Search: “SecurityWeek”

41 stories

Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.

Acronis released urgent patches for CVE-2026-87886 (CVSS 7.8), insecure file permissions in the Backup plugin for cPanel & WHM and the Backup extension for Plesk that allow attackers to gain elevated privileges. Exploitation has been detected in the wild in limited, targeted attacks against the cPanel & WHM plugin, but not against the Plesk extension. All Linux versions of the plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected; Acronis urges immediate updates and has not shared technical details.

SecurityWeekupdated 11:08 UTC · 1h agofirst 09:52 UTC · 2h agoExploit / PoC in the wild 6 sources CVE-2026-87886

ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

ConnectWise patched critical ScreenConnect flaw CVE-2026-84869 (CVSS 9.9) exploited since August 20 in worm-like attacks; CISA added it to KEV.

ConnectWise released urgent patches for CVE-2026-84869 (CVSS 9.9), a missing authorization and improper privilege management flaw in ScreenConnect allowing file transfer and execution through active remote sessions without host confirmation. Huntress reported in-the-wild exploitation since August 20, with attackers using rogue ScreenConnect clients to push four VBScript files for persistence and worm-like propagation to other ScreenConnect clients. The flaw is fixed in ScreenConnect 26.6.5, with disabling the TransferFiles permission as a temporary mitigation. CISA added the CVE to its KEV catalog, requiring federal agencies to patch within three days under BOD 26-04.

SecurityWeekupdated 11:14 UTC · 1h agofirst Sep 14, 08:25 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2026-848691

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeekSep 11, 14:19 UTC · 4d agoIndustry in the wildCVE-2026-148942

Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak

A 32.8 million-record Conde Nast user database is offered for $15,000 on a Russian cybercrime forum, extending December's WIRED leak with millions of unseen records.

A database of 32,815,767 Conde Nast user records went on sale on 7 September 2026 for $15,000 on a Russian-language forum, containing names, addresses, birth dates and phone numbers but no passwords or payment data. Ransomnews verified a 5,000-record sample as genuine account data collected between September and late October 2025, with roughly 30.5 million non-WIRED records never previously published. The listing matches the December 2025 WIRED leak of 2,366,576 records, claimed by an actor called 'Lovely' who said 40+ million records were stolen via IDOR and broken access controls. Conde Nast has not confirmed the breach; exposed data enables credible targeted phishing and fraud.

Security AffairsSep 7, 19:40 UTC · 8d agoData breach in the wild

The Q1 vulnerability pulse

Cisco TalosApr 16, 18:00 UTC · Apr 16, 2026Vulnerability in the wild1

A puppet made me cry and all I got was this t

Cisco TalosMar 26, 18:00 UTC · Mar 26, 2026Ransomware in the wildCVE-2026-21992

Your year

Cisco TalosDec 4, 19:00 UTC · Dec 4, 2025Ransomware in the wild

Ransomware attacks and how victims respond

Cisco TalosOct 16, 18:00 UTC · Oct 16, 2025Ransomware in the wild

Understanding the challenges of securing an NGO

Cisco TalosMay 1, 18:01 UTC · May 1, 2025Ransomware in the wildCVE-2025-31324

280,000 Impacted by Premier Medical Group Data Breach

New York healthcare provider Premier Medical Group is notifying 282,075 patients that personal and medical information was stolen in a June breach.

New York healthcare provider Premier Medical Group is notifying 282,075 patients whose personal and medical data was stolen in a June breach. Attackers accessed certain files on June 14 after some systems were disrupted, but PMG has not disclosed how the attack occurred or who was responsible. Exposed data includes names, contact information, dates of birth, treatment and diagnostic details, medication information, and health insurance details. PMG reported the incident to HHS, which added it to its public breach portal this week.

SecurityWeek10:47 UTC · 1h agoData breach in the wild

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security Newsupdated 11:15 UTC · 1h agofirst 09:40 UTC · 2h agoExploit / PoC in the wild 4 sources CVE-2026-58704 CVE-2026-28662

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeek08:39 UTC · 3h agoExploit / PoC in the wild 2 sources CVE-2026-54301· 1 read

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

Attackers hijacked HBO Max's verified Reddit account to push 108 malicious ads delivering AMOS and Amatera infostealers via ClickFix prompts.

Threat actors compromised the official u/hbomax Reddit account and ran 108 malicious ads over 48 hours in a campaign tracked as PasteSwitch, directing users to a fake hbomaxx[.]us site. ClickFix prompts tricked macOS users into running curl | zsh payloads (MacSync, AMOS Helper, fake wallets) and Windows users into executing MSHTA/PowerShell delivering Amatera Stealer. AnimateClipper and ZigClipper clipboard hijackers swapped cryptocurrency addresses using a blockchain-hosted C&C active since early 2026. Reddit suspended the ads after notification.

SecurityWeekupdated Sep 15, 11:51 UTC · 1d agofirst Sep 15, 09:09 UTC · 1d agoMalware in the wild 7 sources

Telus Warns Customers of Account Breaches

Telus warns customers that attackers used compromised credentials to access accounts and personal data between February 2025 and June 2026.

Telus, one of Canada's largest telecom providers, is notifying customers that attackers accessed consumer telecom accounts using compromised credentials between February 2025 and June 2026. Exposed data includes names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. The stolen information was used to push customers toward competitors and to make unauthorized service changes; the number of affected accounts is undisclosed. Telus reset credentials, added enhanced monitoring, notified Vancouver police, and offered identity theft protection; the incident may be credential stuffing and follows a ShinyHunters-claimed breach of subsidiary Telus Digital.

SecurityWeekSep 14, 09:56 UTC · 2d agoData breach in the wild

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco Talosupdated Sep 11, 16:36 UTC · 4d agofirst Sep 10, 18:00 UTC · 5d agoIndustry in the wild 4 sources1

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462

CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...

CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.

CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.

Web discovery (articles for new exploits & KEV entries)Sep 8, 06:48 UTC · 8d agoExploit / PoC in the wildCVE-2026-34908

Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.

Threat actors are actively exploiting a zero-day RCE in Adobe Commerce and Magento 2.4.7-2.4.9, injecting PHP code via generated failure reports and executing it through Magento's payment-failure email, with no user interaction required. Exploitation began September 4 and succeeds even against stores running the July and August 2026 patches; the Rust backdoor disguises itself as kworker/u:8:0 or fc-cache and hides C&C communication inside fake NTP replies. Adobe's September 8 Patch Tuesday updates may not include a StyleSmuggler fix.

SecurityWeekSep 7, 11:58 UTC · 9d agoExploit / PoC in the wild

CVE-2026-16232: Checkpoint Quantum Security Management auth bypass ...

Attackers exploit Check Point SmartConsole authentication bypass CVE-2026-16232 to take over Quantum Security Management firewall servers; CISA added it to KEV.

CVE-2026-16232 is an authentication bypass (CWE-287) in the SmartConsole login process of Check Point Quantum Security Management, exploitable via an application token. Disclosed July 22, 2026, it was added to CISA's Known Exploited Vulnerabilities catalog the same day with remediation due July 25. Rapid7, Check Point Research and other vendors confirmed exploitation in the wild, and a public PoC was released. A workaround is available, and federal agencies must comply with BOD 26-04 patching guidance.

Web discovery (articles for new exploits & KEV entries)Sep 5, 08:03 UTC · 11d agoExploit / PoC in the wildCVE-2026-16232

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business NewsAug 19, 04:52 UTC · 28d agoThreat actor in the wild1