Search: “macOS”

49 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 14 Industry 11 Malware 11 AI industry 5 Research 4 Phishing & fraud 4 Advisory 3 Tools 3 AI tools & infra 2 AI research 2 Model release 2 Exploit / PoC 2 AI safety & security 1

SeverityAll critical 2 high 18 medium 13 low 0 info 31

Atomic macOS (AMOS) Stealer Activity

Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.

Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.

Palo Alto Unit 4210:00 UTC · 4h agoMalware in the wild

MacOS 27 - First Boot, (Tue, Sep 15th)

SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.

Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.

SANS Internet Storm CenterSep 15, 15:23 UTC · 22h agoResearch

Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.

Threat actors use ClickFix social-engineering lures, SEO poisoning, and malvertising impersonating brands like Claude, ChatGPT, Zoom, and Docker to trick users into pasting curl-to-zsh commands into Terminal, evading Gatekeeper and notarization checks. The MacSync Stealer (formerly Mac.c, emerged April 2025, linked to developer 'Mentalpositive') is a 64-bit Mach-O stager with single-byte XOR string obfuscation that daemonizes, polls C2 with custom API-key headers, streams AppleScript payloads into osascript, and persists via fake LaunchAgents. It steals browser credentials, Keychain data, SSH keys, session tokens, and crypto wallets, exfiltrating archives in 10MB HTTP PUT chunks. Microsoft documented more than 30 related MacSync domains.

GBHackersupdated Sep 10, 09:53 UTC · 6d agofirst Sep 10, 07:01 UTC · 6d agoMalware in the wild 2 sources

HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware

Hijacked HBO Max verified Reddit account ran 108 ClickFix malvertising ads delivering AMOS and Amatera stealers plus crypto clippers to macOS and Windows users.

Threat actors hijacked HBO Max's verified Reddit account (u/hbomax) to run 108 malicious ClickFix ads over 48 hours in a campaign tracked as PasteSwitch, researched by Hudson Rock and ADAMnetworks. macOS victims were served curl | zsh chains deploying MacSync and Atomic macOS Stealer (AMOS), which harvest browser credentials, Telegram data, Apple Notes, and macOS passwords, while fake Ledger, Trezor, and Exodus apps targeted BIP39 seed phrases. Windows users received an InstallFix chain using an MP3/HTA polyglot with mshta and PowerShell, scheduled-task persistence, AMSI disabling, and in-memory Amatera Stealer that hid C2 traffic (77.91.65.13:443) behind a facebook.com TLS SNI. AnimateClipper and ZigClipper components swapped copied crypto wallet addresses and used Binance Smart Chain contracts as mutable C2 dead drops; Reddit paused the ads and the initial access path remains undisclosed.

GBHackersupdated Sep 15, 11:51 UTC · 1d agofirst Sep 15, 05:22 UTC · 1d agoMalware 7 sources

Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Apple patched a record 200+ vulnerabilities in iOS 27 and macOS Golden Gate 27, including 20 kernel flaws; none exploited in the wild.

Apple's iOS 27 and iPadOS 27 releases fix roughly 126 security flaws, 20 of them in the kernel, while macOS Golden Gate 27 addresses 210 vulnerabilities, about 100 shared with the mobile release. macOS Tahoe 26.7 patches 153 unique CVEs, including 26 kernel defects that could cause memory corruption, privilege escalation, system termination, and information leaks. Notable fixes include CVE-2026-64752, a CoreMedia memory corruption flaw allowing iPhone compromise via a malicious image, and CVE-2022-3437, a heap buffer overflow in Heimdal Samba enabling denial-of-service. Apple states none of the patched flaws are known to be exploited in the wild.

SecurityWeekSep 15, 11:06 UTC · 1d agoVulnerability CVE-2022-3437 CVE-2026-647521· 1 read

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security NewsSep 15, 15:51 UTC · 22h agoVulnerability CVE-2026-65414 CVE-2026-84607 CVE-2026-64752+7 CVEs1

Apple releases iOS 27, macOS Golden Gate 27 with Siri AI and Liquid Glass refinements

Apple released iOS 27 and macOS Golden Gate 27 with a LLM-based Siri AI overhaul powered by new AFM 3 on-device and cloud models.

