Nostr notes by The Hacker News (RSS Feed)

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 ...

2026-09-21T08:39:38Z

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript.

"ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ...

2026-09-21T06:06:44Z

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks.

Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple

https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest ...

2026-09-18T10:40:06Z

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit.

The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html

RatHat Android Malware Abuses ADB to Retain Shell Access After ...

2026-09-18T06:17:25Z

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.

"Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses

https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal ...

2026-09-15T18:54:14Z

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN.

Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and

https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts ...

2026-09-13T10:11:48Z

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments.

The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers

https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html

Google Play Early Access Abused to Push Thousands of Deceptive ...

2026-09-10T14:36:47Z

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content.

Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their

https://thehackernews.com/2026/09/google-play-early-access-abused-to-push.html

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA ...

2026-09-09T14:23:55Z

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others.

Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API

https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution ...

2026-09-09T09:11:03Z

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild.

The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine.

"Out-of-bounds write in V8 in Google Chrome prior to

https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable ...

2026-09-08T11:22:07Z

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says.

FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software.

The

https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html

Fake IT Calls Target Executives in Microsoft 365 Data Theft and ...

2026-09-07T15:51:56Z

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins.

The activity, which mainly singles out directors, vice presidents, and other executive staff

https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html

Attackers Breached JetBrains Cadence via Unpatched TeamCity, ...

2026-09-05T16:52:33Z

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment.

"Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.

https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html

Phishing Campaign Sends Millions of Emails Using Invisible ...

2026-09-04T15:57:15Z

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters.

"Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said.

The

https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other ...

2026-09-02T14:06:59Z

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication.

The command executes as the user, outside the agent's sandbox and without an approval prompt, and exploitation requires the repository to arrive

https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form ...

2026-09-02T10:53:49Z

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks.

The vulnerabilities, discovered internally by SonicWall's William Perry and Adam Babis, are listed below -

CVE-2026-83548 (CVSS score: 10.0) - A pre-authentication SSRF vulnerability in the Appliance

https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC ...

2026-09-02T07:47:13Z

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware.

The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command

https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html

Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs ...

2026-09-01T13:08:58Z

Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript.

Russian cybersecurity company Kaspersky is tracking the

https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, ...

2026-08-27T07:05:28Z

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation.

The vulnerabilities are listed below -

CVE-2019-1068 - A remote code execution vulnerability in

https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other ...

2026-08-26T10:27:23Z

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs.

The original incident was first reported by ABC News on August 10, based on chat logs and screenshots the user supplied. He had asked an

https://thehackernews.com/2026/08/claude-opus-46-bypasses-gym-booking.html

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP ...

2026-08-20T06:04:34Z

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.

The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type.

"The flaw lives in the Forms module's File

https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread ...

2026-08-19T11:25:28Z

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity.

"The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software

https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html

16 Typosquatted RubyGems Packages Steal Browser Credentials and ...

2026-08-18T11:40:06Z

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer.

OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below -

ubnuler
ubnlder
ri18nr
reaker
rakier
orakw
joxn

https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html

SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly ...

2026-08-18T09:10:45Z

SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers

SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers.

The hardware wallet maker said all affected customers were notified individually by email on August 16 from security@safepal.com, with the subject line "[Important] Your SafePal Order

https://thehackernews.com/2026/08/safepal-hardware-wallet-maker-says-flaw.html

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into ...

2026-08-06T09:19:23Z

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine.

Huntress, which tracks the toolkit as khunt,

https://thehackernews.com/2026/08/attackers-compile-khunt-inside-oracle.html

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal ...

2026-08-04T17:27:39Z

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and seize control of user accounts.

"Greatness supports AiTM [adversary-in-the-middle] credential and

https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy ...

2026-08-03T10:49:06Z

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit.

Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit.

"

https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and ...

2026-07-29T15:39:30Z

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution.

The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's

https://thehackernews.com/2026/07/ruflo-mcp-flaw-lets-unauthenticated.html

The Federal Security Service of the Russian Federation (FSB) on ...

2026-07-29T11:00:00Z

The Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly facilitating terrorist activities and for failing to remove prohibited information in violation of Russian law.

The principal security agency said the instant messaging platform "failed to remove numerous channels, chats, and bots on the platform that are

https://thehackernews.com/2026/07/russia-charges-telegram-founder-pavel.html

Public PoC Released for Exploited Check Point SmartConsole ...

