ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Security Hub”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 255Ransomware 151Malware 148Industry 144Policy & legal 131Exploit / PoC 105Data breach 95Threat actor 67Phishing & fraud 67AI tools & infra 41AI industry 19AI safety & security 16Research 12Advisory 11
SeverityAllcritical 531high 231medium 209low 229info 80

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Top 10 Best AWS Security Tools in 2026

Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.

The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.

Cyber Security News · 19h agoTools

Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests

Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests.

Reflectiz, a continuous web exposure management vendor, launched a multi-agent penetration testing platform for websites under a new Offensive Hub. Four specialized agents crawl the site like a real user, fingerprint the stack, run attacks, and independently validate findings to remove false positives. The company claims up to 10x more coverage than conventional pentesting by starting from its pre-existing live model of each site. Findings integrate via REST API, CI/CD triggers and Slack, and the Atlas remediation agent guides fixes.

CSO Online · 8d agoTools

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog · 12d agoThreat actor in the wild1

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

SAP patched a CVSS 10.0 unauthenticated RCE flaw (CVE-2026-58231) in Commerce Cloud's Data Hub Adapter, plus three critical flaws in NetWeaver and Manufacturing.

SAP's August 2026 updates fix CVE-2026-58231, a CVSS 10.0 flaw in Commerce Cloud's Data Hub Adapter where insufficient authorization checks and input validation let unauthenticated attackers execute arbitrary code. Onapsis urged customers to patch and redeploy, with an IP Filter Set on the vulnerable endpoint offered as a temporary workaround. The update also fixed CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1), code injection flaws in Manufacturing Integration and Intelligence involving SSRF and SSTI, and CVE-2026-34265 (CVSS 9.8), an out-of-bounds write in NetWeaver ABAP's DIAG protocol parsing that can leak information or crash systems.

The Hacker News · Aug 12, 2026VulnerabilityCVE-2026-58231CVE-2026-44772CVE-2026-34265+1 CVEs

Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes

Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.

Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.

CSO Online · 8d agoTools2

JetBrains security advisory (AV26-891)

Canada's Cyber Centre relayed a JetBrains advisory covering vulnerabilities in GoLand, Hub, IntelliJ IDEA and YouTrack.

Advisory AV26-891, dated September 8, 2026, notes JetBrains vulnerabilities affecting GoLand prior to 2026.2.2.1, Hub prior to 2026.2.52442, IntelliJ IDEA prior to 2026.2.2, and multiple YouTrack versions. Users and administrators are encouraged to review JetBrains' advisory and apply any necessary updates. No specific CVEs or exploitation details are provided in the relayed advisory.

Canadian Centre for Cyber Security · 8d agoAdvisory

Mars Security brings threat intelligence to detection in real time

Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.

Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.

Help Net Security · 8d agoTools

Phishing 3.0: The Fight Moves to Agent Versus Agent

Agentic AI transforms phishing economics, enabling personalized multi-channel attacks with deepfakes like the $25M Arup deepfake heist.

The article argues phishing has evolved through three stages: from malicious content, to intent-based BEC, to AI-powered multi-channel campaigns where attacker agents autonomously conduct reconnaissance and generate tailored lures. The widely reported Arup case saw a deepfake video call impersonating colleagues convince an employee to approve transfers worth roughly $25 million. An Osterman Research study of 128 security leaders found 88% experienced trust-undermining incidents, while Microsoft 365 EOP and Google Workspace were measured missing hundreds of phishing messages per 100 mailboxes monthly. The author argues defenders must adopt their own agents to match attacker speed.

The Hacker News · 28d agoPhishing & fraud2

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center · 14d agoTools1

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.

Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.

The Hacker News · 7d agoVulnerability in the wild1

Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes

Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.

The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.

Cyber Security News · 8d agoTools1

Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.

Microsoft Threat Intelligence observed attackers abusing Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading employees to grant screen control via Quick Assist or RMM tools. Operators deploy malicious MSI packages via silent msiexec, run encrypted JavaScript implants through portable Node.js, and persist via EdgeUpdate Run keys or Startup folder entries. The Node.js backdoor uses HTTPS long-polling C2, captures screenshots, enumerates Active Directory, and moves laterally over WinRM (TCP 5985) to domain controllers and certificate authorities. Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Teams vulnerability is exploited.

GBHackers · 8d agoPhishing & fraud in the wild

Chrome's anti-abuse protections block 7 billion unwanted Android notifications daily

Google Chrome now auto-revokes web push notification permissions, blocking over 7 billion unwanted and abusive notifications daily on Android.

