News

667 items in the last 3d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 129 Advisory 124 Research 83 Exploit / PoC 76 Industry 58 Data breach 40 Malware 38 Tools 36 Threat actor 31 Policy & legal 31 Phishing & fraud 17 Ransomware 4

SeverityAll critical 42 high 184 medium 172 low 49 info 220

Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theftnew

Jenkins patched 20 vulnerabilities across 13 plugins, including Groovy sandbox bypasses enabling remote code execution on CI/CD controllers.

Jenkins released security updates on September 16, 2026 for 20 vulnerabilities across 13 plugins, including nine fixes in the Script Security Plugin for Groovy sandbox bypasses. CVE-2026-92127 (classpath abuse) and CVE-2026-92128 (TOCTOU race on remote JAR loading) could allow arbitrary code execution in the controller JVM, exposing build secrets, credentials, and downstream deployment environments. Other flaws include stored XSS in the Warnings, Coverage, OWASP Dependency-Check and Gitee plugins, SSRF in the Gradle and Bitbucket plugins enabling credential capture, credential exposure via CVE-2026-92130, arbitrary file write via CVE-2026-92137, OAuth token theft, and an open redirect in the Keycloak Authentication Plugin. No exploitation is reported; fixes include Script Security Plugin 1422.v06869826dd9b_.

GBHackers06:21 UTC · 19m agoVulnerability CVE-2026-92122 CVE-2026-92123 CVE-2026-92124+17 CVEs

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Daynew

Cisco urgently patched actively exploited zero-day CVE-2026-76460 (CVSS 10.0), an ISE authentication bypass enabling root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76460 (CVSS 10.0), a zero-day authentication bypass in an API endpoint of Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), and confirmed active exploitation in the wild. Successful exploitation lets attackers bypass the web-based management interface and execute commands with root privileges, allowing them to hide or delete indicators of compromise. Fixed releases are ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12; no workarounds exist beyond restricting traffic with infrastructure ACLs. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving US federal agencies three days to patch under BOD 26-04.

SecurityWeek06:19 UTC · 20m agoExploit / PoC in the wild 16 sources CVE-2026-76460

Riverbed NPM 360 uses AI to predict and prevent network disruptionsnew

Riverbed launched Network 360 observability offerings embedding agentic AI (Riverbed IQ and Q) into AppResponse and NetProfiler for predictive network troubleshooting.

Riverbed announced its Network 360 intelligent network observability solutions, natively integrating the agentic AI layers Riverbed IQ and Riverbed Q into AppResponse and NetProfiler, with NPM+ extending visibility across remote users, Zero Trust, and public cloud. Riverbed IQ applies causal, predictive, generative, and agentic AI to correlate network evidence, identify root causes, and recommend actions, while Q provides a natural-language conversational assistant for investigations. The launch aims to shift NetOps teams from manual, reactive troubleshooting to AI-guided workflows that predict and prevent disruptions before user impact.

Help Net Security06:13 UTC · 27m agoIndustry

Tuskira Vector brings autonomous red teaming to attack surface validationnew

Tuskira launched Vector, an autonomous red teaming agent that validates exploitable external attack surface against deployed controls using a Security Data Fabric digital twin.

Tuskira announced Vector, an agentic autonomous red teaming capability that simulates attacker behavior from outside an organization to identify its exploitable attack surface. Findings are validated against deployed compensating controls, internal risk data, and application/infrastructure topology via Tuskira's Security Data Fabric, which normalizes third-party tool signals into a live digital twin. The release extends Kairo (introduced May 2026), adding red team sensors and an agentic defense loop spanning agents Kairo, Lattice, Quell, and Iris. Tuskira claims Kairo has deprioritized up to 99% of scanner findings as unreachable and recomputes breach-path maps in minutes.

Help Net Security06:01 UTC · 38m agoTools

NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor

Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.

Kaspersky's Global Emergency Response Team attributes new intrusions against Russian companies to NightEagle (APT-Q-95), active since at least 2023 and previously focused on Asian organizations. The group uses valid VPN credentials, deploys the .NET-based GhostContainer backdoor on Microsoft Exchange servers, and tunnels RDP via Microsoft Dev Tunnels and rdp2tcp. In one incident operators exploited BlueKeep (CVE-2019-0708) to create an administrator account, and they performed DCSync replication against Active Directory to harvest domain password hashes. GhostContainer reuses code from Neo-reGeorg, ExchangeCmdPy.py (CVE-2020-0688), and ysoserial, and tampers with AMSI and Windows event logging to evade detection.