2026-07-29T08:58:27Z

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild.

The vulnerability, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass in the SmartConsole login process that

https://thehackernews.com/2026/07/rapid7-releases-poc-for-exploited-check.html

Two Compromised joyfill npm Packages Run RAT When Imported Into ...

2026-07-29T04:20:57Z

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family.

The list of affected packages is as follows -

@joyfill/layouts@0.1.2-2773.beta.0
@joyfill/components@4.0.0-rc24-2773-beta.4

The two packages "contain an import-time JavaScript implant that resolves encrypted code

https://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.html

Researcher Publishes GitLab RCE PoC Letting Authenticated Users ...

2026-07-25T08:34:15Z

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server.

An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and requesting their diff. The chain needs no administrator rights, continuous integration (CI) runner access, victim interaction

https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html

Seeing AI Agents Is Not Enough. Security Teams Must Enforce What ...

2026-07-24T11:30:00Z

Seeing AI Agents Is Not Enough. Security Teams Must Enforce What They Can Do

AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering to identity-layer access controls. Where we've collectively landed is that understanding the intent of

https://thehackernews.com/2026/07/seeing-ai-agents-is-not-enough-security.html

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks ...

2026-07-24T06:50:57Z

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that's dressed up as a Notepad++ plugin to compromise Windows systems.

The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously observed weaponizing security flaws in WinRAR software to

https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail ...

2026-07-23T18:36:08Z

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client.

The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it.

The NSA, CISA and partner agencies published

https://thehackernews.com/2026/07/russian-espionage-group-exploited.html

Why Modern SOCs Need Multi-Layered Detections The cycle is over. ...

2026-07-22T11:25:35Z

Why Modern SOCs Need Multi-Layered Detections

The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely.

The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on

https://thehackernews.com/2026/07/why-modern-socs-need-multi-layered.html

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass ...

2026-07-21T14:04:57Z

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments.

Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway

https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html

WordPress wp2shell Exploitation Grows as Public Exploit Fuels ...

2026-07-21T08:59:30Z

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.

The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell.

"By the early hours of Saturday morning (UTC), successful exploitation was already well

https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html

New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE ...

2026-07-21T07:34:32Z

New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month.

The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem.

The entry

https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows ...

2026-07-15T10:55:22Z

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to execute.

Whatever that binary does, it does as you, with your source, your SSH keys and your cloud tokens. Cursor keeps re-running it for as long as the project stays open.

No prompt

https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI ...

2026-07-13T15:05:57Z

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More

Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.

That's the shape of this week. Trusted code turns on the people who installed it. Old bugs from last year are still landing because the fix sat in a queue too

https://thehackernews.com/2026/07/weekly-recap-sharefile-threat-citrix.html

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 ...

2026-07-10T11:47:43Z

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch.

FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no login and no malformed packets: about 260 bytes of ordinary QPACK traffic takes the server

https://thehackernews.com/2026/07/unpatched-xring-flaw-in-xquic-lets.html

Dormant GitHub Accounts Help Attackers Blend In While Mapping ...

2026-07-09T18:38:49Z

Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs

Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API.

"Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old, or compromised OAuth tokens and personal

https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html

15-Year-Old GhostLock Flaw Enables Root and Container Escape on ...

2026-07-08T06:16:44Z

15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros

Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched.

The vulnerable code has shipped by default in essentially every mainstream distribution since 2011. The flaw needs no special permission, no unusual settings, and no network

https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent ...

2026-07-06T13:01:14Z

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary.

Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throughout: trust

https://thehackernews.com/2026/07/monday-recap-proxy-botnets-browser.html

New TrojPix Attack Leaks Data From Air-Gapped Systems via Video ...

2026-07-06T08:50:54Z

New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions

Researchers at Shandong University have shown a fast new way to pull data off computers that are cut off from every network. The technique, called TrojPix, tweaks on-screen pixels in ways the eye cannot see, so that the video cable carrying them radiates a faint radio signal a nearby receiver can decode.

But TrojPix works only once malware is already on the target machine, so it

https://thehackernews.com/2026/07/new-trojpix-attack-leaks-data-from-air.html

Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver ...

2026-06-30T11:18:47Z

Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer

An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer.

