Cyber Security
Application Security
WordPress Patches Comment2Shell Anonymous-to-RCE Attack Chain
WordPress patched CVE-2026-93485 (Comment2Shell) in version 7.1.1 on September 17, a flaw allowing anonymous comments to achieve RCE when viewed by administrators.
Application Security
Fake LastPass Authenticator Uses Signed Driver to Disable EDR
Fake LastPass Authenticator installer distributed via GitHub installs Microsoft-signed kernel driver to disable antivirus and EDR before deploying password stealer.
CVE Vulnerability Alerts
Issabel Framework Flaw Enables Unauthenticated OS Command Execution
CVE-2026-89026 in Issabel Framework under active exploitation allows unauthenticated attackers to execute arbitrary OS commands remotely via hard-coded credentials.
Cybersecurity
KREMLIN Banking Malware Hijacks Chrome and Edge for Credential Theft
Previously undocumented Brazilian banking malware KREMLIN installs malicious extensions on Chrome and Edge, bypassing security checks to steal credentials and session tokens.
Cybersecurity
North Korean Jade Sleet Breaches Indian IT Provider
North Korean Jade Sleet group compromised an Indian IT services firm using FLATROOF and ROOFDECK backdoors, targeting developers for supply chain attacks.
Cybersecurity
Malicious npm Packages Bypass Install-Script Detection
npm attackers hide malware in runtime code execution instead of install scripts, evading traditional supply chain defenses targeting the indexed-btree package.
Cybersecurity
Researchers Escape OpenAI Codex Sandbox, Compromise Staff Accounts
Security researchers broke out of OpenAI's Codex sandbox using two methods and chained vulnerabilities to compromise ChatGPT and Codex staff accounts.
Application Security
Single Browser Extension Hijacks AI Assistants Across Five Browsers
BragJack proof-of-concept uses a single malicious extension and Prompt Forcing to hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity, and Claude.
Cybersecurity
North Korean WaterPlum Stole $10.7M After Infecting 30,000 Devices
North Korean WaterPlum hackers compromised 30,000 devices globally in eight-month campaign, stealing over $10.7 million in cryptocurrency traced to Pyongyang.
Cybersecurity
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
ShinyHunters extortion gang compromised Clop's Tor leak site, claiming to have stolen server data and private keys, threatening to extort the ransomware gang.
Cybersecurity
Viral AI Actress Service Face-Scans Callers, Tracks Emotions
Tilly Norwood's Talking Tilly video call service scans every caller's face for age verification and monitors emotions before shutdown on September 27.
Cybersecurity
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
Application Security
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
Application Security
Thousands of Scam Apps Exploit Google Play Early Access Program
Malicious developers abuse Google Play's Early Access program to push thousands of deceptive Android apps promising money, rewards, and premium content that do not deliver.
Cybersecurity
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window, with researchers suspecting AI assistance.
Cybersecurity
NSA, CISA, FBI Accuse Six Chinese AI Firms of Model Distillation
US intelligence agencies accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of extracting billions of tokens from OpenAI, Anthropic, Google, and SpaceX at industrial ...
Application Security
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...
Application Security
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
Cybersecurity
Surfshark VPN Breach Exposes Internal Testing and Proxy Servers
Surfshark disclosed that hackers accessed internal test servers and proxy infrastructure after a configuration error exposed testing systems to the public internet on September 10.
Application Security
Citrix NetScaler CVE-2026-19490 Exploited Since September 3
Critical authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler has been actively exploited since September 3, enabling unauthenticated attackers to bypass authentication controls.
TOP CYBERSECURITY HEADLINES
Application Security
Trojanized Terraform Provider Hides FLATROOF and ROOFDECK Backdoors
Application Security
AnyPwn Heap Overflow in AnyDesk for Linux Gives Root RCE, PoC Public
This Week’s Security Spotlight
Application Security
GhostAction Campaign Hits 500+ GitHub Accounts to Steal API Keys
Application Security
Atlassian CVE-2026-21589 Exploited Within Two Hours of PoC Details
CVE Vulnerability Alerts
Dell Patches Root-Level Flaw CVE-2026-86360 in System Update Tool
CVE Vulnerability Alerts
Android October 2026 Update Patches 25 Flaws, Seven Rated Critical
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
KREMLIN Banking Malware Hijacks Chrome and Edge for Credential Theft
Previously undocumented Brazilian banking malware KREMLIN installs malicious extensions on Chrome and Edge, bypassing security checks to steal credentials and session tokens.
North Korean Jade Sleet Breaches Indian IT Provider
North Korean Jade Sleet group compromised an Indian IT services firm using FLATROOF and ROOFDECK backdoors, targeting developers for supply chain attacks.
Malicious npm Packages Bypass Install-Script Detection
npm attackers hide malware in runtime code execution instead of install scripts, evading traditional supply chain defenses targeting the indexed-btree package.
Researchers Escape OpenAI Codex Sandbox, Compromise Staff Accounts
Security researchers broke out of OpenAI's Codex sandbox using two methods and chained vulnerabilities to compromise ChatGPT and Codex staff accounts.
Single Browser Extension Hijacks AI Assistants Across Five Browsers
BragJack proof-of-concept uses a single malicious extension and Prompt Forcing to hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity, and Claude.
North Korean WaterPlum Stole $10.7M After Infecting 30,000 Devices
North Korean WaterPlum hackers compromised 30,000 devices globally in eight-month campaign, stealing over $10.7 million in cryptocurrency traced to Pyongyang.
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
ShinyHunters extortion gang compromised Clop's Tor leak site, claiming to have stolen server data and private keys, threatening to extort the ransomware gang.
Viral AI Actress Service Face-Scans Callers, Tracks Emotions
Tilly Norwood's Talking Tilly video call service scans every caller's face for age verification and monitors emotions before shutdown on September 27.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
Thousands of Scam Apps Exploit Google Play Early Access Program
Malicious developers abuse Google Play's Early Access program to push thousands of deceptive Android apps promising money, rewards, and premium content that do not deliver.
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window, with researchers suspecting AI assistance.
NSA, CISA, FBI Accuse Six Chinese AI Firms of Model Distillation
US intelligence agencies accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of extracting billions of tokens from OpenAI, Anthropic, Google, and SpaceX at industrial ...
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
Surfshark VPN Breach Exposes Internal Testing and Proxy Servers
Surfshark disclosed that hackers accessed internal test servers and proxy infrastructure after a configuration error exposed testing systems to the public internet on September 10.
Citrix NetScaler CVE-2026-19490 Exploited Since September 3
Critical authentication bypass vulnerability CVE-2026-19490 in Citrix NetScaler has been actively exploited since September 3, enabling unauthenticated attackers to bypass authentication controls.
CISA Sets September 12 Deadline for Cisco, Citrix, Fortinet Flaws
CISA added three actively exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog on September 10, requiring federal agencies to patch by ...
Infostealer Logs Expose Replayable AI Tokens That Bypass MFA
Cybercriminals harvest AI session tokens from infostealer malware logs to hijack Google, Anthropic, and OpenAI accounts, bypassing MFA through token replay attacks published September 9.
Google Patches Seventh Chrome Zero-Day of 2026, CVE-2026-87491
Google released Chrome security update on September 9 patching CVE-2026-87491, an out-of-bounds write in V8 engine — the seventh actively exploited Chrome zero-day of 2026.