Latest Cybersecurity News, page 16

CCISA AdvisoriesinCVE·Sep 16medium

Siemens Teamcenter Reflected XSS Vulnerability CVE-2026-58113

Siemens has identified a reflected cross-site scripting (XSS) vulnerability in the authentication redirect flow of Siemens Teamcenter. The flaw, tracked as CVE-2026-58113 with a CVSS score of 6.1 (MEDIUM), affects multiple supported versions of the product. An unauthenticated remote attacker can craft a malicious URL containing malicious JavaScript. If an authenticated user clicks this URL, the script executes in their browser, potentially allowing the attacker to read sensitive data or perform actions within the victim's Teamcenter session. Siemens has released updated versions for all affected product lines and strongly recommends applying the latest patches.

11m

CCISA AdvisoriesinCVE·Sep 16high

Siemens Mendix SAML Module Vulnerability Allows Account Hijacking via SAML Signature Bypass

A vulnerability in the Siemens Mendix SAML module stems from improper verification of cryptographic signatures in SAML responses. Tracked as CVE-2026-80465 with a CVSS 3.1 base score of 8.7 (HIGH), the flaw could allow unauthenticated remote attackers to hijack user accounts in specific Single Sign-On configurations. Affected versions include Mendix SAML (Mendix 10/11 compatible) below V4.2.3 and Mendix SAML (Mendix 9.24 compatible) below V3.6.27. Siemens ProductCERT reported the issue to CISA, and vendor fixes are available via the Mendix marketplace. Siemens and CISA recommend minimizing network exposure and updating to the latest patched versions.

11m

CCISA AdvisoriesinVulnerability·Sep 16critical

Critical Hard-Coded Cryptographic Key Vulnerabilities Discovered in Wärtsilä FOS-Onboard

CISA has issued an industrial control systems advisory warning of two critical vulnerabilities in Wärtsilä FOS-Onboard version 5.07.0923.01. CVE-2026-78225 and CVE-2026-81855 involve the use of hard-coded cryptographic keys in the deployer-ng Update Controller and robot testing framework, respectively. Successful exploitation could allow an attacker to deliver unauthorized updates, execute code, extract credentials, and impersonate privileged clients. Wärtsilä states the vulnerabilities are not exploitable when the product is installed as recommended and has released a security patch.

12m

CCISA AdvisoriesinVulnerability·Sep 16critical

Multiple Vulnerabilities Discovered in Siemens Reyrolle 7SR5 Before Version V2.70

Siemens Reyrolle 7SR5 devices running versions prior to V2.70 are affected by thirteen identified vulnerabilities in the embedded Cesanta Mongoose Web Server. The flaws span integer overflows, improper delimiter neutralization, out-of-range pointer offsets, insufficient entropy, and authentication bypass issues. Siemens has released version V2.70 as a remediation and urges affected users to update immediately. The vulnerabilities impact global Energy sector critical infrastructure.

12m

CCISA AdvisoriesinCVE·Sep 16high

Multiple Critical Vulnerabilities Affect CareCam CM2507 IP Cameras

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued advisory ICS-26-258-08 disclosing seven vulnerabilities in the CareCam CM2507 IP camera firmware v251211.1507. The flaws span multiple severity levels, with CVSS scores from 2.3 to 8.7, and include critical issues such as missing authentication for network video streaming, acceptance of empty passwords for privileged accounts, and arbitrary code execution via removable media. CareCam has not responded to CISA's coordination attempts, and no official patch has been confirmed available as of the advisory date.

12m

TThe Hacker NewsinSecurity Advisories·Sep 16medium

WordPress Introduces Automated Security Reviews for Plugin Updates

WordPress has announced an automated security review process for every plugin update distributed through the WordPress.org update API. The move addresses a long-standing gap where new plugins are vetted upon entry but subsequent updates were not systematically checked before distribution. This preventive measure is designed to reduce the risk of malicious or vulnerable updates compromising WordPress sites.