The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated

https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html

Apple Patches 30+ iOS, macOS, Safari Flaws, Including ...

2026-06-30T07:15:07Z

Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs

Apple on Monday released security updates for iOS, macOS, and the Safari web browser to address over three dozen flaws, including four vulnerabilities in WebKit that were discovered using artificial intelligence (AI) tools like Anthropic Claude and OpenAI Codex Security.

The WebKit vulnerabilities are listed below -

CVE-2026-43707 - A memory corruption issue that could result in an

https://thehackernews.com/2026/06/apple-patches-30-ios-macos-safari-flaws.html

OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger ...

2026-06-27T12:19:37Z

OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards

OpenAI on Friday released three versions of GPT-5.6, called Sol, Terra, and Luna, as a limited preview to a small number of companies as part of an ongoing engagement with the U.S. government.

While Sol is the latest flagship model and the most powerful, Terra strikes a balance between efficiency and power, and Luna is fine-tuned for speed and affordability.

"GPT‑5.6 Sol launches with our most

https://thehackernews.com/2026/06/openai-limits-gpt-56-rollout-as-sol.html

New Linux pedit COW Exploit Enables Root Access by Poisoning ...

2026-06-26T13:00:41Z

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.

CVE-2026-46331, nicknamed "pedit COW," is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as

https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain ...

2026-06-25T05:46:54Z

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant.

The vulnerability, tracked as CVE-2026-20245 (CVSS score: 7.8), allows an authenticated, local attacker to execute arbitrary commands with elevated privileges

https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-zero-day-cve-2026.html

GitHub Updates actions/checkout to Block Common Pwn Request ...

2026-06-23T14:22:03Z

GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns

GitHub is moving to strengthen software supply chain security by updating "actions/checkout" to block pwn request attacks that exploit the risky use of the "pull_request_target workflow" trigger to run malicious code with the workflow's full privileges.

Effective June 18, 2026, the latest version of "actions/checkout," the official GitHub action for checking out a repository into the

https://thehackernews.com/2026/06/github-updates-actionscheckout-to-block.html

ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain ...

2026-06-22T18:00:48Z

ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with the official release channels and push backdoor code.

"Attackers compromised the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels," Wordfence said in an analysis

https://thehackernews.com/2026/06/shapedplugin-wordpress-pro-plugins.html

29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak ...

2026-06-22T14:29:46Z

29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests

A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session tokens it carries, to anyone already allowed to send traffic through the same proxy.

The bug traces to a 1997 FTP-parsing change and is still live in Squid's default configuration. Researchers at Calif.io disclosed it in June and named it Squidbleed (

https://thehackernews.com/2026/06/29-year-old-squid-proxy-bug-squidbleed.html

New OXLOADER Loader Uses Malicious Google Ads to Deliver ...

2026-06-22T13:20:12Z

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER.

According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. Evidence indicates that the threat actor is likely Russian-speaking and financially motivated, owing to the

https://thehackernews.com/2026/06/new-oxloader-loader-uses-malicious.html

INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising ...

2026-06-22T06:06:53Z

INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific

A new report from INTERPOL has revealed a "dramatic increase" in cybercrime in Asia and the South Pacific, fueled by rapid digitalization, internet penetration, new technologies, organized criminal networks, and a disparity in cybersecurity maturity.

According to INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report, phishing has emerged as the most widespread and

https://thehackernews.com/2026/06/interpol-warns-phishing-ransomware-and.html

Malicious JetBrains Plugins Steal AI API Keys as Chrome ...

2026-06-17T09:38:46Z

Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

Cybersecurity researchers have flagged a "coordinated malware campaign" on the JetBrains Marketplace that has published no less than 15 malicious plugins capable of exfiltrating artificial intelligence (AI) provider keys.

"Every plugin poses as an AI coding assistant built on DeepSeek and other large language models, offering chat, commit messages, code review, bug finding, and unit tests,"

https://thehackernews.com/2026/06/malicious-jetbrains-plugins-steal-ai.html

144 Mastra npm Packages Compromised via Hijacked Contributor ...

2026-06-17T07:38:24Z

144 Mastra npm Packages Compromised via Hijacked Contributor Account

As many as 144 npm packages associated with the Mastra namespace ("@mastra/*"), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI) applications, have been compromised as part of a software supply chain attack codenamed easy-day-js, per findings from JFrog, SafeDep, Socket, and StepSecurity.

