ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “reliability”

44 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllResearch 10Vulnerability 7Exploit / PoC 6Industry 6Threat actor 6Phishing & fraud 4Advisory 3Malware 3Ransomware 1Data breach 1
SeverityAllcritical 1high 20medium 9low 4info 13

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.

On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif 1.19.7/1.19.8 (missing Debian security backports, upstream fix never assigned a CVE), reached through Discourse image uploads processed by ImageMagick, to gain remote code execution on community.openai.com. Combined with an SSO identity misconfiguration in the 'Sign in with OpenAI' flow, they took over employees' ChatGPT/Codex accounts with connected GitHub, Slack, and email access, and proved it by opening PR #1186742 in OpenAI's internal openai/openai monorepo. They reported the issues for coordinated patching, received a $6,500 bounty from OpenAI, and Debian shipped fixed libheif packages on August 8, 2026. The team used Claude Opus 4.8 and Claude Opus 5 to locate the missing backport and autonomously develop working x86-64/ARM64 exploits.

Hacker News · securityupdated · 38m agofirst · 11h agoResearch in the wild 9 sourcesHN 334↑ · 128 comments1

Enterprise Threat Intelligence Buying Guide: How to Choose the Right Solution

ANY.RUN published a buyer's guide for enterprise threat intelligence platforms, outlining evaluation criteria and promoting its own TI products.

ANY.RUN, whose sandbox, TI Lookup, and TI Feeds products are featured throughout, published guidance for selecting an enterprise threat intelligence provider. The guide recommends defining SOC or MSSP requirements first, then weighing intelligence quality and freshness, integrations including STIX/TAXII support, privacy, scalability, and proof-of-concept testing with real alerts. It emphasizes context and enrichment over raw data volume, citing figures such as TI Lookup results in about 2 seconds and 99% validated IOCs in its feeds.

ANY.RUNupdated · 1d agofirst · 1d agoIndustry 3 sources

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 2d agoResearch

Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.

CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.

GBHackers · 3d agoExploit / PoCCVE-2026-43502CVE-2026-43501CVE-2026-43074+4 CVEs4

No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation

Prototype binary lifter brute-force lifts every byte offset of x86-64 binaries to LLVM IR, enabling fully static cross-ISA recompilation without runtime support.

The paper presents a fully static, whole-program binary lifting system that treats every byte offset as a potential branch target, constructing a superset control flow graph that conservatively contains all feasible control flows. Statically unresolvable computed branches are reduced to lookups in a dispatch table pointing to translated control flow paths, eliminating runtime translation machinery on the target machine. A prototype recompiles x86-64 binaries to LLVM IR with no code/data heuristics and achieves fully static cross-compilation to AArch64 using unmodified LLVM backends.

arXiv cs.CR · 3d agoResearch1

New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks

ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.

CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.

Cyber Security News · 4d agoVulnerabilityCVE-2026-43502

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 4d agoResearch1

New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systemsnew

Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.

Huntress investigated two Settra intrusions: a consumer services and retail organization in July 2026 and a manufacturing firm in September 2026, showing nearly identical post-compromise behavior. Operators installed the MeshAgent RMM, ran ransomware executables named after the victim domain (_win64.exe), encrypted files with .locked or .locked_wip extensions, and dropped RESTORE_FILES.txt ransom notes. In both cases attackers cleared Windows Event Logs, disabled the Windows Recovery Environment, and used DiskPart to remove the recovery partition; the July case also ran Cipher to overwrite free space and flushed DNS cache. The September incident added BYOVD using gdrv.sys, and initial access was suspected via VPNs or previously stolen credentials, though unconfirmed.

Cyber Security News · 24m agoRansomware in the wild 3 sources

Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell

Four Linux kernel privilege escalation flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) allow local root access; fixes ship in stable kernel branches with PoC exploits published.

Researcher Asim Viladi Oglu Manizada reported four memory-corruption LPEs in long-standing Linux kernel networking code in mid-July: DirtyAH6 (CVE-2026-80844, IPv6 AH/XFRM), TUNderflow (CVE-2026-81000, TUN/TAP integer underflow), PPPoEject (CVE-2026-68121, PPPoE use-after-free), and DiagSpill (CVE-2026-74469, SCTP sock_diag overwrite of ~8 MB). Published proof-of-concept exploits demonstrate root shell access; the first three rely on unprivileged user namespaces, while DiagSpill does not. Patches are included in Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4, and AppArmor/SELinux did not block the tested exploit paths.

