ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “update controller”

190 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 44Vulnerability 39Advisory 29Malware 20AI safety & security 19Industry 17Phishing & fraud 14Threat actor 13AI research 12Tools 10AI industry 10Research 8Model release 3Policy & legal 3
SeverityAllcritical 17high 96medium 47low 6info 79

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.

CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.

The Hacker Newsupdated · 2h agofirst · 5h agoExploit / PoC in the wild 2 sourcesCVE-2026-5430

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA Advisories · 23h agoAdvisoryCVE-2026-78225CVE-2026-81855

12 Best Container Security Tools Compared (2026): Features & Pricing

GBHackers compares pricing and features of 12 container security platforms, from free Trivy, Falco, and SUSE NeuVector to commercial Sysdig, Wiz, and Aqua.

A procurement-focused comparison of twelve container security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, and CrowdStrike, centered on billable units (per node, workload, developer, or vCore) and pricing mechanics. The piece argues free open-source tools like Trivy, Falco, and NeuVector set a floor that commercial products must justify exceeding through enforcement and scale. It also notes rising container threats, including Kubernetes flaws exploited to jump from containers to cloud accounts and exposed container registries.

GBHackers · 1h agoIndustry 13 sources

AdamX: Cosine similarity meets gradient descent

Researchers propose AdamX, a cosine-similarity-based first-order optimizer with variance rectification that matches Adam-class convergence across benchmark datasets and architectures.

The paper introduces AdamX, a first-order optimizer that uses cosine similarity as an adaptive mechanism for controlling update magnitudes, plus a variance rectification scheme for smoother optimization early in training. The method is described as scalable, model-agnostic, and straightforward to integrate into existing pipelines. Empirically, AdamX shows competitive convergence rates measured by epochs to reach performance thresholds under a fixed hyperparameter budget, with code and experiments released on GitHub.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research

Why Patch Automation Needs Brakes, Not Just an Accelerator

Action1's field CTO argues patch automation needs staged deployments and stop conditions, not just speed.

Gene Moody, Field CTO at Action1, writes on BleepingComputer that patch automation must pair acceleration with safeguards. He recommends staged deployment rings with predefined go/no-go criteria, keeping human judgment for domain controllers, databases, and ERP systems. The piece warns that automation without brakes can push a bad update to 10,000 endpoints as fast as a good one.

BleepingComputer · 1d agoIndustry

Privacy-Aligned Personalized Federated Learning with Compact Adaptation and Variable-Length Gaussian Communication

Paper releases a private client context once and confines adaptation to coefficients, matching full-model differential privacy with 2.67x less uplink on CIFAR-10.

The paper addresses the dimensionality misalignment between record-level differential privacy and low-dimensional client variation in personalized federated learning by releasing a private client context once and restricting repeated adaptation to a fixed coefficient space. A variable-length quantized Gaussian mechanism lets quantization error itself serve as the required privacy perturbation. On MNIST and CIFAR-10, the design matches or outperforms full-model private adaptation across privacy budgets and client heterogeneity while cutting protected uplink 2.67x at epsilon=16 on CIFAR-10.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research1

Top 10 Best Ransomware Protection Solutions in 2026

A 2026 buyer's guide ranks ten ransomware protection tools by kill-chain role as extortion shifts from encryption to data theft.

The roundup organizes defenses across the ransomware kill chain: prevention-grade EPP/EDR platforms, containment layers, rollback specialists, and immutable recovery. Recommended products include CrowdStrike, Microsoft Defender, Sophos, SentinelOne, Bitdefender, Trend Micro, Halcyon, Huntress, and Malwarebytes. It stresses that many crews now extort on stolen data without encrypting, making exfiltration detection and response speed as important as rollback.

Cyber Security News · 6d agoIndustry1

AI workflows may be creating a dangerous new authorization blind spot

Noma Labs researchers describe 'workflow identity hijacking,' letting unauthenticated users trigger privileged AI workflows that execute actions with high-privilege service accounts.