"A single npm account (ehindero) mass-published more

https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html

Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched ...

2026-06-16T10:30:41Z

Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week

Bad actors are exploiting multiple security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber.

In a post shared on X, the company said it has observed exploitation of CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 over the past 24 hours.

CVE-2026-39813 (CVSS score: 9.1) refers to a path traversal vulnerability in FortiSandbox JRPC API that could

https://thehackernews.com/2026/06/attackers-exploit-three-fortinet.html

Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT ...

2026-06-16T08:14:55Z

Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware

The North Korean state-sponsored hacking group known as ScarCruft (aka APT37) has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver malware called NarwhalRAT.

"The attack email contained a message impersonating an MS account security alert," the Genians Security Center (GSC) said. "It was designed to create concern over possible

https://thehackernews.com/2026/06/fake-microsoft-alerts-used-to-deploy.html

North Korean Hackers Are Turning Developer Tools Into Malware ...

2026-06-15T19:32:52Z

North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels

Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi).

According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes

https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html

Agentjacking Attack Tricks AI Coding Agents Into Running ...

2026-06-12T12:04:33Z

Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code

Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines.

Called Agentjacking by Tenet Security, the attack can be triggered by means of a fake error report crafted using Sentry, an open-source error-tracking and performance-monitoring platform.

"The attack

https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html

Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to ...

2026-06-10T05:08:35Z

Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

Cybersecurity researchers have flagged half a dozen vulnerabilities in protobuf.js, a JavaScript and TypeScript implementation of Protocol Buffers (Protobuf), that, if successfully exploited, could result in remote code execution (RCE) and denial-of-service (DoS) attacks.

"In affected environments, a single malicious protobuf schema, descriptor, or crafted payload could be enough to trigger

https://thehackernews.com/2026/06/six-proto6-vulnerabilities-in.html

Microsoft Restores Some GitHub Repos, Keeps Others Offline as ...

2026-06-09T16:34:52Z

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues

Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to 73 of its open-source projects being compromised to inject an information stealer into the code.

"Our priority is to protect customers and the broader ecosystem," a Microsoft spokesperson told The Hacker News via email. "We temporarily removed some

https://thehackernews.com/2026/06/microsoft-restores-some-github-repos.html

The Hidden Security Risk in Modern Networks: The Work Between ...

2026-06-09T11:30:00Z

The Hidden Security Risk in Modern Networks: The Work Between Tools

Organizations have more visibility than ever. Growing tech stacks provide greater coverage, and network security teams are increasingly adopting AI and automation to help with routine tasks and reduce manual effort.

But the same challenges persist. Outages still last hours, causing significant financial losses, operational disruption, and reputational impact. Threat response and mean time to

https://thehackernews.com/2026/06/the-hidden-security-risk-in-modern.html

AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce ...

2026-06-08T13:00:00Z

AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload

Phishing has always been a numbers game. AI has turned it into a volume machine.

Attackers can now create convincing emails, fake login pages, and tailored lures in minutes. Every polished message adds another case for Tier 1 to review, another link to inspect, and another alert that cannot be dismissed at a glance.

As the queue grows, a credential theft attempt or malware delivery can easily

https://thehackernews.com/2026/06/ai-phishing-is-crushing-socs-with-alert.html

Claude Code GitHub Action Flaw Let One Malicious Issue Hijack ...

2026-06-04T15:15:26Z

Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

A security researcher found a flaw in Anthropic's Claude Code GitHub Action that let an attacker take over vulnerable public repositories running it, with nothing more than a single opened GitHub issue. Because Anthropic's own action repo used the same workflow, a working attack could have pushed malicious code into the action itself and onto the projects downstream that pull it.

RyotaK of GMO

https://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.html

China-Linked TA4922 Expands Phishing Attacks to UK, Germany, ...

2026-06-04T12:22:25Z

China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa

A new China-linked cybercrime group known as TA4922 has expanded its targeting focus to target European organizations in the U.K., Germany, Italy, and South Africa.

These efforts have been complemented by a "rapid operational tempo" and a continually evolving malware arsenal comprising known families like ValleyRAT (aka Winos 4.0) and Atlas RAT (aka AtlasCross RAT), as well as previously

https://thehackernews.com/2026/06/china-linked-ta4922-expands-phishing.html

AI-Driven Exploitation is Destroying Vulnerability Management. ...