GBHackers05:41 UTC · 58m agoThreat actor in the wild 3 sources CVE-2019-0708 CVE-2020-0688

The AI security question leaders should be asking instead

Gremlin security officer Frederic Bull argues AI has eroded the attacker-defender skill asymmetry while least-privilege controls remain essential for securing AI agents.

In a Help Net Security interview, Gremlin Security Officer Frederic Bull says AI has narrowed the expertise gap between attackers and defenders, enabling faster exploit discovery even by less-skilled actors. His team processed roughly nine times more vulnerabilities in the past year with unchanged staffing using LLM-based tooling, cutting time-to-remediate by about 5%. He argues least privilege, session-based RBAC via OIDC/OBO, and human-in-the-loop oversight remain the bedrock defenses for AI agents, and that hiring should favor engineers able to catch confidently wrong AI output.

Help Net Security05:30 UTC · 1h agoIndustry

Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication

Check Point patched CVE-2026-91843 (CVSS 9.8), an unauthenticated stack overflow enabling remote root code execution on Security Management and Log Servers.

Check Point issued a high-severity alert for CVE-2026-91843, a critical stack overflow (CVSS 9.8, solution sk1000155) in the unauthenticated login workflow of Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. Successful exploitation grants an unauthenticated remote attacker root-level code execution. Affected releases span R80 through R82.20 with Jumbo Hotfix takes at or below specified levels (e.g., R82.20 Take 44, R81.20 Take 166), with several older versions end of support. A LivePatch is available and offline urgent bundles (R81.20-R82.20 Takes 28-29) were released; Smart-1 Cloud is already protected.

GBHackers05:23 UTC · 1h agoVulnerability 10 sources CVE-2026-918431

A flat cybersecurity budget doesn’t have to mean weaker coverage

vCISO Cheri Hotman advises sorting security spend into four buckets to hold coverage steady under flat or cut budgets.

Cheri Hotman, Managing Partner of Hotman Group, shares advice for security leaders facing flat budgets or 12% cuts in a Help Net Security video. She recommends categorizing each expense as effective protection, unoperationalized value, duplicate tooling, or compliance theater instead of trimming every line equally. She notes waste such as companies running three or four GRC tools, and says framing spending in risk and revenue terms improves finance conversations.

Help Net Security05:00 UTC · 1h agoIndustry

Re: Retrospective by 'gpg.fail' authors

oss-security thread on the gpg.fail retrospective discusses legacy code removal and flaws surfaced by frontier AI models in open-source projects.

In a reply to Soatok Dreamseeker's gpg.fail retrospective thread on the oss-security mailing list, cryptographer Peter Gutmann argues it is often unclear which legacy code is obsolete or can be safely removed. He recounts a discussion with another well-known open-source project developer estimating, unscientifically, that around half of issues in such projects were found by frontier AI models. The exchange reflects on lessons from documenting weaknesses in GnuPG/OpenPGP implementations.

oss-security03:19 UTC · 3h agoResearch 9 sources

ISC Stormcast For Thursday, September 17th, 2026 https://isc.sans.edu/podcastdetail/10098, (Thu, Sep 17th)

SANS Internet Storm Center published its daily ISC Stormcast podcast summary for Thursday, September 17th, 2026.

The ISC Stormcast is the SANS Internet Storm Center's routine daily podcast covering current internet security activity. The provided text contains only the podcast listing and license information, with no specific incidents, vulnerabilities, or indicators detailed.

SANS Internet Storm Center02:00 UTC · 4h agoAdvisory 6 sources

Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins

Microsoft's September Windows 11 cumulative update KB5124008 breaks Active Directory domain trust on domain-joined machines, blocking logins despite valid credentials.

Microsoft is investigating community reports that KB5124008, the September 8, 2026 cumulative update for Windows 11 24H2/25H2 (builds 26100.9445/26200.9445), breaks the AD secure channel, causing 'The user name or password is incorrect' errors on interactive logon. Admins reproduced the failure consistently and observed nltest error 1786 (ERROR_NO_TRUST_LSA_SECRET) plus domain controller Event 4625 with status 0xC000006D over NTLM. The problem is suspected in Machine Identity Isolation, a Credential Guard capability that moves machine-account secrets into virtualization-based security, and disabling it via registry value, Group Policy, or Intune baseline restored trust. The September 14 out-of-band update KB5129195 does not address the domain trust issue, and Microsoft's release notes do not list it as a known problem.