Google announced anti-abuse measures in Chrome that automatically revoke notification permissions for inactive websites and sites Safe Browsing flags for abusive or deceptive notification practices, with users able to restore permissions via Safety Hub. The protections combine Chrome Security, Firebase Cloud Messaging, and Safe Browsing behavioral detection of coordinated abusive networks, and blocked more than 7 billion unwanted notifications per day on Android in Q1. Google also limits abusive domains to 1,000 push messages per minute via FCM and redesigned Android prompts with one-tap unsubscribe.

Help Net Security · Aug 12, 2026Phishing & fraud

Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities

CRM provider Beacon says a compromised AWS access key likely caused a data breach affecting more than 1,500 UK charities.

Beacon, a UK CRM provider serving the charity sector, disclosed that an exposed AWS access key was the likely root cause of a data breach. The incident affected data belonging to more than 1,500 UK charities. The company said the compromised cloud credential enabled the unauthorized access; specific record volumes and data types are not detailed in the report.

Infosecurity Magazine · Aug 13, 2026Data breach in the wild

How MCP Servers Can Expose Enterprise Secrets

MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.

The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.

The Hacker News · Aug 17, 2026AI safety & securityCVE-2025-6514

Cyberattack encrypts systems at Bavarian municipal utility

Hackers encrypted the central IT network of Bavarian utility Stadtwerke Landsberg, disrupting office systems but not electricity or water services.

Stadtwerke Landsberg said hackers encrypted its central IT network overnight on Sept. 1, prompting disconnection from the internet, crisis-team activation and external forensic support. Essential electricity and water services were unaffected, but staff availability was limited and customer data such as names, addresses and bank details may have been accessed. No ransomware group was named and no extortion demand was confirmed. The attack follows a similar late-June encryption incident at a North Rhine-Westphalia municipal utility, and the BSI consistently ranks ransomware among Germany's most serious cyber threats.

The Record · 8d agoRansomware in the wild

North Korean Hackers Deploy New Linux Espionage Toolkit

Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.

Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.

SecurityWeek · 9d agoThreat actor in the wild1

Oracle Corporation security advisory (AV26-929)

CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.

The Canadian Centre for Cyber Security (AV26-929) relays Oracle's September 2026 Critical Security Patch Update, which addresses vulnerabilities in dozens of product families as of September 15, 2026. Affected products include Oracle WebLogic Server, Database Server, E-Business Suite, Fusion Middleware, PeopleSoft Enterprise, Siebel Applications, GraalVM, VirtualBox, Coherence, and numerous banking and communications suites. The bulletin lists no CVE identifiers and encourages administrators to review Oracle's advisory and apply patches.

Canadian Centre for Cyber Security · 9h agoAdvisory 3 sources

Cyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three Airports

Manchester Airports Group breach exposed email addresses, phone numbers and vehicle registrations of about 8.7 million customers across three UK airports.

Manchester Airports Group (MAG) disclosed that an unauthorized third party accessed customer data for roughly 8.7 million people across Manchester, London Stansted and East Midlands airports. Exposed data covers car park, lounge and fast-track bookings and Wi-Fi sign-ups, including email addresses, phone numbers, vehicle registration numbers and postcodes; no bank or payment details were stored and no flight operations were disrupted. MAG learned of the incident on August 25 after attackers breached the system over the weekend, contained it, hired external security experts and suspended its Manage My Booking service as a precaution. The breach lands during peak summer travel and adds pressure on UK infrastructure operators after recent incidents at Jaguar Land Rover, M&S, Harrods, Co-op and a UK power plant.

Security Affairs · 19d agoData breach

Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us

Cyble's Qatar Threat Landscape Report 2025-26 finds Qilin dominated local ransomware while access brokers concentrated on Qatari BFSI and retail access sales.

Cyble's Qatar Threat Landscape Report 2025-26 describes a concentrated threat environment where Qilin accounted for essentially all observed ransomware activity in the country in 2025, including an October campaign, with The Gentleman, Everest, Crypto24, and Payload sharing the space in 2026. Access brokers are selling compromised access, with BFSI and retail accounting for more than half of underground listings, while the education sector sees the most breach and leak incidents. Exploitation activity surged for enterprise remote-access products from Microsoft, Fortinet, Ivanti, and Citrix. The report was published ahead of the CYSEC Qatar summit and cites Qatar's data privacy law and National Cyber Security Agency initiatives.

Cyble · 9d agoThreat actor in the wild

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security Blog · 7d agoTools

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.

Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.

The Hacker News · 8d agoThreat actor in the wild 2 sources2

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog · 14d agoThreat actor in the wild

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog · 8d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

Building AI to accelerate science and improve lives

Google highlights AI-for-science advances: AlphaGenome Atlas mapping 9 billion genetic variants, WeatherNext 3 weather model, and global health AI tools.