2026-06-02T11:58:00Z

AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It.

AI-driven exploitation timelines are rapidly shrinking, and they are not going to stop shrinking. Vulnerabilities are being discovered, reproduced, and weaponized faster than ever in the history of enterprise security. As a result, the window between a vulnerability being disclosed and indiscriminate exploitation observed across the internet is now measured in hours, not days.

The industry's

https://thehackernews.com/2026/06/ai-driven-exploitation-is-destroying.html

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered ...

2026-06-01T13:59:54Z

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More

Monday hit like a cron job with anger issues.

A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI lowering the bar for people who already thought 'curl | sh' had a personality.

The vibe is simple: old

https://thehackernews.com/2026/06/weekly-recap-new-linux-flaw-pan-os.html

AI Chatbot Recommendations Redirect Users to Cryptojacking ...

2026-05-27T07:45:52Z

AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites

Microsoft has warned of an active cryptojacking campaign that makes use of artificial intelligence (AI) chatbot interactions as a mechanism for surfacing malicious download sites.

"This emerging delivery technique extends social engineering beyond conventional search results and increases the visibility of malicious software recommendations," Microsoft Defender Experts and the Microsoft

https://thehackernews.com/2026/05/ai-chatbot-recommendations-redirect.html

New AI DDoS Attacks Are Smarter. Learn How to Fight Back in This ...

2026-05-26T11:58:00Z

New AI DDoS Attacks Are Smarter. Learn How to Fight Back in This Webinar

Every single day, hackers are finding new ways to crash websites and steal data.

But right now, something has changed. Hackers are no longer working alone. They are now using powerful Artificial Intelligence (AI) tools to make their attacks faster, stronger, and much harder to stop.

According to recent updates from The Hacker News, bad actors are using AI to find weak spots in systems and

https://thehackernews.com/2026/05/new-ai-ddos-attacks-are-smarter-learn.html

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ...

2026-05-25T12:02:46Z

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks.

According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost's Content API that could allow an unauthenticated attacker to read arbitrary data from the

https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html

Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents ...

2026-05-20T17:06:54Z

Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development

Microsoft has unveiled two new open-source tools called RAMPART and Clarity to assist developers in better testing the security of artificial intelligence (AI) agents.

RAMPART, short for Risk Assessment and Measurement Platform for Agentic Red Teaming, functions as a Pytest-native safety and security testing framework for writing and running safety and security tests for AI agents, covering

https://thehackernews.com/2026/05/microsoft-open-sources-rampart-and.html

DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE ...

2026-05-19T14:56:26Z

DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability

Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE).
Dubbed DirtyDecrypt (aka DirtyCBC), the vulnerability was discovered and reported by the Zellic and V12 security team on May 9, 2026, only to be informed by the maintainers that it was a duplicate of a vulnerability that had

https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html

GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD ...

2026-05-19T05:28:06Z

GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials

In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server.

"Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action's normal commit history,

https://thehackernews.com/2026/05/github-actions-supply-chain-attack.html

Developer Workstations Are Now Part of the Software Supply Chain ...

2026-05-18T11:23:41Z

Developer Workstations Are Now Part of the Software Supply Chain

Supply chain attackers are not only trying to slip malicious code into trusted software. They are trying to steal the access that makes trusted software possible. Recently, three separate campaigns hit npm, PyPI, and Docker Hub in a 48-hour window, and all three targeted secrets from developer environments and CI/CD pipelines, including API keys, cloud credentials, SSH keys, and tokens. This is

https://thehackernews.com/2026/05/developer-workstations-are-now-part-of.html

CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access ...

2026-05-15T05:28:03Z

CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits

The U.S.Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly disclosed vulnerability impacting Cisco Catalyst SD-WAN Controller to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the issue by May 17, 2026.
The vulnerability is a critical authentication bypass tracked as CVE-2026-20182. It's

https://thehackernews.com/2026/05/cisa-adds-cisco-sd-wan-cve-2026-20182.html

Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in ...