Cyber Security News00:29 UTC · 6h agoVulnerability 2 sources

datasette 0.65.5

Datasette 0.65.5 patches a permission bypass where a trailing newline in a table name could expose private rows (GHSA-h547-rmjf-5m2m).

Datasette 0.65.5 fixes a security issue tracked as GHSA-h547-rmjf-5m2m in which a trailing newline in a requested table name bypassed table permission checks and exposed private rows. The flaw was reported by dpfkdlemtp. The same fix is included in the 1.0a40 alpha release.

Simon WillisonSep 16, 23:51 UTC · 6h agoVulnerability 5 sources

CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.

A stack-based buffer overflow was identified in GNU libextractor's OLE2 plugin in versions prior to 1.15, assigned CVE-2026-91752. The flaw resides in the process_star_office function, which sizes a variable-length stack array using attacker-controlled OLE2 stream data. Attackers can craft malicious OLE2/StarOffice files to trigger the overflow. The issue was disclosed on the oss-security mailing list by researcher Haitam Lazaar on September 16, 2026.

oss-securitySep 16, 23:13 UTC · 7h agoVulnerability 2 sources CVE-2026-91752

Canada: Nipigon hospital hit by ransomware attack

Nipigon District Memorial Hospital in Ontario, Canada confirmed a ransomware attack disrupted its IT systems, possibly affecting some patient services.

Nipigon District Memorial Hospital in Nipigon, Ontario announced that a ransomware attack affected its information technology systems. The hospital described the event as a 'cyber security incident' and warned that some patient services may be impacted while it responds. Nipigon Mayor Suzanne Kukko commented on the incident to local media. No threat actor was named and no data exposure or leak was confirmed at the time of disclosure.

DataBreaches.netSep 16, 22:47 UTC · 7h agoRansomware in the wild

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · securitySep 16, 22:19 UTC · 8h agoVulnerability 3 sources HN 35↑ · 3 comments CVE-2021-1905 CVE-2018-9568

AI Security Spending Jumps as Fear Outpaces Proof of Value

Dark Reading examines CISOs boosting AI security spending before the technology has proven its cybersecurity value.

Dark Reading reports that CISOs are increasing investments in AI for cybersecurity rather than waiting for the technology to demonstrate clear value. The piece questions whether fear-driven AI security budgets are justified while proof of value still lags adoption.

Dark ReadingSep 16, 21:26 UTC · 9h agoIndustry

Nonprofit that tracks meteors taken down by "critical blow" from a cyberattack

The International Meteor Organization says a cyberattack dealt a critical blow to its infrastructure, taking much of its site offline for weeks.

The International Meteor Organization (IMO), a nonprofit coordinating amateur and professional meteor observations since 1988, reported a cyberattack that took much of its website offline. The organization expects several weeks of partial downtime while transitioning to new infrastructure and is prioritizing fireball reporting through alternate channels. The attack vector and whether any data was accessed remain undisclosed; the IMO's observation databases and WGN journal are widely used in the field.

Ars Technica · SecuritySep 16, 21:08 UTC · 9h agoData breach in the wild 2 sources

TestFlight Update

Apple issued a routine TestFlight software update; the release notes contain no security or vulnerability details.

Apple's developer release feed lists a TestFlight update published on September 16, 2026. The available notes contain no listed CVEs, security fixes, or vulnerability information. This appears to be a routine application maintenance release for Apple's beta-testing platform.

Apple software releasesSep 16, 21:00 UTC · 9h agoAdvisory

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated 00:29 UTC · 6h agofirst Sep 16, 20:39 UTC · 10h agoVulnerability 2 sources

CISA decides weekly vulnerability bulletin isn't necessary anymore

CISA will discontinue its weekly vulnerability bulletin on September 28, pushing users toward KEV, alerts, and CVE data under risk-based prioritization.

CISA announced its weekly vulnerability bulletin will stop on Monday, September 28, as part of a shift from static CVSS severity scores to a modern, risk-based approach detailed in a June Binding Operational Directive. The directive prioritizes federal remediation based on exposure, exploitation evidence, control granted by exploitation, and whether exploitation can be automated. CISA directs bulletin subscribers to rely instead on its Known Exploited Vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog, requiring users to enable those subscriptions in GovDelivery or Granicus to avoid missing critical notices.