Apple shipped its 2026 annual OS updates: iOS 27, macOS 27 Golden Gate, watchOS 27, visionOS 27, and tvOS 27. Siri AI is the flagship feature, offering context-aware responses, personal history search, app interaction, and a dedicated Siri app. The stack includes AFM 3 Core (3B parameters on-device), AFM 3 Core Advanced (20B sparse model activating 1-4B parameters), plus AFM 3 Cloud, ADM 3 Cloud (Image), and AFM 3 Cloud Pro server models. Additional features include prompt-generated Shortcuts and Safari extensions, new photo editing options, and a Liquid Glass transparency slider.

Ars Technica · AISep 14, 19:28 UTC · 1d agoAI industry1

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm CenterSep 14, 18:33 UTC · 1d agoVulnerability CVE-2022-3437 CVE-2026-20683 CVE-2026-28899+27 CVEs

macOS 27.0 RC (26A428)

Apple seeded the macOS 27.0 Release Candidate (build 26A428) to developers ahead of the final public release.

Apple published a Release Candidate build of macOS 27.0, labeled 26A428, on its developer release page. The notice only provides download and release-notes links and includes no security content, CVEs, or threat information. RC builds typically precede the general availability of the final operating system version.

Apple software releasesupdated Sep 14, 17:00 UTC · 1d agofirst Sep 9, 17:00 UTC · 6d agoAdvisory 2 sources

Homebrew 7.0.0 is out, here’s what changed for security

Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.

Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.

Help Net SecuritySep 15, 00:47 UTC · 1d agoVulnerability

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.

The Register · SecuritySep 15, 21:38 UTC · 16h agoVulnerability CVE-2026-65410 CVE-2026-65409 CVE-2026-43689+10 CVEs

Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.

Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.

Cyber Security NewsSep 15, 13:55 UTC · 1d agoTools

Apple's Siri AI Can Be Swapped Out for Claude, ChatGPT, Code Shows

Code analysis of iOS 27 and macOS Golden Gate frameworks shows Apple engineered Siri to deeply interoperate with third-party AI models like Claude and GPT-5.6.

Code sleuth 'pdfu' uncovered private frameworks in iOS 27 and macOS Golden Gate revealing a 'Model Delegation' mechanism that lets Claude act as a Siri extension like the built-in ChatGPT extension. A second 'Inference Providing' protocol in Model Manager Services can fully replace Siri's server-side model with models such as GPT-5.6, which then receives Apple's Siri planner prompt and tool definitions to perform system actions and process personal data. The EU Digital Markets Act, which requires Apple to give third parties effective access to iOS features, may have shaped this approach. The entitlement is not yet open to third parties and Claude is not yet available in the macOS 27 Golden Gate RC.

Hacker News · AISep 14, 12:01 UTC · 2d agoAI industry HN 57↑ · 14 comments

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.

Ars Technica · SecuritySep 11, 11:30 UTC · 5d agoPhishing & fraud in the wild1

Top 10 Best Endpoint Privilege Management (EPM) Tools in 2026

A 2026 scorecard ranks ten endpoint privilege management tools, led by BeyondTrust, ThreatLocker and Delinea for elevation, coverage and policy depth.

The article ranks ten endpoint privilege management (EPM) tools using weighted criteria covering elevation workflow, platform coverage, policy depth, time-to-value and value. BeyondTrust scored highest overall (8.4) for cross-platform breadth, with ThreatLocker (8.2), Delinea (8.1) and Admin By Request (8.0) highlighted for allowlisting integration, cloud administration and deployment speed respectively. It also notes that Netwrix acquired CoSoSys in 2024, which affects bundling when shortlisting both EPM and device control.

Cyber Security NewsSep 10, 07:58 UTC · 6d agoIndustry

Homebrew 7.0.0 gets built-in GUI, better security controls

Homebrew 7.0.0 adds a built-in vulnerability scanner (brew vulns), a Homebrew advisory database, stronger sandboxing, and the BrewUI GUI.

