Cyber Security
Application Security
Single Browser Extension Hijacks AI Assistants Across Five Browsers
BragJack proof-of-concept uses a single malicious extension and Prompt Forcing to hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity, and Claude.
Cybersecurity
North Korean WaterPlum Stole $10.7M After Infecting 30,000 Devices
North Korean WaterPlum hackers compromised 30,000 devices globally in eight-month campaign, stealing over $10.7 million in cryptocurrency traced to Pyongyang.
Cybersecurity
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
ShinyHunters extortion gang compromised Clop's Tor leak site, claiming to have stolen server data and private keys, threatening to extort the ransomware gang.
Cybersecurity
Viral AI Actress Service Face-Scans Callers, Tracks Emotions
Tilly Norwood's Talking Tilly video call service scans every caller's face for age verification and monitors emotions before shutdown on September 27.
Cybersecurity
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
Application Security
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
Application Security
Thousands of Scam Apps Exploit Google Play Early Access Program
Malicious developers abuse Google Play's Early Access program to push thousands of deceptive Android apps promising money, rewards, and premium content that do not deliver.
Cybersecurity
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window, with researchers suspecting AI assistance.
Cybersecurity
NSA, CISA, FBI Accuse Six Chinese AI Firms of Model Distillation
US intelligence agencies accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of extracting billions of tokens from OpenAI, Anthropic, Google, and SpaceX at industrial ...
Application Security
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...
Application Security
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
Cybersecurity
Surfshark VPN Breach Exposes Internal Testing and Proxy Servers
Surfshark disclosed that hackers accessed internal test servers and proxy infrastructure after a configuration error exposed testing systems to the public internet on September 10.
Application Security
Citrix NetScaler CVE-2026-19490 Exploited Since September 3
Critical authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler has been actively exploited since September 3, enabling unauthenticated attackers to bypass authentication controls.
CVE Vulnerability Alerts
CISA Sets September 12 Deadline for Cisco, Citrix, Fortinet Flaws
CISA added three actively exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog on September 10, requiring federal agencies to patch by ...
Application Security
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token replay attacks published September 9.
Application Security
Google Patches Seventh Chrome Zero-Day of 2026, CVE-2026-87491
Google released Chrome security update on September 9 patching CVE-2026-87491, an out-of-bounds write in V8 engine — the seventh actively exploited Chrome zero-day of 2026.
Application Security
PoisonedRefresh Rootkit Injects PHP Web Shells into F5 BIG-IP Memory
SophosLabs published analysis of PoisonedRefresh, a fileless Linux rootkit that injects PHP web shells directly into F5 BIG-IP APM Apache server memory, leaving no disk ...
Application Security
September Windows Server Updates Break Remote Desktop Services
Microsoft's September security updates cause Remote Desktop Services failures on Windows Server 2019, 2022, and 2025, with some systems requiring hard reset reported September 10.
Application Security
Microsoft Excel KB5002914 Update Breaks Copy and Paste Functions
Microsoft's KB5002914 Office security update breaks copy-and-paste operations and formula dragging in Excel, with affected users removing the update to restore functionality reported September 10.
Application Security
cPanel Critical RCE Enables Full Server Takeover via Mail Account
Critical cPanel vulnerability lets authenticated hosting account holders execute root-level code and take complete control of entire server infrastructure.
Cybersecurity
Capcom ID Breach Exposes 11.77 Million Email Addresses
Cybersecurity
Capcom ID Breach Exposes 11.77 Million Email Addresses
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Arista Patches Exploited VeloCloud Orchestrator Zero-Day
CVE Vulnerability Alerts
Okta Patches Four Access Gateway Flaws Including CVSS 9.1 Bug
CVE Vulnerability Alerts
ZDI Posts Unpatched Linux KSMBD RCE Flaws to Public Mailing Lists
This Week’s Security Spotlight
Application Security
GitLab Patches CVSS 10.0 Unauthenticated RCE Flaw CVE-2026-110264
CVE Vulnerability Alerts
Okta Patches Four Access Gateway Flaws Including CVSS 9.1 Bug
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Viral AI Actress Service Face-Scans Callers, Tracks Emotions
Tilly Norwood's Talking Tilly video call service scans every caller's face for age verification and monitors emotions before shutdown on September 27.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
Thousands of Scam Apps Exploit Google Play Early Access Program
Malicious developers abuse Google Play's Early Access program to push thousands of deceptive Android apps promising money, rewards, and premium content that do not deliver.
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window, with researchers suspecting AI assistance.
NSA, CISA, FBI Accuse Six Chinese AI Firms of Model Distillation
US intelligence agencies accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of extracting billions of tokens from OpenAI, Anthropic, Google, and SpaceX at industrial ...
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
Surfshark VPN Breach Exposes Internal Testing and Proxy Servers
Surfshark disclosed that hackers accessed internal test servers and proxy infrastructure after a configuration error exposed testing systems to the public internet on September 10.
Citrix NetScaler CVE-2026-19490 Exploited Since September 3
Critical authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler has been actively exploited since September 3, enabling unauthenticated attackers to bypass authentication controls.
CISA Sets September 12 Deadline for Cisco, Citrix, Fortinet Flaws
CISA added three actively exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog on September 10, requiring federal agencies to patch by ...
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token replay attacks published September 9.
Google Patches Seventh Chrome Zero-Day of 2026, CVE-2026-87491
Google released Chrome security update on September 9 patching CVE-2026-87491, an out-of-bounds write in V8 engine — the seventh actively exploited Chrome zero-day of 2026.
PoisonedRefresh Rootkit Injects PHP Web Shells into F5 BIG-IP Memory
SophosLabs published analysis of PoisonedRefresh, a fileless Linux rootkit that injects PHP web shells directly into F5 BIG-IP APM Apache server memory, leaving no disk ...
September Windows Server Updates Break Remote Desktop Services
Microsoft's September security updates cause Remote Desktop Services failures on Windows Server 2019, 2022, and 2025, with some systems requiring hard reset reported September 10.
Microsoft Excel KB5002914 Update Breaks Copy and Paste Functions
Microsoft's KB5002914 Office security update breaks copy-and-paste operations and formula dragging in Excel, with affected users removing the update to restore functionality reported September 10.
cPanel Critical RCE Enables Full Server Takeover via Mail Account
Critical cPanel vulnerability lets authenticated hosting account holders execute root-level code and take complete control of entire server infrastructure.
SAP Patches CVSS 10.0 Kernel RCE in Extended Passport Processing
SAP released patches for CVE-2026-44756, a maximum-severity memory corruption flaw enabling unauthenticated remote code execution in SAP kernel systems.
Microsoft Ships Record 974 Security Patches in September Batch
Microsoft's September Patch Tuesday delivered 974 security fixes—the largest single batch ever—driven partly by AI-assisted vulnerability discovery tools.
ShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters extortion gang claims theft of over 200,000 driver records from Florida DMV's DAVID online platform. No official confirmation yet from the state.