The Register · SecuritySep 16, 20:33 UTC · 10h agoPolicy & legal

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.

US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.

BleepingComputerSep 16, 20:24 UTC · 10h agoThreat actor in the wild 6 sources

CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' a 22-page guide marking the agency's first guidance on decoys such as honeypots and honeytokens. Acting executive director Chris Butera described decoys as a low-cost, high-fidelity way to detect adversaries already inside networks, complementing zero-trust and assume-compromise approaches. The guidance covers decoy principles, definitions, deployment scenarios, and is aimed especially at resource-constrained critical infrastructure sectors.

CyberScoopSep 16, 20:22 UTC · 10h agoAdvisory

BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.

Lumen Black Lotus Labs identified BambooToken, a multiplatform malware family that exchanges commands through MQTT brokers so infected hosts never contact the C2 server directly, active from at least February 2023 through July 2026. The Windows variant sideloads via Tendyron's OnKey hardware-token software used in Chinese banking and government, or impersonates Kingsoft Office, without either vendor's signing certificate being compromised; a Linux build appeared by December 2025 with shell, file transfer, and system information commands. Victims include MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam reached after internet-wide SNMP scanning, and Lumen cannot attribute the family to any known actor.

Security AffairsSep 16, 20:20 UTC · 10h agoMalware in the wild

USN-8776-1: python-cryptography vulnerabilities

Ubuntu patches python-cryptography flaws including a PKCS#7 timing side-channel (CVE-2026-69247) that could allow key recovery.

Ubuntu Security Notice USN-8776-1 fixes multiple vulnerabilities in python-cryptography. CVE-2026-69247 describes distinguishable PKCS#7 decryption outcomes with observable timing differences that a remote attacker could exploit to recover encryption keys; it affects Ubuntu 26.04 LTS. CVE-2023-23931, affecting only Ubuntu 18.04 LTS, involves incorrect handling of objects with immutable buffers during cipher operations, causing corrupted output, and a third issue reported by Jack Lloyd is also addressed.

Ubuntu Security NoticesSep 16, 20:12 UTC · 10h agoAdvisory 15 sources CVE-2023-23931 CVE-2026-69247

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare BlogSep 16, 20:06 UTC · 10h agoMalware in the wild

The Apple Security Update Review for September 2026

Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.

ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.

Zero Day Initiative BlogSep 16, 19:58 UTC · 10h agoVulnerability in the wildCVE-2026-65400 CVE-2026-65414 CVE-2026-43692+27 CVEs

LinkedIn fights for the right to tell customers when the feds want their data

Microsoft's chief legal officer argues federal subpoenas for LinkedIn user data should carry narrower scope and that secrecy orders must become the exception.

Microsoft chief legal officer Jon Palmer said federal courts and Congress must curb overly broad US government subpoenas for LinkedIn user data that arrive with secrecy orders preventing customer notification. The company is asking courts to enforce meaningful limits on demand scope and secrecy, invoking Fourth and First Amendment arguments. Palmer cited House legislation passed August 31 to rein in secret surveillance, while LinkedIn simultaneously faces user privacy lawsuits, one dismissed with leave to amend by Judge Vince Chhabria.

CSO OnlineSep 16, 19:50 UTC · 10h agoPolicy & legal

ISC BIND security advisory (AV26-931)

Canadian Cyber Centre relays ISC advisory on vulnerabilities affecting multiple BIND 9 branches; administrators should review the matrix and apply updates.

On September 16, 2026, the Canadian Centre for Cyber Security (AV26-931) relayed ISC's advisory on vulnerabilities affecting ISC BIND 9 versions prior to or equal to 9.18.50, 9.20.27, and 9.21.25, including their -S1 variants. No specific CVE identifiers or exploitation details are provided in the bulletin. Administrators are directed to ISC's BIND 9 Software Vulnerability Matrix and encouraged to apply updates as they become available.

Canadian Centre for Cyber SecuritySep 16, 19:43 UTC · 10h agoAdvisory

Apple security advisory (AV26-930)

CCCS relays Apple's September 14, 2026 security updates fixing vulnerabilities across iOS 27, macOS Tahoe 26.7, Sequoia 15.8, Safari, and other products.

