Search: “device code phishing”

16 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Phishing & fraud 27 Threat actor 24 Exploit / PoC 16 Malware 14 Industry 13 Advisory 9 Research 7 AI safety & security 6 Policy & legal 6 Vulnerability 6 Data breach 4 Ransomware 1 AI policy 1 Tools 1

SeverityAll critical 9 high 58 medium 37 low 2 info 29

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 8d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security NewsSep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2025-25249+3 CVEs3

Update Chrome now to protect against an actively exploited vulnerability

Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.

Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.

Malwarebytes LabsSep 10, 10:52 UTC · 6d agoExploit / PoC in the wild 2 sources CVE-2026-874911

Microsoft fixes record 964 flaws, including 2 exploited zero-days

Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.

Microsoft's September 2026 Patch Tuesday addresses 964 customer-patchable CVEs (104 Critical, 860 Important), the largest release on record, out of 974 total listed. Two actively exploited zero-days are fixed: CVE-2026-81963, a link-following elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape, both with CVSS 7.8. Both zero-days were exploited before a patch was available and grant SYSTEM-level access after an initial foothold. The release also includes high-severity RCE fixes for Windows DNS Server, Remote Desktop Services, Exchange Server, SharePoint, and SQL Server.

Malwarebytes LabsSep 9, 10:01 UTC · 7d agoExploit / PoC in the wildCVE-2026-81963 CVE-2026-858801

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

Attackers exploit zero-days in consistently besieged SonicWall product

Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.

SonicWall disclosed and patched two zero-days in SMA 1000 appliances: CVE-2026-83548, a maximum-severity pre-authentication SSRF, and CVE-2026-83549, a high-severity OS command injection. Rapid7 said chaining the flaws yields unauthenticated remote code execution, and CISA added both to its KEV catalog Wednesday. The vendor provided no IOCs or victim counts, urging customers to hunt for compromise, reimage or redeploy appliances, and reset all passwords and tokens. The product has faced repeated exploitation, including ransomware-linked flaws used by INC and Akira.

CyberScoopSep 3, 22:12 UTC · 12d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.

Gen Digital researchers found three weaknesses in Sogou Input Method's sgbiz protocol handler that chain into a one-click RCE running with the signed-in user's permissions. UNC3569 used the chain in an active intrusion, leveraging an unsandboxed Chromium 80 embedded browser, the known V8 flaw CVE-2021-38003, and DLL sideloading via 7-Zip to deploy the GRAYRABBIT backdoor. Tencent fixed the issue in version 16.3.0.3498 within 12 days of disclosure; Sogou is used by hundreds of millions of people, mainly in China.

Cyber Security NewsSep 14, 13:01 UTC · 2d agoExploit / PoC in the wild 3 sources CVE-2026-51990 CVE-2021-38003

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) enables unauthenticated root command execution via crafted email; CISA added it to KEV.

CVE-2026-76461 is a critical SQL injection (CVSS 9.8) in Cisco AsyncOS for Secure Email Gateway allowing an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a specially crafted email through a vulnerable gateway. CISA added it to the KEV catalog on disclosure day, indicating zero-day exploitation, and Cisco PSIRT became aware of active exploitation in September 2026. No public PoC or attribution exists; fixed versions are 15.5.5-014, 16.0.4-302, and 16.5.0-780, and admins should check mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM'.

Rapid7 Blogupdated Sep 15, 20:46 UTC · 17h agofirst Sep 15, 12:22 UTC · 1d agoExploit / PoC in the wild 15 sources CVE-2026-76461

Google Pixel owners urged to patch actively exploited modem flaw

Google's September 2026 Pixel bulletin fixes 110 vulnerabilities, including CVE-2026-58704, a modem permission bypass under limited targeted exploitation enabling remote privilege escalation.

