated privileges may be tricked, through its own malicious-macro remediation workflow, into acting on an attacker’s behalf. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
427 or 4 Devices?: Measuring Internet-Exposed Industrial Infrastructure in the UK | On August 22, 2026, The Telegraph reported that a small UK power generator had been shut down for four days in July following a cyberattack by hackers linked to Iran. | ICS blog | FLARE.IO |
|
5.9.26 |
Someone Else Is Using Your AI | FortiCNAPP analyzes an AWS LLMjacking incident involving a leaked administrator key and unauthorized access to Amazon Bedrock. | AI blog | FORTNITE |
|
5.9.26 |
One Blank Field Bypasses Direct Send Control | This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest’s own environment. Nothing in this report should be read as a vulnerability in ReliaQuest’s systems or data. | Vulnerebility blog | RELIAQUEST |
|
5.9.26 |
H1 2026 Malware Vulnerability Trends | H1 2026 activity showed a continued adversary preference for abusing legitimate tools, trusted platforms, and routine workflows already present in enterprise and consumer environments. Threat actors used exposed software, developer tools, remote access utilities, payment workflows, and third-party services to gain access, steal credentials, move laterally, and monetize intrusions while blending into expected activity. | Malware blog | Recorded Futures |
|
5.9.26 |
How to correlate Kubernetes audit logs with container runtime data | Two fields join the Kubernetes API to what ran inside the pod, and one turns up a container escape your process events never recorded. | Security blog | ELASTIC |
|
5.9.26 |
Data access: the hidden cost of security vendor lock-in | Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and latency, and it is the part of the evaluation most teams overlook. | Security blog | ELASTIC |
|
5.9.26 |
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems | Disclosure note: Hunt.io disclosed these findings under TLP:AMBER to the relevant national CERTs for the affected jurisdictions and, following responsible disclosure, held publication until September 3, 2026. | APT blog | HUNT.IO |
|
5.9.26 |
eSentire Wins 2026 Global AI Award for AI in Cybersecurity | We're proud to announce that eSentire has won a 2026 Global AI Award in the AI in Cybersecurity category, recognizing the Atlas Platform and the Controlled Autonomy SecOps operating model behind it. | AI blog | ESENTIRE |
|
5.9.26 |
Compliance at the Speed of Regulation | For years, compliance teams built their programs around a manageable, well-known set of frameworks: PCI-DSS for payment data, HIPAA for healthcare, SOC 2 for service organizations, ISO 27001 for information security management. These frameworks were stable. Auditors knew them. Tooling was built around them. And most importantly, the list didn't change very often. | Cyber blog | PROOFPOINT |
|
5.9.26 |
Why Proofpoint Is Signing On to Collective Cyber Defense with Frontier Labs | Last week, OpenAI published an open letter calling for a global surge in cyber defense. Proofpoint is proud to stand alongside frontier labs, fellow security vendors, and global enterprises in signing it. | Cyber blog | PROOFPOINT |
|
5.9.26 |
Proofpoint Introduces SOC Analyst Agent, Powered by OpenAI Daybreak Models Through Daybreak Defense Network | Security teams don’t have a data problem. They have a prioritization problem. Alerts arrive faster than any team can review them, spread across a growing set of products, each with its own console and its own version of the truth. | Cyber blog | PROOFPOINT |
|
5.9.26 |
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help | Microsoft's August 2026 Patch Tuesday included a fix for CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The severity has a CVSS score of 8.0 from Microsoft. | Vulnerebility blog | Zscaler |
|
5.9.26 |
AI threat so great that security “takes precedence over everything except critical business operations” | OpenAI just published an open letter, co-signed by Anthropic, Google, and more than 120 other organizations, warning that the window to prepare for AI-enabled attacks is closing rapidly. | AI blog | THREATDOWN |
|
5.9.26 |
CrowdStrike Delivers the Next Evolution of the Agentic SOC | The agentic SOC provides a foundation that agents can reason over, teams of expert agents that learn each environment, and one workspace to build and govern it all, delivered on the Falcon platform. | Security blog | CROWDSTRIKE |