Homebrew 7.0.0 ships a native BrewUI graphical interface for macOS 26 Tahoe and later, plus a new 'brew vulns' command that queries OSV.dev in batch to flag vulnerabilities in installed formulae, specific packages, or Brewfile dependencies. The release also introduces a Homebrew-specific OSV-format advisory database distinguishing outstanding vulnerabilities from backported fixes. Sandbox improvements block home directory access by default and separate network-enabled dependency downloads from offline installs.

BleepingComputerSep 14, 19:51 UTC · 1d agoTools1

Top 10 Best Endpoint Encryption Software in 2026

A 2026 roundup of ten endpoint encryption products argues the engines are solved and buyers should choose management layers like Intune, Sophos, or Trellix.

The guide ranks ten endpoint encryption options, arguing BitLocker and FileVault have won the engine war so the real purchase decision is the management layer for compliance proof, key escrow, and cross-platform policy. Microsoft BitLocker with Intune is named the baseline for Windows estates, with Sophos, ESET, Trend Micro, Check Point, Trellix, and others covering mixed or regulated fleets. It also warns that TrueCrypt-lineage freeware is unmaintained and that Kaspersky cannot be sold to US customers.

Cyber Security NewsSep 10, 08:15 UTC · 6d agoIndustry

GPT-6 Astra, Looped Transformers, and Hidden Reasoning

OpenAI released GPT-6 Astra, its strongest model to date, with standout 3D rendering and computer-use performance and 99.9% on ARC-AGI-3.

Sebastian Raschka reviews OpenAI's GPT-6 Astra, calling it the best model he has used, with disproportionate gains in 3D rendering, animation, and computer use through the Codex/ChatGPT harness. The model scores 99.9% on ARC-AGI-3 versus 7.8% for GPT-5.6 Sol and leads the Artificial Analysis Coding Agent Index, though gains on independent aggregate indices are more incremental. The article also explains looped transformer/recurrent depth architecture rumors, speculation that Astra hides its chain-of-thought reasoning, and recent research insights on the topic.

Hacker News · AIupdated Sep 12, 20:00 UTC · 3d agofirst Sep 9, 14:37 UTC · 6d agoModel release 11 sources HN 84↑ · 12 comments2

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)

CVE-2026-90894 in Parallels Desktop for Mac lets any local user gain root via argument injection; patched in v27.0.0, PoC withheld.

JFrog researchers disclosed CVE-2026-90894, an argument injection flaw in Parallels Desktop for Mac v26.4.0 on Apple silicon that lets any local user gain root on the host. The chain combines a world-writable Unix socket for prl_disp_service (which runs as root), weak peer-credential authentication, and argument injection via --use-compress-program in the appliance extraction tar path. Alludo fixed the flaw in Parallels Desktop v27.0.0 in early September 2026; JFrog published technical details but withheld its proof-of-concept script.

Help Net Securityupdated 13:14 UTC · 1h agofirst 12:36 UTC · 1h agoVulnerability 4 sources CVE-2026-90894

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security News03:01 UTC · 11h agoVulnerability CVE-2026-91721 CVE-2026-91749 CVE-2026-91726+27 CVEs

Building a Linux GPU Driver for the M4 Mac Mini in One Month

Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.

Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.

Hacker News · AISep 15, 19:30 UTC · 18h agoResearch HN 40↑ · 5 comments

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings

ANY.RUN announced G2 Fall 2026 Grid Leader and Momentum Leader recognition in the malware analysis category, citing 700,000+ users.

ANY.RUN announced it was named both Grid Leader and Momentum Leader in G2's Fall 2026 malware analysis rankings, citing customer satisfaction and market momentum. The vendor states its Interactive Sandbox is used by over 700,000 security professionals and 16,000+ SOC and MSSP teams across Windows, Linux, macOS, and Android. It also cites claimed efficiency gains, including faster investigations for 95% of SOCs and MTTR reductions of up to 21 minutes per case.