2026-05-13T13:46:02Z

Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday

Microsoft has unveiled a new multi-model artificial intelligence (AI)-driven system called MDASH to facilitate vulnerability discovery and remediation at scale, adding that it's being tested by some customers as part of a limited private preview.
MDASH, short for multi-model agentic scanning harness, is designed as a model-agnostic system that uses bespoke AI agents for different vulnerability

https://thehackernews.com/2026/05/microsofts-mdash-ai-system-finds-16.html

Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails ...

2026-05-12T08:50:00Z

Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of a fresh Mini Shai-Hulud campaign.
The affected npm packages have been modified to include an obfuscated JavaScript file ("router_init.js") that's designed to profile the execution

https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html

Ollama Out-of-Bounds Read Vulnerability Allows Remote Process ...

2026-05-10T12:41:00Z

Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak

Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory.
The out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482 (CVSS score: 9.1). It has been codenamed Bleeding Llama by Cyera.
Ollama is a

https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html

One Missed Threat Per Week: What 25M Alerts Reveal About ...

2026-05-08T10:30:00Z

One Missed Threat Per Week: What 25M Alerts Reveal About Low-Severity Risk

The dark secret of enterprise security operations is that defenders have quietly institutionalized the practice of not looking. This is not just anecdotal, but rather backed by a recent report investigating more than 25 million security alerts, including informational and low-severity, across live enterprise environments.
The dataset behind these findings includes 10 million monitored

https://thehackernews.com/2026/05/one-missed-threat-per-week-what-25m.html

PAN-OS RCE Exploit Under Active Use Enabling Root Access and ...

2026-05-07T13:34:00Z

PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage

Palo Alto Networks has disclosed that threat actors may have attempted to unsuccessfully exploit a recently disclosed critical security flaw as early as April 9, 2026.
The vulnerability in question is CVE-2026-0300 (CVSS score: 9.3/8.7), a buffer overflow vulnerability in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software that could allow an unauthenticated attacker

https://thehackernews.com/2026/05/pan-os-rce-exploit-under-active-use.html

2026: The Year of AI-Assisted Attacks On December 4, 2025, a ...

2026-05-04T11:58:00Z

2026: The Year of AI-Assisted Attacks

On December 4, 2025, a 17-year-old was arrested in Osaka under Japan’s Unauthorized Access Prohibition Act. The young man had run malicious code to extract the personal data of over 7 million users of Kaikatsu Club, Japan's largest internet cafe chain. When asked, the young man shared his motivation for the hack: he wanted to buy Pokémon cards.
In a sense, this is a fairly conventional story.

https://thehackernews.com/2026/05/2026-year-of-ai-assisted-attacks.html

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in ...

2026-05-04T11:57:00Z

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia

The China-based cybercrime group known as Silver Fox has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor.
The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.
"Both waves followed a nearly identical

https://thehackernews.com/2026/05/silver-fox-deploys-abcdoor-malware-via.html

Trellix Confirms Source Code Breach With Unauthorized Repository ...

2026-05-02T06:41:00Z

Trellix Confirms Source Code Breach With Unauthorized Repository Access

Cybersecurity company Trellix has announced that it suffered a breach that enabled unauthorized access to a "portion" of its source code.
It said it "recently identified" the compromise of its source code repository and that it began working with "leading forensic experts" to resolve the matter immediately. It also said it has notified law enforcement of the matter.
Trellix did not disclose the

https://thehackernews.com/2026/05/trellix-confirms-source-code-breach.html

Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for ...

2026-05-01T09:43:00Z

Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence.
The activity has been attributed to the GitHub account "BufferZoneCorp," which has published a set of repositories that are associated with malicious Ruby gems and Go modules. As of

https://thehackernews.com/2026/05/poisoned-ruby-gems-and-go-modules.html

ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K ...

2026-04-30T13:55:00Z

ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories

The internet is noisy this week. We are seeing some wild new tactics, like people using fake cell towers to send scam texts, while some developers are accidentally downloading tools that peek into their private files during a simple install. It is definitely a busy time to be online.
Security is always a moving target. Millions of servers are currently sitting online without any passwords, and

https://thehackernews.com/2026/04/threatsday-bulletin-sms-blaster-busts.html

New Python Backdoor Uses Tunneling Service to Steal Browser and ...

2026-04-30T12:36:00Z

New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials

Cybersecurity researchers have disclosed details of a stealthy Python-based backdoor framework called DEEP#DOOR that comes with capabilities to establish persistent access and harvest a wide range of sensitive information from compromised hosts.
"The intrusion chain begins with execution of a batch script ('install_obf.bat') that disables Windows security controls, dynamically extracts an

https://thehackernews.com/2026/04/new-python-backdoor-uses-tunneling.html

Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable ...