GBHackersupdated · 55m agofirst · 3h agoVulnerability 3 sourcesCVE-2026-80844CVE-2026-81000CVE-2026-68121+1 CVEs

Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials

pgAdmin 4 versions 6.2-9.17 contain critical auth bypass CVE-2026-86863 (CVSS 9.8) letting unauthenticated attackers impersonate administrators; fixed in 9.18.

A critical authentication bypass (CVE-2026-86863, CVSS 3.1 score 9.8) affects pgAdmin 4 versions 6.2 through 9.17 when Webserver authentication is enabled in AUTHENTICATION_SOURCES. The WebserverAuthentication.get_user() function falls back to client-controlled HTTP headers such as X-Forwarded-User when the WEBSERVER_REMOTE_USER environment variable is absent, allowing unauthenticated remote attackers to log in as any user, including administrators, without a password or MFA. Successful attackers could view, alter, or delete PostgreSQL database objects and data accessible through the hijacked privileged session. Version 9.18 fixes the issue by trusting only genuine CGI/WSGI environment variables by default and requiring explicit options like WEBSERVER_REMOTE_USER_FROM_HEADER with trusted proxies for header-based identity.

GBHackers · 4h agoVulnerabilityCVE-2026-86863

AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection

Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.

Morphisec analysts reviewed Google's late-2025 disclosure of PROMPTFLUX, an experimental dropper that queried the Gemini API roughly hourly and generated more than 70 obfuscated variants in under four hours. Related samples PROMPTSTEAL, PromptLock, and BlackMamba use LLMs to generate Windows commands or mutate payloads at runtime. The report argues signature-based controls lose value when every copy differs and recommends prevention-first execution controls and behavior-based detection.

Cyber Security News · 5h agoMalware in the wild 2 sources

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.

The IETF published RFC 10008 in June 2026 defining HTTP QUERY, the first new standard method since PATCH in 2010, behaving as a safe, idempotent, explicitly cacheable GET whose query lives in the request body. SANS handler Xavier Mertens warns that WAF rules, API-gateway allowlists, CSRF middleware, and caches built around the classic verb set may not inspect QUERY bodies, allowing SQL injection or XSS payloads to bypass inspection where POST would be blocked. Behavior in the wild is inconsistent: nginx's limit_except silently rejects QUERY and never caches it, while curl, Caddy, Traefik, FastAPI explicit routes, and .NET 10 pass or support it, and Cloudflare/Akamai co-authored the RFC. The author found no QUERY requests in his logs yet and recommends updating method-matching rules and allowlists to include QUERY.

SANS Internet Storm Center · 8h agoResearch

Weather Data Spoofing Attacks on Rain-Adaptive Millimeter-Wave Frequency Selection in V2X Communication Networks

Spoofed rainfall inputs let attackers dictate V2X millimeter-wave carrier selection without transmitting, halving platoon range or quadrupling latency in ns-3 simulations.

The paper shows spoofing only the rainfall sensor input lets an adversary control which mmWave carrier a connected vehicle selects, without transmitting on the channel. In MilliCar/ns-3 simulations with real 3GPP NR V2X propagation, forcing the 73 GHz band held an eight-vehicle platoon's reliable range at 38 m versus an 82 m honest baseline, while forcing 5 GHz kept 97% long-range reception but quadrupled long-range latency to 12.5 ms. A receiver-side SINR cross-check against rain-predicted attenuation detects force-up attacks with 98% probability within 1.5 s at 1% false alarms, but is structurally blind to force-down. The authors argue weather-aware band selection requires authenticated meteorological input.

arXiv cs.CR · 22h agoResearch

Empirical Analysis of Randomness Quality in Differential Privacy Mechanisms

Empirical study using IBM DiffPrivLib shows differential privacy mechanisms detect manipulated entropy when roughly 1 in 8-16 bits is biased or correlated.