Google released the September 2026 Pixel Update Bulletin addressing 110 vulnerabilities, including CVE-2026-58704, a high-severity logic error in the cellular modem that allows remote escalation of privilege with no additional execution privileges or user interaction required. Google says there are indications the flaw may be under limited, targeted exploitation; attackers need adjacent network access and some existing foothold on the device, which the bulletin does not explain how to obtain. The fix ships at the 2026-09-05 patch level and appears only in the Pixel-specific bulletin, so other Android vendors do not receive this specific fix.

Malwarebytes Labsupdated 13:10 UTC · 59m agofirst 10:39 UTC · 3h agoExploit / PoC in the wild 5 sources CVE-2026-58704

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker NewsAug 17, 17:57 UTC · 29d agoExploit / PoC in the wildCVE-2026-59310 CVE-2026-65400 CVE-2026-688201

14th September – Threat Intelligence Report

Check Point weekly digest: Microsoft's record 974-vuln Patch Tuesday ships two actively exploited Windows zero-days; IDScan.net, Mathspace, Revolut suffer breaches.

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited privilege-escalation zero-days, CVE-2026-85880 and CVE-2026-81963, plus 20 flaws allowing unauthenticated remote code execution. Disclosed breaches include IDScan.net (identity documents), Mathspace (over 1 million people via Metabase CVE-2026-72898), Revolut, and Florida DMV (ShinyHunters). GitLab fixed critical CVSS 10.0 path traversal CVE-2026-85706, and MikroTik fixed chainable RouterOS flaws CVE-2026-67276 and CVE-2026-86060. The report also covers the PuzzleMask LLM jailbreak technique, GoldFactory's Gigabud Android fraud, and the BlueMoon Chromium exploit chain (CVE-2026-85046).

Check Point ResearchSep 14, 12:22 UTC · 2d agoExploit / PoC in the wildCVE-2026-72898 CVE-2026-85880 CVE-2026-81963+4 CVEs2· 1 read

Chinese espionage groups swarm to exploit triple-link chain of zero-days

At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.

Proofpoint observed at least four state-aligned threat groups, starting with TA412/Violet Typhoon/APT31 on August 28, chaining three zero-days in the 'BlueMoon' exploit chain targeting Chrome, Chromium-based browsers and Microsoft Windows. The chain includes RCE flaws in Chromium's JavaScript engine (CVE-2026-85046, CVE-2026-87491) and a Windows Advanced Local Procedure Call privilege-escalation zero-day (CVE-2026-85880), enabling sandbox code execution, sandbox escape and system privileges. APT31 delivered the chain via phishing links to NGOs, mining and commodity trading firms in the US, installing a browser extension disguised as Google Gemini to surveil activity and steal credentials. Other groups (UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) targeted US aerospace, Vietnamese manufacturing, and Indonesian and Singaporean organizations; fewer than 20 victims were directly observed but the true count is likely higher.

CyberScoopupdated Sep 15, 10:17 UTC · 1d agofirst Sep 9, 21:17 UTC · 6d agoExploit / PoC in the wild 23 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858802· 1 read

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.

GBHackersSep 9, 06:17 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-87464 CVE-2026-87488+19 CVEs1

Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware

Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.

Cisco Talos warns of active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center allowing unauthenticated root-level code execution, and CVE-2026-20316 (CVSS 5.3), which permits login via a low-privileged static account for privilege escalation. Hotfixes are available now, with a broader hardening release planned for the week of September 14. Three post-compromise activity clusters were identified: UAT-12197 deployed a home.jsp web shell and cmd.jar command executor; UAT-11823, attributed with high confidence to a Sandworm-linked APT, deployed a Netcat reverse shell and Cyclops Blink; and UAT-11988 showed Qilin ransomware tactics including Active Directory enumeration and credential theft before deploying Qilin ransomware.

GBHackersupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 05:30 UTC · 5d agoExploit / PoC in the wild 14 sources CVE-2026-20079 CVE-2026-20316

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersSep 15, 05:20 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2024-21762 CVE-2020-1938

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

HuntressSep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1