|
5.9.26 |
CrowdStrike Announces Agentic Identity Provider | CrowdStrike gives every AI agent a trusted identity and continuously controls their access based on real-time context, and expands modern privileged access to where work happens. | AI blog | CROWDSTRIKE |
|
5.9.26 |
Peer Pressure: Inside the Sality Botnet Disruption Operation | CrowdStrike collaborated with international law enforcement and industry partners to execute a coordinated disruption of the Sality peer-to-peer botnet. | BotNet blog | CROWDSTRIKE |
|
5.9.26 |
CrowdStrike Falcon Guardian Defines the Next Generation of AI Security | CrowdStrike’s new flagship AI detection and response solution delivers runtime protection for AI agents, introduces a new AI gateway, and extends expert-led defense. | AI blog | CROWDSTRIKE |
|
5.9.26 |
Ungentlemanly behavior: Insights into a ransomware operation | Analysis of 15 intrusions revealed tradecraft used by GOLD SHERWOOD affiliates | Ransom blog | SOPHOS |
|
5.9.26 |
Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. | APT blog | GTI | |
|
5.9.26 |
Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works | Supply chain attacks in 2026 are a major breach vector, exposing vendor dependencies and software risks that traditional security tools often miss. | Hacking blog | Cyble |
|
5.9.26 |
The NDA Was the Payload: Inside Phantom Deal, a Fake Acquisition Fraud Campaign | Attackers posed as executives, moved conversations to WhatsApp and personal email, and forged acquisition documents to set up international wire transfers. When they targeted Gen, researchers played along, exposing a wider M&A scam. | CyberCrime blog | GENDIGITAL |
|
5.9.26 |
ASCII smuggling crosses over from AI prompt injection to phishing evasion | Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them. | Phishing blog | Microsoft blog |
|
5.9.26 |
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node. | Cyber blog | Microsoft blog |
|
5.9.26 |
Counterfeit installers to system compromise: Tracking a deceptive software download campaign | An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. | Cyber blog | Microsoft blog |
|
5.9.26 |
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America | We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Corroborating recent findings from the broader threat intelligence community, we observed attackers leveraging artificial intelligence (AI) to enhance their capabilities. | AI blog | Palo Alto |
|
5.9.26 |
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation | Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransom attack. The agents breached the company's security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. | AI blog | Palo Alto |
|
5.9.26 |
Oracle HTTP & WebLogic Servers Proxy Plug-in Authentication Bypass | The SonicWall Capture Labs threat research team became aware of an unauthenticated authentication bypass vulnerability in Oracle HTTP & WebLogic Servers, assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
|
5.9.26 |
Orova: A New Linux Ransomware Targeting ESXi Hypervisors | This week, the SonicWall Capture Labs Threat Research Team identified and analyzed an emerging ransomware family known as Orova. The sample is an ELF 64-bit binary targeting Linux servers and VMware ESXi hypervisors. This target has drawn growing attention from ransomware operators due to the concentrated value of virtual machine datastores. | Ransom blog | SonicWall |
|
5.9.26 |
The story behind the intelligence | From engaging with cybercriminals to surviving a live Flamin’ Hot Cheetos taste test, Hazel reflects on the latest Beers with Talos with Azim, where they cover the full spectrum of what it takes to gather threat intel. | Cyber blog | CISCO TALOS |
|
5.9.26 |
I’ve been deepfaked: What do I do? | Don’t panic if you spot an illegally created image or video of you online – there are ways to request its removal | Cyber blog | Eset |
|
5.9.26 |
This month in security with Tony Anscombe – August 2026 edition | Details about the Hugging Face hack, critical infrastructure under attack, a spoofed in-flight Wi-Fi network, and more of this month's cybersecurity news | Cyber blog | Eset |
|
5.9.26 |
The Bug Report – August 2026 Edition | This blog will walk through the complete kill chain: an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm. | Vulnerebility blog | TRELLIX |
|
3.9.26 |
