Attackers Use BYOD Weaknesses to Access M365 via Graph API
September 11, 2026
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure
Endpoint Security
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token replay attacks published September 9.
Google Patches Seventh Chrome Zero-Day of 2026, CVE-2026-87491
Google released Chrome security update on September 9 patching CVE-2026-87491, an out-of-bounds write in V8 engine — the seventh actively exploited Chrome zero-day of 2026.
PoisonedRefresh Rootkit Injects PHP Web Shells into F5 BIG-IP Memory
SophosLabs published analysis of PoisonedRefresh, a fileless Linux rootkit that injects PHP web shells directly into F5 BIG-IP APM Apache server memory, leaving no disk ...
OpenAI Artifactory Flaw Enabled Cross-Account Data Theft
Security researchers disclosed a vulnerability in OpenAI's Artifactory enabling unauthorized cross-account artifact access and covert data exfiltration.
Boston Scientific Cyberattack Damages Q3 and Full-Year Earnings
Boston Scientific disclosed that an August cyberattack will materially impact Q3 and full-year sales and earnings. Recovery is taking longer than expected.
PEEP Toolkit Turns Chrome and Edge Into Post-Exploitation Backdoors
Researchers disclosed PEEP, a toolkit that hijacks Chrome and Edge browsers as backdoors by injecting malicious extensions that execute host commands.
Magento StyleSmuggler Zero-Day Deploys Linux Backdoors on Stores
Zero-day StyleSmuggler flaw enables code execution on all Magento and Adobe Commerce versions. Attackers deploy Linux backdoors on e-commerce sites.
Attackers Chain MikroTik Flaws to Hijack Internet-Exposed SSH
Hackers are exploiting two chained MikroTik RouterOS vulnerabilities to take full control of routers with SSH services exposed to the public internet.
Nightmare Eclipse Drops Zero-Days for CrowdStrike, Nvidia, Avast
Security researcher Nightmare Eclipse publicly released proof-of-concept zero-day exploits for CrowdStrike, Nvidia, and Avast that escalate to System privileges.
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
September 11, 2026
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token
Google Patches Seventh Chrome Zero-Day of 2026, CVE-2026-87491
September 11, 2026
Google released Chrome security update on September 9 patching CVE-2026-87491, an out-of-bounds write in V8 engine — the seventh actively
PoisonedRefresh Rootkit Injects PHP Web Shells into F5 BIG-IP Memory
September 11, 2026
SophosLabs published analysis of PoisonedRefresh, a fileless Linux rootkit that injects PHP web shells directly into F5 BIG-IP APM Apache
OpenAI Artifactory Flaw Enabled Cross-Account Data Theft
September 9, 2026
Security researchers disclosed a vulnerability in OpenAI’s Artifactory enabling unauthorized cross-account artifact access and covert data exfiltration.
Boston Scientific Cyberattack Damages Q3 and Full-Year Earnings
September 9, 2026
Boston Scientific disclosed that an August cyberattack will materially impact Q3 and full-year sales and earnings. Recovery is taking longer
PEEP Toolkit Turns Chrome and Edge Into Post-Exploitation Backdoors
September 8, 2026
Researchers disclosed PEEP, a toolkit that hijacks Chrome and Edge browsers as backdoors by injecting malicious extensions that execute host
Magento StyleSmuggler Zero-Day Deploys Linux Backdoors on Stores
September 8, 2026
Zero-day StyleSmuggler flaw enables code execution on all Magento and Adobe Commerce versions. Attackers deploy Linux backdoors on e-commerce sites.
Attackers Chain MikroTik Flaws to Hijack Internet-Exposed SSH
September 8, 2026
Hackers are exploiting two chained MikroTik RouterOS vulnerabilities to take full control of routers with SSH services exposed to the
Nightmare Eclipse Drops Zero-Days for CrowdStrike, Nvidia, Avast
September 8, 2026
Security researcher Nightmare Eclipse publicly released proof-of-concept zero-day exploits for CrowdStrike, Nvidia, and Avast that escalate to System privileges.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.