The Canadian Centre for Cyber Security (AV26-930) notes that as of September 14, 2026, Apple has addressed vulnerabilities in iOS and iPadOS prior to 27, macOS Golden Gate prior to 27, macOS Tahoe prior to 26.7, macOS Sequoia prior to 15.8, plus tvOS, watchOS, visionOS 27, Safari, and Xcode prior to 27. The bulletin provides no CVE identifiers or exploitation details. Users and administrators are encouraged to review Apple's security releases and apply the updates.

Canadian Centre for Cyber SecuritySep 16, 19:42 UTC · 10h agoAdvisory

Oracle Corporation security advisory (AV26-929)

CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.

The Canadian Centre for Cyber Security (AV26-929) relays Oracle's September 2026 Critical Security Patch Update, which addresses vulnerabilities in dozens of product families as of September 15, 2026. Affected products include Oracle WebLogic Server, Database Server, E-Business Suite, Fusion Middleware, PeopleSoft Enterprise, Siebel Applications, GraalVM, VirtualBox, Coherence, and numerous banking and communications suites. The bulletin lists no CVE identifiers and encourages administrators to review Oracle's advisory and apply patches.

Canadian Centre for Cyber SecuritySep 16, 19:29 UTC · 11h agoAdvisory 3 sources

Malware bypasses browser checks to force install Chrome, Edge extensions

Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.

Elastic Security Labs analyzed KREMLIN, a toolkit used by a Brazilian operation in at least seven campaigns since May 2025 that impersonates 12 banks to trick users into opening a JavaScript file disguised as a bank receipt or invoice. After anti-sandbox checks, it downloads Node.js, persists via a scheduled task, and fetches payload locations from an Ethereum smart contract, hiding payloads in JPEG images on Internet Archive. The toolkit bypasses Chromium integrity mechanisms to install unapproved Chrome/Edge extensions masquerading as AVSync that steal cookies, keylog form input, capture screenshots, and intercept HTTP traffic, while recent campaigns deployed the REMCOS RAT and earlier ones Pulsar RAT. Elastic confirmed 1,515 infected systems, almost all in Brazil, and disrupted the campaign by registering an anti-sandbox canary domain; the linked wallet handled roughly 20,800 USDT incoming and 19,000 USDT outgoing.

BleepingComputerSep 16, 18:50 UTC · 11h agoMalware in the wild 3 sources

Coast Guard, FBI boarded tanker after attack by ‘foreign cyber actors’

US Coast Guard and FBI boarded an oil tanker after foreign hackers compromised its network; VL Prosperity reportedly lost communications for 30 hours.

The US Coast Guard confirmed that a specialized team including USCG Cyber Protection Team members and FBI Cyber Action Team operators boarded a tanker on August 21 after indications its network was compromised by foreign cyber actors. Bloomberg identified one vessel as VL Prosperity; Iranian state-linked outlet Mehr reported it lost communications for 30 hours after an August 7 attack while transiting the Strait of Gibraltar, with a crew member alleging attackers increased engine speed and disabled fuel and engine-oil tanks. No operational disruptions or environmental impacts were reported, no group has claimed responsibility, and Russian analysts linked the incident to US-Iran tensions. A day before the alleged attack, North Carolina Ports reported a cyberattack that forced a shift to manual operations.

The RecordSep 16, 18:46 UTC · 11h agoData breach in the wild 2 sources

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm CenterSep 16, 18:44 UTC · 11h agoExploit / PoC

HPE security advisory (AV26-928)

Canada's Cyber Centre relayed an HPE advisory covering multiple vulnerabilities in EdgeConnect SD-WAN Gateways and Orchestrator, urging prompt updates.

On September 16, 2026, the Canadian Centre for Cyber Security published advisory AV26-928 noting that as of September 15, 2026, HPE is affected by multiple vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways and Orchestrator across multiple versions, per HPE bulletin HPESBNW05135 rev.1. The Cyber Centre encourages users and administrators to review the linked HPE security bulletins and apply available updates. No exploitation details or CVE identifiers are provided in the advisory text.

Canadian Centre for Cyber SecuritySep 16, 18:35 UTC · 12h agoAdvisory 2 sources

House passes bill to equip local law enforcement with scam-fighting tools

The U.S. House passed the GUARD Act, letting local law enforcement use federal grants to investigate financial scams and trace stolen cryptocurrency.