Noma Labs lead researcher Sasi Levi detailed 'workflow identity hijacking,' where benign unauthenticated inputs via support inboxes, GitHub issues, or web forms trigger enterprise AI pipelines that execute privileged actions. The workflow runs using high-privilege service accounts or developer API keys, decoupled from the requester's identity, effectively creating a confused-deputy condition. Unlike prompt injection, the model behaves correctly; the failure lies in authorization enforcement at the workflow layer, and activity blends into routine automation. Mitigations include identity-aware access at execution points and user-context propagation between AI outputs and downstream operations.

CSO Onlineupdated · 5d agofirst · 5d agoAI safety & security 2 sources

ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.

Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.

CSO Online · 6d agoAI safety & security

Coupled Calibration and Learning: Mitigating Teacher Bias in LLM Distillation without Target-Domain Reward Feedback

CCL couples teacher calibration with student updates via token-level branching, provably removing teacher bias in LLM distillation.

The paper proposes Coupled Calibration and Learning (CCL), an LLM distillation algorithm that alternates teacher calibration using source-question reward feedback with student training on target questions under covariate shift. Each iteration calibrates the teacher on source feedback, trains the student on target questions, and lets the updated student inform subsequent calibration. The authors prove the student's expected KL divergence to the oracle student converges to zero at a polynomial rate, and show regularized direct matching error can remain bounded away from zero.

arXiv cs.AI / cs.LG / cs.CL · 17h agoAI research

WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review

WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.

WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.

GBHackersupdated · 4d agofirst · 5d agoTools 7 sources1

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blogupdated · 5d agofirst · 6d agoExploit / PoC in the wild 4 sourcesCVE-2026-59822CVE-2026-598211

Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly

Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.

Per Trellix, threat actors increasingly abuse Active Directory replication via DCSync, using privileged credentials to invoke DRSGetNCChanges and retrieve NTLM password hashes and Kerberos key material without running code on domain controllers. Capturing the krbtgt account hash enables forging Golden Tickets for persistent, highly privileged domain access. Because malicious replication traffic mimics legitimate DRS/RPC activity, defenders should monitor Windows Security Event ID 4662, restrict replication permissions, and investigate replication requests from non-domain-controller systems.

GBHackers · 5d agoResearch in the wild 2 sources2

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber Security · 4d agoAdvisory2

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.

Huntress SOC investigated two August incidents where phishing links led to fake CAPTCHA checks and Adobe PDF Reader lures rendered as browser-in-the-browser (BiTB) pages spoofing legitimate domains like get.adobe.com. Victims downloaded what they believed was Acrobat Reader but actually installed ScreenConnect.ClientSetup.exe from attacker infrastructure, yielding two rogue ScreenConnect clients with service-based persistence. The attacker used cmd.exe and curl to stage a second client connecting to 144.172.115.59, leveraged a ScreenConnect Trial Relay domain for stealth, and ran HideCursor.exe as a defense-evasion binary. Incident 2 arrived via AT&T Office@Hand (RingCentral), with both chains stopped before broader impact.

Huntress · 6d agoPhishing & fraud in the wild

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated · 23h agofirst · 1d agoMalware in the wild 7 sources

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackers · 23h agoVulnerability 2 sourcesCVE-2026-78006CVE-2026-78159

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.

CERT/CC issued VU#687587 for CVE-2026-12780, an incorrect permission assignment (CWE-732) in the amwrtdrv.sys kernel driver shipped with AOMEI Backupper 8.4.0. The driver exposes a world-accessible device object without a security descriptor, allowing any unprivileged user to write arbitrary physical disk sectors; with Secure Boot disabled, an attacker can modify the GPT and inject a UEFI payload that executes before the OS loads, bypassing HVCI, EDR, Windows Defender and Hyper-V isolation. On TPM-only BitLocker configurations the attack can capture Volume Master Key material during pre-boot. AOMEI has shipped patches; users who cannot update should uninstall the software or disable the amwrtdrv.sys service, and enabling Secure Boot adds defense in depth.

CERT/CC Vulnerability Notes · 5d agoVulnerabilityCVE-2026-127801

Chrome, Firefox Updates Patch 115 Vulnerabilitiesnew

Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.

Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.

SecurityWeek · 46m agoVulnerabilityCVE-2026-91726CVE-2026-91721CVE-2026-91749

New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks

Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.

Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.

Cyber Security News · 4d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.

Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.