2026-04-30T07:07:00Z

Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

Google has addressed a maximum severity security flaw in Gemini CLI -- the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems.
"The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,"

https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html

SAP npm Packages Compromised by “Mini Shai-Hulud” ...

2026-04-29T16:26:00Z

SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware

Cybersecurity researchers are sounding the alarm about a new supply chain attack campaign targeting SAP-related npm Packages with credential-stealing malware.
According to reports from Aikido Security, SafeDep, Socket, StepSecurity, and Google-owned Wiz, the campaign – calling itself the mini Shai-Hulud – has affected the following packages associated with SAP's JavaScript and cloud application

https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html

Brazilian LofyGang Resurfaces After Three Years With Minecraft ...

2026-04-28T17:39:00Z

Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign

A cybercrime group of Brazilian origin has resurfaced after more than three years to orchestrate a campaign that targets Minecraft players with a new stealer called LofyStealer (aka GrabBot).
"The malware disguises itself as a Minecraft hack called 'Slinky,'" Brazil-based cybersecurity company ZenoX said in a technical report. "It uses the official game icon to induce voluntary execution,

https://thehackernews.com/2026/04/brazilian-lofygang-resurfaces-after.html

Mythos Changed the Math on Vulnerability Discovery. Most Teams ...

2026-04-27T11:58:00Z

Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren't Ready for the Remediation Side

Anthropic’s Claude Mythos Preview has dominated security discussions since its April 7 announcement. Early reporting describes a powerful cybersecurity-focused AI system capable of identifying vulnerabilities at scale and raising serious questions about how quickly organizations can validate, prioritize, and remediate what it finds.
The debate that followed has mostly focused on the right

https://thehackernews.com/2026/04/mythos-changed-math-on-vulnerability.html

PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian ...

2026-04-27T11:54:00Z

PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025.
That's according to a report published by Positive Technologies, which found the threat actors to be leveraging an exploit chain comprising three vulnerabilities to execute commands remotely on susceptible

https://thehackernews.com/2026/04/phantomcore-exploits-trueconf.html

Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting ...

2026-04-25T09:26:00Z

Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software

Cybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran's nuclear program by destroying uranium enrichment centrifuges.
According to a new report published by SentinelOne, the previously undocumented cyber sabotage framework dates back to 2005, primarily targeting high-precision calculation software to tamper

https://thehackernews.com/2026/04/researchers-uncover-pre-stuxnet-fast16.html

UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy ...

2026-04-23T18:16:00Z

UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware

A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
"As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account

https://thehackernews.com/2026/04/unc6692-impersonates-it-helpdesk-via.html

No Exploit Needed: How Attackers Walk Through the Front Door via ...

2026-04-21T11:30:00Z

No Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks

The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn't changed: stolen credentials.
Identity-based attacks remain a dominant initial access vector in breaches today. Attackers obtain valid credentials through credential stuffing

https://thehackernews.com/2026/04/no-exploit-needed-how-attackers-walk.html

Analysis of 216M Security Findings Shows a 4x Increase In ...

2026-04-14T10:00:00Z

Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)

OX Security recently analyzed 216 million security findings across 250 organizations over a 90-day period. The primary takeaway: while raw alert volume grew by 52% year-over-year, prioritized critical risk grew by nearly 400%.
The surge in AI-assisted development is creating a "velocity gap" where the density of high-impact vulnerabilities is scaling faster than

https://thehackernews.com/2026/04/analysis-of-216m-security-findings.html

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and ...

2026-04-12T05:54:00Z

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Unknown threat actors compromised CPUID ("cpuid[.]com"), a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT.
The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00 UTC, with

https://thehackernews.com/2026/04/cpuid-breach-distributes-stx-rat-via.html

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; ...

2026-04-07T05:56:00Z

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck.
The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that could result in remote code execution.
"The CustomMCP node allows users to input configuration settings for connecting

https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable ...

2026-04-06T10:07:00Z

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver (BYOVD) technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro.
Qilin attacks analyzed by Talos have been found to deploy a malicious DLL named "msimg32.dll,"

https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html