The bipartisan GUARD Act (Reps. Zachary Nunn, Scott Fitzgerald, Josh Gottheimer) passed the House, allowing existing DOJ grant funds to be used for fraud analysts, victim-support training, blockchain tracing software, and financial-information sharing with law enforcement. It addresses scams like pig butchering, often run by transnational criminal groups overseas; Americans lost a record $11.4 billion to crypto-related fraud in 2025, including $8.6 billion in investment fraud. Senators Katie Britt and Kirsten Gillibrand introduced a Senate companion in July 2025, and the House also passed a bill retroactively eliminating the 'scam tax' on stolen funds for 2021-2025 victims.

The RecordSep 16, 18:28 UTC · 12h agoPolicy & legal

Data Broker Radaris Loses Domains in Privacy Fight

A New Jersey court ordered people-search broker Radaris to transfer radaris.com and a dozen related domains to Atlas Data Privacy over Daniel's Law violations.

On August 26, a New Jersey judge found Radaris failed to defend claims that it violated Daniel's Law, which protects law enforcement officials' personal data and imposes $1,000 fines per ignored removal request. The court ordered radaris.com and more than a dozen related broker domains transferred to plaintiff Atlas Data Privacy Corp. Radaris had delayed litigation using offshore shell entities and previously used a fictitious CEO named 'Gary Norden' in investor-facing press releases.

Krebs on SecuritySep 16, 18:14 UTC · 12h agoPolicy & legal

Fighting Your Dragons Through Tough Tech Times

Cybersecurity veteran Hal Pomeranz shares advice on managing career anxiety and building professional connections during the tech industry downturn.

Dark Reading published a pep talk by industry veteran Hal Pomeranz addressing career anxiety and self-doubt among cybersecurity professionals amid a historically tough tech job market. He shares strategies for building meaningful professional connections during industry downturns.

Dark ReadingSep 16, 18:00 UTC · 12h agoIndustry

Hackers publish thousands of drivers’ data after breaching Florida motor vehicle database

ShinyHunters published hundreds of thousands of records from Florida's DAVID vehicle database, including SSNs and passports, after an unpaid ransom demand.

The ShinyHunters group published hundreds of thousands of files from Florida's DAVID motor vehicle database on its leak site, saying the victim did not pay a ransom. Stolen records include vehicle ownership certificates with names, addresses, and VINs, plus a smaller number of Social Security numbers, non-US passports, and immigration documents. FLHSMV confirmed the breach, which followed theft of a police officer's credentials stored on a personal device. It comes the same month as the IDScan hack exposing over 150 million driver's license images.

TechCrunch · SecuritySep 16, 18:00 UTC · 12h agoData breach 3 sources

[Control Systems] Phoenix Contact security advisory (AV26-927)

Canadian Cyber Centre warns Phoenix Contact, Pepperl+Fuchs, and Carlo Gavazzi I/O devices need firmware 1.7.4 to fix multiple vulnerabilities.

Canada's Cyber Centre issued advisory AV26-927 covering multiple vulnerabilities in Phoenix Contact ICE2/ICE3 and IOL MA8 EIP/PN devices, plus related Pepperl+Fuchs and Carlo Gavazzi YL212/YN115 products. Firmware versions prior to 1.7.4 are affected across roughly 15 models. Administrators are encouraged to review vendor advisories and apply available updates.

Canadian Centre for Cyber SecuritySep 16, 18:00 UTC · 12h agoAdvisory1

Google Pixel phones pwned in zero-click attacks

CISA added actively exploited zero-click Pixel modem flaw CVE-2026-58704 to its KEV catalog, giving federal agencies three days to patch.

Google disclosed CVE-2026-58704, a high-severity improper authorization flaw in Pixel phones' cellular modems that bypasses permission checks and escalates privileges with no user interaction, noting limited, targeted exploitation. CISA added it to the Known Exploited Vulnerabilities Catalog with a September 19 deadline for federal agencies. Such zero-click modem bugs are a frequent vector for commercial spyware. The Register also notes two recently KEV-listed Chromium V8 flaws, CVE-2026-85046 and CVE-2026-87491, which Proofpoint says four espionage groups chained in intrusions.

The Register · SecuritySep 16, 17:56 UTC · 12h agoExploit / PoC in the wild 8 sources CVE-2026-58704 CVE-2026-85046 CVE-2026-87491