ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “digital forensics”

9 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 4Industry 3AI policy 1Data breach 1
SeverityAllcritical 4high 0medium 1low 0info 4

CenterPoint Energy Confirms Data Breach Exposing Customers’ Personal Information

CenterPoint Energy confirmed an unauthorized third party accessed customer personal data via an external system, disclosed in an SEC Form 8-K filing.

CenterPoint Energy disclosed in a September 14, 2026 Form 8-K that an unauthorized third party obtained personal information of some customers through one of the company's external systems. The company learned of the incident after an online post claimed possession of a customer dataset, then activated incident-response protocols and engaged external forensic specialists. Electric and gas delivery operations were unaffected and the company does not expect a material financial impact, though response, notification, and compliance costs are being incurred. The number of affected customers, data types, and threat actor remain undisclosed as the investigation continues.

GBHackersupdated · 6h agofirst · 10h agoData breach 5 sources

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.

Broadcom patched critical directory traversal flaw CVE-2026-59310 in the vCenter Syslog server on July 29, warning of unauthenticated remote code execution. QUIRSO subsequently found 361 compromised IPs across 47 countries after a suspected APT deployed a reverse SSH tool for persistence and remote access. CISA added the flaw to its KEV catalog with a three-day patch deadline for federal agencies, and over the weekend updated it to flag active abuse by ransomware gangs. Shadowserver tracks over 450 exposed vCenter servers, and CISA has tagged 26 VMware vulnerabilities as exploited in the wild over five years, nine abused by ransomware.

BleepingComputer · 1d agoExploit / PoC in the wildCVE-2026-59310CVE-2025-60710CVE-2025-22225+2 CVEs1

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackers · 1d agoIndustry

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net Security · 1d agoIndustry1

Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider

Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.

Hunt.io found an open directory on server 92.63.180[.]133 holding 298 files detailing an intrusion into Triple T Broadband's 3BB brand, starting from a FortiGate 60F SSL-VPN at mail.3bb.co[.]th:10443. The actor weaponized CVE-2024-21762 (CVSS 9.8, KEV-listed since February 2024) using heap spraying and a ROP chain to gain a reverse shell. Post-exploitation included MeshCentral root-level persistence via www.ayuthayatech[.]com, Dirty COW/PwnKit privilege escalation, credential harvesting, SSH spraying against 55+ internal addresses, and log-deleting cleanup scripts; a stolen OpenVPN certificate and key from Triple T's PKI may still be valid.

Cyber Security Newsupdated · 1d agofirst · 2d agoExploit / PoC in the wild 3 sourcesCVE-2024-217622

AI is exposing a security structure built for yesterday’s threats

EY's Jeffrey Sallet argues AI-driven deepfakes and impersonation require integrating cybersecurity, physical security, HR and legal functions.

The opinion piece contends AI-powered impersonation, deepfakes and automated social engineering cross digital, physical and operational boundaries that siloed security programs cannot cover. It cites an EY survey of 250 corporate leaders where only 12% feel most prepared to detect a targeted physical attack, and describes transnational groups using deepfakes and stolen identities to bypass virtual HR hiring loops. The author urges unified cross-functional verification pipelines and shared threat intelligence between CISOs and chief security officers.

CSO Online · 1d agoIndustry

Hackers Exploit Critical Cisco Secure Email Gateway Vulnerability in the Wild to Run Malicious Code

Cisco warns attackers actively exploit zero-day CVE-2026-76461 in Secure Email Gateway, gaining unauthenticated root command execution via crafted emails.

Cisco PSIRT confirmed active in-the-wild exploitation of CVE-2026-76461 throughout September 2026, a zero-day in Secure Email Gateway AsyncOS that lets remote, unauthenticated attackers execute arbitrary commands with root privileges by sending maliciously crafted emails containing injected SQL statements. Physical appliances, virtual deployments, and Cisco Secure Email Cloud instances were affected; Cisco deployed server-side remediations for cloud tenants but on-premises admins must patch themselves. Fixes ship in AsyncOS 16.5.0-780 plus branches 16.0.4-3021 and 15.5.5-0141, and no workarounds exist.

Cyber Security Newsupdated · 7h agofirst · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Key lawmaker suggests action on AI safety legislation will wait until 2027new

House Energy and Commerce Chairman Brett Guthrie declined to commit to a 2026 vote on the FRONTIER Act, pushing AI safety legislation toward 2027.

House Energy and Commerce Chairman Brett Guthrie said he would not pledge a timeline for a committee vote on the bipartisan FRONTIER Act, signaling action likely waits until 2027. The bill, co-sponsored by Jay Obernolte and Lori Trahan, has support from OpenAI, Anthropic, and lawmakers across party lines. At the same event, White House adviser David Sacks endorsed Elon Musk's proposal for cross-industry pre-release model testing, while Hugging Face CEO Clem Delangue argued existing cyberattack liability suffices but urged mandatory disclosure of AI-agent attacks. The debate follows incidents of rogue AI agents launching cyberattacks, including roughly 700 OpenAI agents hacking Hugging Face's platform.

The Record · 42m agoAI policy

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security News · 6h agoExploit / PoC in the wild 4 sourcesCVE-2026-848691