60
60
60
60
60
60
60
60
60
60
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
60
60
Week in review: 10 cybersecurity frameworks you need to know, exploited Chrome zero-day fixed
60
60
60
60
60
60
60
60
60
60
60
45
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.
80
Hackers Drain $320 Million From Liquid Network, Then Return Most of It
Hackers exploited an Elements bug to drain about 4,000 BTC (~$320M) from Liquid Network's federation wallet, then returned 3,400 BTC after Blockstream patched.
An attacker drained roughly 4,000 of 4,200 BTC (~$320M) from Bitcoin's Liquid Network federation wallet on September 6 by exploiting a bug in Elements, the open-source code powering the sidechain, which allowed unbacked L-BTC tokens that were redeemed for real Bitcoin through SideSwap's authorized peg-out mechanism. The self-described white-hat attackers negotiated publicly via OP_RETURN on-chain messages, demanding the bridge nodes be patched before returning 3,400 BTC (~$262.6M) and keeping about 598 BTC (~$47M). Blockstream confirmed the affected bridge nodes were patched; the network remains paused while federation members complete security work, and experts debate whether the act legally constitutes extortion.
78
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Hackers exploited an Elements bug to take ~4,000 BTC from Liquid Network, returned 3,400 BTC (~$265M), and still hold ~598.5 BTC (~$47M).
Attackers exploited a bug in Elements, the software behind Blockstream's Liquid Network Bitcoin sidechain, to create L-BTC and withdraw roughly 4,000 BTC (about $320 million) via SideSwap's Peg-out Authorization Key, roughly 95% of Liquid's reported reserves. They returned 3,400 BTC (about $265 million at ~$78,000 per BTC) to the federation address on September 7, keeping about 598.5 BTC (roughly $47 million). The group called itself white hats, demanded node patches before returning funds, and negotiated via on-chain and PGP-encrypted messages; Ledger CTO Charles Guillemet characterized the arrangement as extortion. Blockstream says the peg-out key and other keys were not compromised, updated software is deployed, and the network remains paused pending a coordinated restart.
70
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
60
60
60
60
60
60
60
60