Google detailed AI advances across science and health, including AlphaGenome Atlas, which mapped all 9 billion possible single-letter genetic changes in the human genome and was made openly available. WeatherNext 3 delivers 50% more accurate precipitation forecasts a day or more ahead and is already in products. AlphaFold is used by 4 million researchers in 190 countries, TB chest X-ray screening has processed 25,000+ scans across six nations, and the diabetic retinopathy model has supported 1.15 million screenings. Google also released its AI & Economy ATLAS global usage insights.

Google · AI · 1d agoAI industry

TruffleHog AWS Analyze reduces remediation time on leaked AWS credentials

Truffle Security launched TruffleHog AWS Analyze, which maps leaked AWS keys' permissions and role assumptions; research found 88% of 64,024 leaked keys still active.

Truffle Security announced TruffleHog AWS Analyze, a TruffleHog Enterprise feature that enriches leaked AWS credentials with identity, effective permissions, and role-assumption context to help teams assess blast radius and prioritize remediation, extending earlier coverage of SaaS and Google Cloud to AWS. Truffle Security research on 64,024 unique leaked AWS keys found 88% still active, a median exposure of five years, only 14% rotated, 84% with full administrator access, and 1 in 6 being root keys, including 929 keys AWS had flagged via its compromised-key quarantine policy that still authenticated. A scan of 7.6 petabytes of public AI training data on Hugging Face found 3,343 live AWS keys, over 900 of which could list S3 buckets holding at least 51.7 TB of private data.

Help Net Security · 23d agoTools

Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.

Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.

GBHackers · 7d agoAdvisory in the wildCVE-2026-85880CVE-2026-85877CVE-2026-85875+27 CVEs1

Webinar: The forgotten Google Workspace access that can lead to a breach

BleepingComputer and Material Security will host a September 23, 2026 webinar on breaches caused by forgotten third-party Google Workspace integrations.

BleepingComputer announced a live webinar on September 23, 2026, titled 'Breach autopsy: How fast-growing companies are breached through Google Workspace' in partnership with Material Security. Speakers include Rajan Kapoor, VP of Security at Material Security, and Rick Fitzgerald, President of Fireside Consulting LLC. The session will examine real documented Google Workspace breaches involving overly permissive third-party integrations, social engineering entry paths, first-hours breach response decisions, and high-value security controls for lean security teams.

BleepingComputer · 8d agoIndustry

Android Car Malware Spreads Through Built

Kaspersky found MoYu Group malware infecting DoFun Android car head units via firmware updaters, enabling ad fraud and proxy botnet operations.

Kaspersky discovered in June 2026 the first documented malware specifically infecting Android-based car head units, spread through the built-in updater (TWCore) of DoFun head unit firmware via a dropper dubbed JarService. The multi-stage implant supports nine commands enabling unwanted ads, ad fraud, and additional module downloads, and installs the zhima reverse proxy module. The campaign is attributed with high confidence to the MoYu Group behind the BADBOX ad fraud and residential proxy scheme; the distribution issue was fixed after responsible disclosure.

The Hacker News · 22d agoMalware in the wild

Attackers use passkey-themed scams to hijack Microsoft 365 accounts

Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.

Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.

CSO Onlineupdated · 14h agofirst · 5d agoThreat actor in the wild 9 sources1

How much of F-Droid is LLM generated?

A FOSS maintainer manually graded 102 F-Droid apps from the September 12, 2026 update batch, finding many show signs of LLM-generated code.

A student and FOSS app maintainer reviewed 102 apps pushed to F-Droid on September 12, 2026, assigning each a three-tier rating for likelihood of LLM-authored code (mostly AI >50%, hard to say/mostly human, no signs of AI). The heuristic relies on commit aesthetics, README and branding style, and the presence of agentic infrastructure like Claude Code or Codex, which automatically places an app in the 'mostly AI' tier. Example ratings include Amber (Nostr event signer) as mostly AI, and Aria for Misskey as showing no AI signs. The author stresses reliable detection of LLM-generated code from text alone is impossible, so ratings are approximate.

Hacker News · AI · 1d agoAI researchHN 46↑ · 23 comments

31st August – Threat Intelligence Report

Manchester Airports Group disclosed a cyberattack exposing contact details of about 8.7 million customers across Manchester, Stansted, and East Midlands airports.

Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, disclosed a cyberattack that exposed data belonging to roughly 8.7 million customers. Check Point's weekly threat intelligence bulletin reports the compromised information includes contact details. The disclosure appeared in Check Point's 31 August Threat Intelligence Report covering the week's top attacks and breaches.

Check Point Research · 16d agoData breach in the wild

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.

Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.

Microsoft Security Blog · 7d agoThreat actor in the wild2