The study empirically measures how degraded randomness affects differential privacy mechanisms using IBM's DiffPrivLib. Entropy sources ranged from high-quality quantum TRNGs and cryptographically secure PRNGs down to systematically manipulated generators with controlled entropy degradation, tested over one million queries with complementary statistical tests. DP mechanisms reliably detect deviations when approximately 1 bit in every 8 to 16 is manipulated, with sensitivity varying significantly between bit-level biases and temporal correlations. Notably, statistical detection of distributional anomalies does not necessarily correspond to actual privacy guarantee violations.

arXiv cs.CR · 22h agoResearch

Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.

Group-IB documented previously unreported HEAVYGRAM and CRUDEEXCLUDE malware linked with moderate confidence to the Iran-aligned Handala Hack, assessed as a MOIS-linked persona tied to Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm). CRUDEEXCLUDE uses PowerShell to add attacker-controlled Microsoft Defender exclusions, then a Delphi-based loader deploys a PyInstaller-packaged HEAVYGRAM implant that abuses Telegram bot APIs for command-and-control, shell execution, screenshots, audio recording, and Telegram Desktop data theft. The campaign targets Iranian dissidents, journalists, and academics with fake KeePass, Telegram, WhatsApp, and Pictory installers. The DOJ seized four related domains in March 2026 and the FBI published a HEAVYGRAM FLASH report on September 15.

GBHackersupdated · 1d agofirst · 1d agoThreat actor in the wild 10 sources

Compact Vision Models for Iris Presentation Attack Detection under Presentation Attack Instrument Shift and Environmental Degradation

Compact iris presentation-attack detection models under 0.3M parameters show APCER rising 17-30 percentage points against unseen attack instruments, indicating limited deployment readiness.

Three scratch-trained compact vision models, each with at most roughly 0.26 million trainable parameters, were benchmarked on the Notre Dame subset of LivDet-Iris 2017 under presentation attack instrument shift and environmental degradation, trained without pretraining or augmentation and evaluated over five seeds. Moving from known to unknown attack presentations raises APCER by 17.11-30.47 percentage points and D-EER by 7.38-12.73 points. ZACH-ViT achieves the lowest unknown-attack APCER (47.69% +/- 4.84%) and D-EER (38.87% +/- 0.93%), while Compact-TransMIL yields the lowest bona fide classification error rate; high absolute errors show none are deployment-ready.

arXiv cs.CR · 1d agoResearch

I Hijacked a Real Artist's Spotify with AI Music. It Was Disturbingly Easy

A journalist used DistroKid's loophole to publish an Udio-generated song on Lathe of Heaven's verified Spotify page, exposing a widespread AI music royalty scam.

A 404 Media reporter generated a punk song with Udio and, via a $3.75-per-month DistroKid account, released it under the name of Brooklyn punk band Lathe of Heaven without any identity verification by the distributor or streaming platforms. The AI-generated track appeared a day later on the band's Spotify, Apple Music, Tidal, Amazon Music and Deezer pages, with royalties flowing to the uploader. Similar abuse has hit deceased musicians such as Blaze Foley, and Spotify says artist profiles that are not actively managed are especially vulnerable.

404 Media · 1d agoPhishing & fraud in the wild

SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia

Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.

Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.

Cyber Security Newsupdated · 23h agofirst · 1d agoThreat actor in the wild 3 sources1

ABB Ability Edgenius

CISA's ABB advisory covers CVE-2026-31431, a public Linux kernel flaw letting local users or compromised containers gain root on Ability Edgenius gateways.

ABB confirmed that CVE-2026-31431 (Copy Fail), a Linux kernel flaw in the algif_aead cryptographic interface (CWE-669), affects Ability Edgenius versions 3.2.0.0 to below 3.2.4.1 on bE100 gateways. A locally authenticated user or compromised container workload can gain root privileges, enabling arbitrary code execution or denial of service on the node. CVSS v3.1 score is 7.8, and the flaw impacts kernels shipped in most major Linux distributions since 2017. A fix is available and ABB reported no exploitation of Edgenius when the advisory was issued.

CISA Advisoriesupdated · 1h agofirst · 1d agoAdvisory 2 sourcesCVE-2026-31431

BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks

ISC released BIND 9.20.29 patching 14 flaws, including two DNSSEC validation bypasses enabling cache poisoning and multiple denial-of-service bugs.