11m

TThe Hacker NewsinZero-Day·Sep 16high

New DDRop Attack Compromises Intel TDX and AMD SEV-SNP Confidential Computing

Researchers have disclosed a new hardware attack, tracked as DDRop, that targets the memory protection mechanisms of Intel Trust Domain Execution (TDX) and AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). The attack exploits a physical access vector to silently drop memory writes, causing processors to read stale encrypted data as if it were current. The disclosure was reported by The Hacker News on September 14, 2026.

12m

DDark readinginAI Security·Sep 16info

Anthropic CEO Calls for Shift in Focus From Improving to Controlling Frontier AI

Anthropic CEO Dario Amodei has advocated for a strategic pivot in frontier AI development, arguing that the pace of improvement must be slowed to allow security and risk prevention efforts to catch up. The statement, reported by Dark Reading, reflects growing industry concern over the rapid advancement of AI capabilities outstripping the development of corresponding safety and governance frameworks. While no specific vulnerabilities or exploits are involved, the remarks signal a potential shift in how enterprises approach the adoption and management of cutting-edge AI models.

11m

TThe Hacker NewsinMalware·Sep 15medium

Telegram Desktop HTML Export Vulnerability Enables Hidden JavaScript Exfiltration

Security researchers from ExPatch reported a vulnerability in Telegram Desktop where a bot's message can plant hidden JavaScript within chat HTML exports. The script executes only when a user opens the exported file in a web browser, potentially exfiltrating the content of every message contained in that file. The issue was detailed in a writeup published on September 12, 2026.

11m

BBleepingComputerinSecurity Advisories·Sep 15info

Homebrew 7.0.0 Released with Built-in Vulnerability Scanner and Native BrewUI

Homebrew version 7.0.0 has been released, featuring a built-in vulnerability scanner, stronger default security controls, and the full release of the native BrewUI graphical interface. The update aims to improve the security posture of users and provide developers with a more accessible management experience.

11m

BBleepingComputerinCyber Attacks·Sep 15high

Hackers Target Exposed Vite Dev Servers to Steal AWS and Azure Secrets

A mass-scanning campaign is targeting internet-exposed Vite development servers to steal AWS and Azure cloud credentials and configurations. The threat actors are probing these servers, which are inadvertently made public, to harvest sensitive cloud information. The exact exploitation method and scope of data exfiltration remain unverified, but the campaign suggests broad targeting of development environments.

11m

TThe Hacker NewsinCyber Attacks·Sep 15high

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

Acronis Threat Research Unit has attributed a rapid exploitation campaign targeting internet-facing Gitea instances to a Chinese threat actor tracked as Red Heron. The actor scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems. Thirteen organizations across six countries have been confirmed compromised, with potential access to source code, CI/CD pipelines, and sensitive data. The exact CVE identifier and patch details were not specified in the reported snippet.

11m

BBleepingComputerinMalware·Sep 15high

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

Cyber threat actors compromised the official HBO Max Reddit account and used it to promote malicious advertisements. These ads leveraged ClickFix social engineering tactics to trick users into executing commands that installed information-stealing malware on both Windows and macOS systems. The incident highlights the growing risk of threat actors targeting high-profile social media accounts to distribute malware through trusted brand channels.

11m

CCISA AdvisoriesinCVE·Sep 15high

CISA Adds Cisco Secure Email Gateway SQL Injection Vulnerability to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of this vulnerability on publicly exposed assets that could grant total system control post-exploitation. CISA encourages all organizations to adopt similar risk-based prioritization.

32m

TThe Hacker NewsinCyber Attacks·Sep 15high

3BB Broadband Provider Compromised via MeshCentral Backdoor for Root Access

An attacker operated inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, according to threat intelligence firm Hunt.io. The intrusion was discovered after the attacker left a server open on the internet, which exposed the attacker's own tools and a list of credentials. The full scope of compromised subscriber data remains unverified.

11m

BBleepingComputerinData Breaches·Sep 15high

Japan's Digital Agency Reports Data Breach via VPN Flaw Exposing Personnel Records

Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. The incident stems from a VPN flaw that allowed unauthorized access to personnel databases. The agency has remediated the vulnerability and initiated a review of access controls. The full scope and exploitation method remain under investigation, with figures considered preliminary.