Mini Shai-Hulud's Latest Wave: 280 New Places | A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, crypto wallets, and CI/CD tools. | Cryptocurrency blog | GITGUARDIAN |
|
3.9.26 |
Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist | In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware. | BigBrother blog | CITIZENLAB |
|
3.9.26 |
Docker OIDC connections for GitHub Actions available for Docker Orgs | TL;DR: Docker now supports OpenID Connect (OIDC) for GitHub Actions. Your workflows can authenticate with short-lived, per-run tokens instead of stored PATs or OATs. No secrets to rotate, no credentials to leak. | Security blog | DOCKER |
|
3.9.26 |
Node.js: Old Technique Makes a Comeback | The trusted JavaScript runtime has featured in multiple attacks since February 2026, some linked to ransomware. In one case, attackers installed it from its official site to run an implant commanded via the Ethereum blockchain. | Hacking blog | SECURITY.COM |
|
3.9.26 |
EtherHiding: Blockchain Technology as a Cyber Weapon | In the cybercrime world, a strange cat and mouse game is continuously taking place. Cybersecurity researchers tirelessly hunt attackers' infrastructures. As soon as some of their components are discovered and brougth to light, they quickly become obsolete because of their addition on IOC's lists that strengthen cybersecurity equipments. This is why attackers must be able to constantly adapt themselves. | Hacking blog | STORMSHIELD |
|
3.9.26 |
EtherHiding Exposed: What Security Leaders Need to Know | Attackers have compromised the websites of at least 31 legitimate businesses, including e-commerce, professional services and retail logistics organizations. Visitors arriving to the compromised sites via search engine encounter a fake “Verify you’re human”. | Hacking blog | GUIDESECURITY |
|
3.9.26 |
FBI Investigates Nexus Claim of 153M+ ID Records | A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. | Incident blog | SOCRADAR |
|
3.9.26 |
Kali365 phishing kit abuses Microsoft authentication | The Kali365 phishing kit epitomizes a major shift in phishing, from stealing passwords to abusing legitimate authentication processes. | Phishing blog | BARRACUDA |
|
3.9.26 |
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action | This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is a well established kit in the Chinese community with over 267 ready-made phishing templates targeting over 54 countries worldwide. | Phishing blog | GROUP-IB |
|
3.9.26 |
eSentire Wins 5 G2 Badges in the Fall 2026 Grid® Report | We are thrilled to share that eSentire has once again been recognized with multiple badges by G2 as part of their Fall 2026 Grid® Reports! The quarterly G2 Grid® Reports provide a high-level overview of the top leaders in any given product category, based on peer-to-peer feedback from real customers and market presence (based on market share, seller size, and social impact). | Security blog | ESENTIRE |
|
3.9.26 |
REVSTEALER ramps up: analysis of up-and-coming infostealer | REVSTEALER's credential harvesting reaches 225 browser extensions and 51 crypto wallets, its gaming session theft needs no password, and its backup C2 address sits on the Polygon blockchain waiting for the primary server to fail. | Malware blog | ELASTIC |
|
3.9.26 |
Linux Detection Engineering - Fileless Execution | We reproduced five Linux fileless execution patterns with FENIX, including memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads, then mapped each to the Elastic Defend rules that catch it. | OS Blog | ELASTIC |
|
3.9.26 |
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity | Huntress is observing the same anomalous pattern across unrelated endpoints in various organizations: rogue ScreenConnect clients repeatedly spawning wscript.exe to execute 1.vbs, 2.vbs, 3.vbs, and 4.vbs. | Malware blog | Huntress |
|
3.9.26 |
Release Notes: Faster TI Investigations & 650+ Threat Updates | Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity. | Security blog | ANYRUN BLOG |
|
3.9.26 |
Counterfeit installers to system compromise: Tracking a deceptive software download campaign | Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. | Cyber blog | Microsoft blog |
|
3.9.26 |
Clop Never Left: Inside the PTC Windchill Data Theft Campaign | Patch CVE-2026-12569, but do not confuse patching with scoping. Hunt back to early June for hex-named JSP files in the Windchill codebase login directory, for flst.txt, and for the X-windchill-req header if you happen to log headers. | Cyber blog | SUCERONIX |