Internet Systems Consortium shipped BIND 9.20.29 (and 9.21.26) fixing 14 vulnerabilities affecting recursive and DNSSEC-validating resolvers. Key flaws include CVE-2026-77119 (CVSS 5.9), which lets injected NSEC3 records from sibling zones make forged answers appear validated, and CVE-2026-19941, enabling forged DNSSEC-validated NXDOMAIN responses. DoS issues include CVE-2026-19668 (CVSS 5.3, CPU exhaustion via crafted DS/DNSKEY key tags) and cache bloat bugs CVE-2026-81736 and CVE-2026-81563; CVE-2026-1903 fixes partially unsigned TSIG zone transfers and CVE-2026-78301 fixes out-of-zone record serving. ISC reports no active exploitation and says CVE-2026-19668 and CVE-2026-77119 have no workarounds, so upgrading is the only reliable mitigation.

GBHackers · 1d agoVulnerabilityCVE-2026-77119CVE-2026-19941CVE-2026-19668+4 CVEs1

FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.

ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.

Cyber Security Newsupdated · 18h agofirst · 1d agoThreat actor in the wild 9 sources

12 Serverless Security Options Compared (2026): Features & Pricing

A buyer-focused comparison of twelve serverless security offerings concludes no standalone SKU is worth buying in 2026, with function protection bundled inside CNAPP contracts.

The scorecard compares twelve serverless security options on function-protection depth, pricing visibility, platform attach economics, multi-runtime coverage, and vendor viability. Microsoft Defender for Cloud tops the weighted scores at 4.75, with Prisma Cloud at 4.60 and Datadog at 4.55 noted for publishing clean per-function rates. The piece warns that Thundra and Epsagon are defunct and that most vendors bill functions inside platform units where costs are hard to see. It also references the Aqua Security Trivy supply chain incident and Google's finalized acquisition of Wiz as market context.

GBHackersupdated · 5h agofirst · 1d agoIndustry 10 sources1

Multiple vulnerabilities in Jenkins plugins

Jenkins releases security fixes for multiple plugins including Bitbucket, GitLab, Gitee, Coverage, and Gradle integrations.

Jenkins published security updates for several plugins, including Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin. The announcement is a routine open-source security release notice without exploit details.

oss-security · 1d agoVulnerability 2 sources1

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security News · 2d agoPhishing & fraud in the wild 2 sources

Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites

Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.

Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.

Cyber Security Newsupdated · 24m agofirst · 2d agoThreat actor 3 sources

NightEagle targets Russian companies

Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.

Kaspersky's Global Emergency Response Team investigated NightEagle (APT-Q-95) incidents over the past year, finding the group—active since at least 2023 and formerly focused on Asia—now targeting Russian businesses. Attackers used compromised VPN credentials and deployed the GhostContainer .NET backdoor on Microsoft Exchange servers, built from Neo-reGeorg, a CVE-2020-0688 exploit, and ysoserial's GhostWebShell, injected in memory via VIEWSTATE manipulation with AMSI bypass. For lateral movement they combined Microsoft dev tunnels with rdp2tcp over RDP, exploited BlueKeep (CVE-2019-0708) to create local admin accounts, and performed DCSync replication against Active Directory.

Kaspersky Securelistupdated · 44m agofirst · 2d agoThreat actor in the wild 6 sourcesCVE-2020-0688CVE-2019-07082

Apple Reference Image: A New Approach for Verified Photography

Apple introduces Reference Image, hardware-backed verifiable photography on iPhone 18 Pro using sensor signing and Private Cloud Compute to counter AI-generated fakes.

Apple announced Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that produces securely timestamped, verifiable photographs. The design splits into two phases: a secure digital negative created by cryptographically signing pixel data at the sensor immediately after capture (preventing injection or tampering), then developing that negative into a reference image. Private Cloud Compute handles processing without exposing image contents to anyone, including Apple, and fraudulent reference images can be revoked without revealing the photographer's identity. Apple positions the system as stronger than C2PA-based approaches, which sign metadata after capture, are vulnerable to editing-chain compromise, and can tie images to a device or individual.

Hacker News · security · 2d agoResearchHN 25↑ · 18 comments

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Compromised Admin Menu Editor Pro update server distributed backdoored plugin versions installing web shells and hidden admin accounts on roughly 1,500 WordPress sites.