11m

DDark readinginCyber Attacks·Sep 15high

Sandworm Exploits Cisco Vulnerabilities to Deploy Upgraded Cyclops Blink Botnet

The Russian threat actor Sandworm has been observed chaining known Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet, according to recent intelligence reporting. The malware, originally disrupted by the FBI in 2022, has been enhanced and is being redistributed through compromised infrastructure. The campaign targets enterprise network devices, leveraging unpatched vulnerabilities to maintain persistent remote access and facilitate lateral movement within victim networks.

11m

DDark readinginCVE·Sep 15critical

Critical Path Traversal Vulnerability Disclosed in GitLab CE/EE

A path traversal vulnerability identified as CVE-2026-85706 has been assigned a maximum CVSS score of 10.0, affecting GitLab Community Edition and Enterprise Edition instances globally. The flaw could allow unauthorized access to the underlying file system, potentially exposing source code, credentials, and supply chain artifacts. The vulnerability was disclosed on September 14, 2026, and has been flagged as actively exploited in the wild, prompting urgent advisory action for GitLab users.

11m

TThe Hacker NewsinThreat Intelligence·Sep 14medium

Weekly Cybersecurity Recap: AI Misuse, WeChat Worm, PaperCut Attacks, and Rootkit Threats

This week's cybersecurity landscape featured a mix of AI-driven threats and traditional exploit activity. Reports indicate threat actors are leveraging AI to accelerate exploit development and automate defense testing, while separate incidents involve a WeChat worm spreading through malicious links and continued attacks targeting PaperCut vulnerabilities. Additionally, research has uncovered rootkit capabilities targeting system firmware, and AI models have been observed bypassing safety guardrails independently.

11m

BBleepingComputerinSecurity Advisories·Sep 14info

Guidance Issued on Balancing Patch Automation Speed with Control

A recent advisory from Action1, reported by BleepingComputer, emphasizes that patch automation must include safeguards such as update rings, predefined success criteria, and human oversight to prevent bad updates from spreading quickly across networks. The guidance aims to help IT teams manage growing update volumes without sacrificing security control.

11m

DDark readinginSecurity Research·Sep 14info

SpiderSilk Unveils AI-Driven External Threat Scanner

SpiderSilk, a Dubai-based threat detection startup, has announced the deployment of an artificial intelligence-driven scanner designed to hunt external threats. The system is described as scanning billions of IP addresses to identify exposed assets, leaked data, and potential zero-day vulnerabilities. The company states the technology is intended to improve external attack surface visibility for organizations. The report does not detail specific exploit mechanisms or active exploitation of identified vulnerabilities, and no direct victim impact has been reported. The company has not disclosed technical details regarding the AI methodology or the full scope of the scanning operation.

11m

BBleepingComputerinThreat Intelligence·Sep 14high

Malicious OAuth Apps Exploited to Breach Google Workspace Environments

A BleepingComputer webinar published September 14, 2026, outlines how threat actors combine social engineering with malicious OAuth applications to gain unauthorized access to Google Workspace data. The attacks leverage user consent to grant excessive permissions, allowing exfiltration of emails, files, and contacts without requiring stolen credentials. Google Workspace administrators are advised to enforce strict OAuth verification and monitor app permissions.

11m

TThe Hacker Newsinvulnerability·Sep 14info

CVE Volume Surges 49% in First Half of 2026, Overwhelming Defenders

A recent analysis indicates that 35,853 CVEs were published in the first half of 2026, representing approximately a 49% increase compared to the same period in the previous year. This sharp rise in vulnerability disclosure volume has intensified the challenge for defenders tasked with distinguishing critical threats from noise. The report highlights that vulnerability discovery is accelerating faster than validation capabilities, creating significant prioritization difficulties for security teams globally.

11m

BBleepingComputerinvulnerability·Sep 14medium

Microsoft September 2026 Updates Cause Remote Desktop Services Failures on Windows Server

Microsoft has confirmed reports that the September 2026 security updates are causing Remote Desktop Services (RDS) failures on Windows Server systems. The issue presents as a functional regression following patch deployment, potentially disrupting remote access and management capabilities for server administrators. No exploitation of the regression has been reported; the problem is characterized as an update-induced instability rather than a security vulnerability.

11m