The Hacker Newsupdated · 2d agofirst · 5d agoExploit / PoC in the wild 7 sourcesCVE-2026-42018CVE-2026-42016CVE-2026-823292

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security News · 8h agoVulnerabilityCVE-2026-91721CVE-2026-91749CVE-2026-91726+27 CVEs

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek · 4d agoIndustry in the wildCVE-2026-148942

Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities

Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.

Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.

GBHackers · 5h agoAdvisory

The AI graveyard: a running list of projects and startups that didn’t make it

TechCrunch compiles a running list of failed AI products and startups, including Relay, OpenAI's Sora, Humane AI Pin, Notion Mail, and Microsoft's Recall.

TechCrunch's 'AI graveyard' tracks notable AI products and startups that shut down or underperformed, citing S&P Global data that about 42% of AI initiatives are abandoned. Examples include the Relay automation startup, OpenAI's Sora video platform (shut March 2026), ChatGPT Atlas browser (discontinued August 9), Notion Mail (shutting September 22), and Apple's delayed Siri AI that contributed to a $250 million settlement. Hardware failures include the Humane AI Pin ($230 million raised, assets sold to HP for $116 million) and the Rabbit R1, which sold 100,000 units but received poor reviews. Microsoft's Recall feature remains controversial after a researcher demonstrated a tool extracting its captured data.

TechCrunch · AI · 16h agoAI industry1

Cybercriminals are building phishing pages that exist only inside victims’ browsers

Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.

Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.

Help Net Securityupdated · 5d agofirst · 6d agoPhishing & fraud in the wild 3 sources

Rapidly scaling online storage to serve over 1 billion ChatGPT users

OpenAI's Habitat online storage platform now handles over 70 million requests per second and 500 PB of data for 1 billion users.

OpenAI details the evolution of Habitat, its online storage platform backing ChatGPT and other products, which began in mid-2024 as a Python client-side library over Azure Cosmos DB. Habitat now processes more than 70 million requests per second, serves over 500 petabytes of data across nearly 40 geographic regions, and supports over 1 billion users weekly. By mid-2025 the client library approach became brittle, so OpenAI moved Habitat into a standalone service to centralize deployments, observability, and multi-tenancy reliability. This is part one of a two-part series; a future post will cover read optimization and scaling the Azure Cosmos DB partnership.

OpenAI News · 5d agoAI tools & infra1

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security News · 3h agoVulnerability in the wildCVE-2026-62721

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker News · 5d agoIndustry in the wild

[Control systems] Advantech security advisory (AV26-907)

Canada's Cyber Centre flagged vulnerabilities in the Advantech WISE-6610 industrial gateway and urged users to apply available updates.

Advisory AV26-907, dated September 10, 2026, states that multiple versions and models of the Advantech WISE-6610 industrial gateway are affected by vulnerabilities. The Canadian Centre for Cyber Security encourages users and administrators to review the provided links and apply updates as they become available. No CVE identifiers or exploitation details were included in the announcement.

Canadian Centre for Cyber Security · 5d agoAdvisory

DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.

Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.

GBHackers · 1d agoResearch

With iOS 27, I’m actually using Siri again

Apple's rebuilt Siri, powered by Google Gemini models in iOS 27, finally handles complex multi-step and on-screen-context requests, per TechCrunch review.

Apple's iOS 27 ships a redesigned Siri built on Google's Gemini models, supporting multi-step instructions, on-screen context, file/message/email lookups, and camera viewfinder queries. Siri AI gets a dedicated app with chat history, plus settings for voice and expressiveness. Apple Intelligence also adds natural-language Shortcuts creation and automatic password rotation in the Passwords app.

TechCrunch · AI · 1d agoAI industry

HybridFLow: SDN-Orchestrated Client Partitioning for Hybrid Federated Learning

HybridFLow uses SDN topology visibility to partition federated-learning clients into sync/async groups, reaching 80% accuracy 33-40% faster than SmartFLow.

HybridFLow is a closed-loop, SDN-driven orchestration framework for hybrid federated learning that integrates network-layer intelligence into cross-silo training. It leverages the SDN controller's global topology view to generate calibrated per-client communication-time estimates, partitioning clients into synchronous and asynchronous groups while balancing round latency and update staleness, with measured times fed back after each round. Across multiple network topologies it reaches 80% target accuracy 33-40% faster than SmartFLow and cuts average round duration by 30-40 seconds, while FedAsync fails to reach target accuracy under non-IID data.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security News · 19h agoVulnerabilityCVE-2026-65414CVE-2026-84607CVE-2026-64752+7 CVEs1

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.

Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.

GBHackersupdated · 1d agofirst · 2d agoThreat actor in the wild 3 sourcesCVE-2026-51990CVE-2021-380031

[Control systems] GeoVision security advisory (AV26-913)

Canada's Cyber Centre (AV26-913) warns GeoVision GV-LPC2011/LPC2211 firmware 1.13 license-plate cameras are affected by vulnerabilities and urges updates.

The Canadian Centre for Cyber Security issued control-systems advisory AV26-913 on September 11, 2026, noting that GeoVision GV-LPC2011/LPC2211 firmware version 1.13 is affected by vulnerabilities. The bulletin references the vendor advisory GV-LPC-2026-09-01 but provides no CVE identifiers or exploitation details. Administrators are encouraged to review the linked advisories and apply updates as they become available.

Canadian Centre for Cyber Security · 4d agoAdvisory

CISA Updates Insider Threat Guide With New Mitigation Advice

CISA updated its Insider Threat Mitigation Guide on September 9 with new case studies and guidance on hybrid work, AI and employee separations.

CISA published a revision of its Insider Threat Mitigation Guide, first issued in 2020, adding case studies, statistics and guidance for security, HR and leadership audiences. New material covers hybrid and remote work changes to physical and digital access, AI used to manipulate or deceive, access control, visitor screening and adverse employee separations. The agency framed the update around growing insider threat impact on critical infrastructure and pointed to preparedness resources for organizations without existing programs.

Infosecurity Magazine · 5d agoAdvisory

[Control systems] Schneider Electric security advisory (AV26-912)

Canada's Cyber Centre relays a Schneider Electric advisory covering multiple vulnerabilities in EcoStruxure IT Data Center Expert and PowerLogic T300, urging users to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-912 noting that as of September 9, 2026 Schneider Electric is affected by vulnerabilities in EcoStruxure IT Data Center Expert versions 9.1.2 and prior, and PowerLogic T300 versions 2.9.8-5620 and prior. The issues include an improper neutralization of special elements used in an OS command on the PowerLogic T300. The advisory recommends reviewing vendor notifications, performing suggested mitigations, and applying necessary updates.

Canadian Centre for Cyber Security · 4d agoAdvisory

Hackers Advertise Uncensored Luciferus AI Service on Underground Forums

Sophos CTU found Luciferus, an uncensored criminal AI subscription service on the Exploit forum that returned RAT source code on request.

Sophos Counter Threat Unit discovered Luciferus advertised on August 24, 2026 on the Exploit forum by persona 'Optimus_Prime', claiming a proprietary 120-billion-parameter uncensored model that analysts assess with low confidence may be built on Alibaba's Qwen. Subscriptions run $35-$75 monthly, with a VIP 'Individual Embodiment' tier offering a separately deployed model trained on customer data. In testing, the Junior model generated Python remote-access-trojan source code, though Sophos did not execute or verify it. The service extends the WormGPT/FraudGPT lineage into structured commercialization with tiered pricing resembling mature SaaS businesses.

Cyber Security News · 20h agoAI safety & security

Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters

VBSpam Q3 2026 test shows phishers abusing DKIM-aligned domains, Amazon SES, and multi-stage URL cloaking to defeat email filters.

Virus Bulletin's Q3 2026 VBSpam test (AMTSO-LS1-TP207) found phishing campaigns moving payloads past the email itself via browser-fingerprinting gates, redirect chains, and hidden POST requests. Examples include a Dutch McAfee/TotalAV scareware renewal scam, a German overdue-payment Web3 fraud delivered via Amazon SES from DKIM-aligned moolaah.com, and Romanian BCR PSD2 credential phishing embedding IPv6-mapped URLs resolving to 103.193.179.223. Net at Work NoSpamProxy ranked first with a 99.995 score while open-source Rspamd caught only 62.55% of phishing mail.

GBHackers · 22h agoPhishing & fraud in the wild 2 sources