ANY.RUNSep 10, 09:39 UTC · 6d agoIndustry1

12 Best Patch Management Software Compared (2026): Features & Pricing

GBHackers ranks NinjaOne, ManageEngine, and Automox atop twelve patch management tools for 2026, emphasizing third-party application coverage.

GBHackers scored twelve patch management platforms on coverage, automation, visibility, deployment, and value, with NinjaOne ranked highest at 4.55. Action1 is highlighted for its genuinely usable free tier, ManageEngine for third-party catalog breadth, and Automox for cloud-native cross-OS automation. The piece notes that unpatched known vulnerabilities remain a top initial-access vector, citing CISA's Known Exploited Vulnerabilities catalog.

GBHackersSep 10, 08:19 UTC · 6d agoIndustry 4 sources

Top 10 Best Device Control & USB Security Tools in 2026

A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.

The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.

Cyber Security NewsSep 10, 08:05 UTC · 6d agoIndustry

Apple’s new iPhone camera mode promises to prove your photo isn’t AI

Apple's iPhone 18 Pro adds a Reference Image mode that cryptographically signs camera sensor pixels to prove photos were not AI-generated or edited.

Apple will launch a Reference Image mode with the iPhone 18 Pro lineup, using the new camera sensor to sign every pixel and develop the signed data via Private Cloud Compute into an unalterable reference image viewable in Photos. Users can compare the reference image against edited versions to verify authenticity, building on provenance standards like SynthID, C2PA, and Meta's Content Seal. A Reference Image API will span iOS, iPadOS, and macOS for third-party apps, though the feature launches without EU support, arriving there in iOS 27, iPadOS 27, and macOS 27.

The Verge · AIupdated Sep 10, 08:18 UTC · 6d agofirst Sep 9, 19:30 UTC · 6d agoAI industry 6 sources

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.

ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.

Cyber Security Newsupdated Sep 10, 18:00 UTC · 5d agofirst Sep 9, 14:26 UTC · 6d agoMalware in the wild 2 sources1

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.

Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.

SecurityWeek11:32 UTC · 2h agoVulnerability 3 sources CVE-2026-78159 CVE-2026-78006

[AINews] Jev: a “System One Model” that only decides/classifies/routes/scores — >100x faster, >200x cheaper than small frontier LLMs

TypeSafe launches Jev, an RLCD-trained decision model claiming 20-200x faster, 40-400x cheaper classification than frontier LLMs, alongside Gemini 3.8 Live and Neon.

TypeSafe's Jev is a 'System One' decision model trained with RLCD, claiming 20-200x faster and 40-400x cheaper classification and routing than frontier LLMs with free output tokens and no hallucinated text. Google launched Gemini 3.8 Live and 3.8 Live Extended Thinking, supporting 97 languages and async tool calls, debuting #1 on Artificial Analysis' speech-to-speech index at 82.6. Periodic Labs' Neon is a ~1T-parameter XRD analysis model trained with RL on proprietary lab data using 1,300 H200s, lifting FrontierXRD success from 2.7% to 55.3% and beating GPT-6 Astra at lower inference cost.

Latent Space11:09 UTC · 3h agoModel release

Chrome, Firefox Updates Patch 115 Vulnerabilities

Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.

Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.

SecurityWeek10:28 UTC · 3h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeek08:39 UTC · 5h agoExploit / PoC in the wild 2 sources CVE-2026-54302· 1 read

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

Oracle's September 2026 Critical Patch Update fixes 800+ vulnerabilities, including over 100 critical flaws and 240+ remotely exploitable without authentication.

Oracle released 673 new security patches in its September 2026 Critical Security Patch Update, resolving 672 unique CVEs across 17 risk matrices plus 130+ additional CVEs. More than 100 flaws are critical severity and over 240 are remotely exploitable without authentication. Oracle E-Business Suite received the largest batch with 159 patches, followed by Fusion Middleware (153, including 78 unauthenticated remote flaws) and Hyperion (102). Oracle reports no exploitation of these specific flaws but warns attackers routinely exploit unpatched Oracle products.