|
3.9.26 |
Langflow and Rails Exploitation Raises Credential Risks | Attackers are exploiting two separate critical vulnerabilities affecting Langflow and Ruby on Rails. CVE-2026-0768 allows unauthenticated attackers to execute Python code on affected Langflow deployments, while CVE-2026-66066 can expose files and application secrets through Rails Active Storage. | Vulnerebility blog | SOCRADAR |
|
3.9.26 |
Kim Sooki again? This time, it was disguised as a request for seafood ingredients | A request to review the purchase of seafood ingredients arrived. When the file is opened, a normal hwp document appears, but while the user is reviewing the contents, a malicious script runs in the background and even registers a scheduled task. | Hacking blog | AHNLAB |
|
3.9.26 |
“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing | People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship. | Malware blog | AHNLAB |
|
3.9.26 |
BlueKit PhaaS in the Wild: BitM, Geofencing, and ScreenConnect Post-Exploitation | The campaign did not stop at credential or session theft. After a BlueKit browser-in-the-middle flow, selected victims were moved into a fake document-viewer workflow that delivered a legitimate ScreenConnect client configured for an attacker-used ScreenConnect cloud instance. | Phishing blog | ZEROBEC BLOG |
|
2.9.26 |
Your Security Vendor May Not Be Telling You the Truth About Your MTTD – Here's Why | That would be inaccurate. The robbery did not start when the security guard called 911. It started when the attacker entered the building. Those first 45 minutes matter. They are the difference between understanding the full incident and reporting only the moment it becomes visible. | Security blog | RELIAQUEST |
|
2.9.26 |
Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction | That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, more pressure on Tier 2, and higher delivery costs. | Security blog | ANYRUN BLOG |
|
2.9.26 |
Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk | August’s attacks showed how quickly trusted business activity can turn into risk. Across the US and Europe, attackers abused Microsoft 365 sessions, legitimate remote-management tools, business-themed files, and even hiring processes to reach corporate systems. | Hacking blog | ANYRUN BLOG |
|
2.9.26 |
The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT | Between late July and mid August 2026, multiple Huntress-protected organizations were hit by the same modular RAT, three of which were hit within an 85-minute window. Victims were tricked into downloading a JavaScript file that quietly pulled down an installer for a real, working Exodus crypto wallet, with the RAT hidden inside. | Cryptocurrency blog | Huntress |
|
2.9.26 |
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse | Threat actors are abusing Faronics Deploy, a legitimate endpoint management platform, to execute attacker-controlled PowerShell after phishing victims install the software. | Hacking blog | Huntress |
|
2.9.26 |
Proofpoint Sponsors the Insider Threat Matrix: Building a Common Language for Insider Risk | Today, Proofpoint is proud to sponsor the Insider Threat MatrixTM, an open, community-driven framework designed to help organizations better understand, detect, and investigate insider risk—both human and synthetic. | Cyber blog | PROOFPOINT |
|
2.9.26 |
Beyond Device Code Phishing: Preparing for the Next Wave of AI-Powered Attacks | Cybercriminals have always embraced new technologies to improve their effectiveness. Today, artificial intelligence has become another tool that can help threat actors operate faster and at greater scale. | Phishing blog | PROOFPOINT |
|
2.9.26 |
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon | A Chinese-speaking actor is now targeting Brazil. Check Point Research has uncovered a sustained campaign against Brazilian organizations, primarily government and educational institutions since mid-2025. | APT blog | CHECKPOINT |
|
2.9.26 |
Uncovering StreamRat: From Meta Ads to Full Device Takeover | ThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately 570,000 potential victims. | Malware blog | THREATFABRIC |
|
2.9.26 |
Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet | We used AI assistance to successfully port a remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) model to another. | ICS blog | FORESCOUT |