A threat actor with root-level access to adminmenueditor.com pushed trojanized Admin Menu Editor Pro versions 2.35 and 2.36 containing includes/wp-user-consent.php, which installed a web shell and created a hidden wp_-prefixed user account. At least 230 customers and roughly 1,500 sites installed the malicious update, with several hundred more downloads possibly affected. Developer Janis Elsts took the site offline after the attacker recompromised the clean 2.36 release; version 2.34 and the free plugin are believed unaffected.

BleepingComputer · 2d agoMalware in the wild1

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · security · 2d agoResearch1

Most Fraudulent Hires Receive Credentials Before Detection

HYPR report finds 42% of fraudulent hires pass screening and receive corporate credentials, averaging 5.73 days of unmonitored network access before detection.

A HYPR study of 500 US HR executives found 42% of fraudulent candidates pass pre-hire screening and get hired, with only 3% detected on their hire day and 20% remaining undetected up to three weeks. This gives fraudulent hires an average of 5.73 days of unmonitored corporate network access, and 98% of surveyed executives said they had experienced candidate fraud firsthand. The report follows a September 9 CISA update to its Insider Threat Mitigation Guide warning that malicious actors use AI tools to obtain remote IT jobs, a tactic long used by North Korean actors for data theft and extortion.

Infosecurity Magazine · 2d agoPhishing & fraud

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackers · 3d agoIndustry

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated · 2h agofirst · 3d agoExploit / PoC in the wild 9 sourcesCVE-2026-27540

New Phishing Attacks Use Trusted Email Infrastructure and URL Cloaking to Bypass Security Tools

Virus Bulletin Q3 2026 report details phishing using DKIM-aligned senders, Amazon SES delivery, and real-time URL cloaking to evade email security and scanners.

Virus Bulletin's Q3 2026 testing found phishing campaigns delivered through trusted infrastructure like Amazon SES with DKIM-aligned sender domains. Samples included a German overdue-invoice lure redirecting to OpenSea crypto fraud and a Romanian BCR-branded PSD2 banking credential-theft campaign. Cloaking pages used hidden iframes, browser fingerprinting, and time-zone checks to show different content to scanners versus victims. Defenders are urged to inspect full redirect chains rather than attachments or initial URLs alone.

Cyber Security Newsupdated · 3d agofirst · 3d agoPhishing & fraud in the wild 2 sources

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA Advisories · 3d agoAdvisoryCVE-2024-42384CVE-2024-42385CVE-2024-42386+11 CVEs

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackers · 3d agoIndustry in the wild

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersupdated · 1d agofirst · 3d agoExploit / PoC in the wild 4 sourcesCVE-2024-21762CVE-2020-1938

Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group

Recorded Future details Tajin Group, a Chinese-speaking vendor on Telegram guarantee marketplaces running phishing, carding, and money laundering operations targeting Chinese banks.

Insikt Group analyzed Tajin Group, a Chinese-speaking threat actor operating on Telegram-based guarantee marketplaces Dabai Guarantee and, since May 2026, Xinbi Guarantee. The group conducts phishing, payment card theft, and money laundering targeting mainland Chinese citizens and banks, testing stolen cards from twelve countries on platforms like CCAvenue and Geidea. Operators bought and sold at least 100 Telegram usernames and anonymous virtual numbers via Fragment Market to strengthen OPSEC, linking multiple usernames to single Telegram accounts. Recorded Future warns Tajin Group's TTPs are likely to be replicated by other vendors on Chinese-language guarantee marketplaces at global scale.

Recorded Future · 3d agoThreat actor

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net Security · 3d agoIndustry1

Human Attacker Hits Machine-Speed Exploitation of Marimo RCE

Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.

Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.

Infosecurity Magazineupdated · 3d agofirst · 3d agoExploit / PoC in the wild 4 sourcesCVE-2026-39987

Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update

Microsoft's September 2026 Patch Tuesday updates (KB5124008) can break Remote Desktop Services, causing RDP failures and freezes across Windows clients and servers.

Microsoft confirmed its September 2026 security updates, including KB5124008 for Windows 11 24H2/25H2, introduced a reliability regression where RDP connections fail after several minutes and servers hang at the 'Please wait for the Remote Desktop Configuration' screen. MMC, RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page may also stop responding. The issue affects Windows 10/11 clients and Windows Server 2012 through 2025; Microsoft marked it Mitigated on September 11 and is developing a permanent fix, with VM restart offered as a temporary workaround.

Cyber Security News · 4d agoAdvisory1