SecurityWeekupdated 13:03 UTC · 1h agofirst 08:06 UTC · 6h agoAdvisory 2 sources

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackers05:00 UTC · 9h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749+27 CVEs

Saving Jet Fuel

Tutorial optimizes flight paths to cut jet fuel costs using open-source Scikit-decide planning framework and OpenAP aircraft performance models.

A technical walkthrough demonstrates wind-aware flight path optimization using Scikit-decide, an open-source framework for reinforcement learning and automated planning, paired with OpenAP fuel-consumption models built by Dr. Junzi Sun at TU Delft and NOAA wind data. A Boeing 787-9 flying EWR to FCO can require roughly $68K in fuel, and adjusted routing could save thousands. The post uses Python 3.12, DuckDB with spatial extensions, and QGIS for map rendering.

Hacker News · AISep 15, 23:17 UTC · 14h agoAI tools & infra HN 45↑ · 19 comments

Apple brings a fully revamped Siri built on Google's Gemini, but not to the EU

Apple shipped its fully rebuilt Siri running on Google's Gemini models with iOS 27, initially excluding the EU and China over regulatory hurdles.

Apple released 'Siri AI' as an English beta within iOS 27, iPadOS 27, macOS 27, watchOS 27, and visionOS 27, built on Google's Gemini models running partly on-device and partly through Private Cloud Compute. The rollout excludes the EU and China at launch due to regulatory requirements, with French, Japanese, Korean, Portuguese, and Spanish support due next month. Early reviewers call it a step forward but report failures on personal-context queries and occasional hallucinations. Siri integrates with third-party apps like WhatsApp and Audible, with Outlook, Notability, and Tripsy coming later.

The DecoderSep 15, 10:33 UTC · 1d agoAI industry

6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs

ANY.RUN's H1 2026 report details 15 threat trends including 437% growth in fake CAPTCHA phishing and 90.7% rise in Adobe infrastructure abuse.

The report draws on interactive sandbox submissions from over 700,000 analysts and 16,000 SOC teams between January and June 2026. Attacks abusing Adobe infrastructure grew 90.7% versus H2 2025 while RMM-related attacks rose 26.5%, and custom fake CAPTCHA phishing grew 437% from Q1 to Q2 2026. ANY.RUN argues static IOCs are losing effectiveness as dead drop resolvers hide the final C2 until execution.

ANY.RUNSep 15, 09:05 UTC · 1d agoResearch

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net SecuritySep 15, 05:30 UTC · 1d agoTools1

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net SecuritySep 14, 22:15 UTC · 1d agoIndustry

ClickFix attacks are tricking Mac and Windows users into hacking themselves

ClickFix campaigns trick users into pasting terminal commands via fake CAPTCHAs; latest wave abused HBO Max's hacked Reddit account to push infostealer ads.

ClickFix attacks use fake CAPTCHA or anti-bot prompts on hacked or counterfeit websites to convince victims to copy a command into Windows Command Prompt or macOS Terminal, instantly installing infostealers that steal passwords, logged-in sessions, and crypto wallets. The latest campaign compromised HBO Max's official Reddit account to post hundreds of fake ads linking to a spoofed HBO Max page carrying the lure, per researchers at Hudson Rock. It is unclear how many users were compromised. Because execution happens in the terminal, many attacks evade antivirus tools; enterprises can block terminals domain-wide and Mac users can deploy BlockBlock.

TechCrunch · SecuritySep 14, 18:08 UTC · 1d agoPhishing & fraud in the wild1

Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.

ExPatch researchers found that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to plant invisible JavaScript. When a user opened the export in a browser, the script could exfiltrate every message in that 1,000-message file, rewrite the displayed content, or fake a verification form. The flaw (rated CVSS 3.1 8.2) was fixed by commit 8457d13a in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026), but pre-fix exports remain dangerous since updating the app does not fix old files. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild is claimed.

The Hacker Newsupdated Sep 15, 09:47 UTC · 1d agofirst Sep 14, 17:58 UTC · 1d agoVulnerability 2 sources1