Latest Cybersecurity News, page 20

CCISA AdvisoriesinCVE·Sep 11high

Multiple Vulnerabilities Discovered in AVEVA Pipeline Integrity Monitor

CISA and AVEVA have disclosed four vulnerabilities in AVEVA Pipeline Integrity Monitor that could allow an attacker with read access to PIMBoards project files to decrypt sensitive information, brute-force user passwords through weak cryptographic hashes, or execute cross-site scripting attacks. The flaws affect all versions up to and including build 7.1.9580.8513. AVEVA has released a security update (2025 SP1 P2) and advises migration of affected project files.

12m

DDark readinginCyber Attacks·Sep 11high

Brazilian Government and Education Servers Compromised in Phishing and Gambling Operation

A Chinese-language cybercriminal group has compromised Brazilian government and education servers, using them as part of a reverse-proxy network to host gambling-themed phishing sites. The operation leverages compromised infrastructure to lend credibility to scams and redirect traffic from legitimate domains.

11m

TThe Hacker NewsinSecurity Advisories·Sep 11info

New Webinar Tackles Post-CVE Exposure Assessment Challenge

A new webinar announced by The Hacker News addresses the critical challenge security teams face after a new CVE is disclosed: determining actual exposure quickly. The session focuses on integrating vulnerability scanners, endpoint tools, cloud inventories, SBOMs, and application data to reduce response time.

11m

BBleepingComputerinThreat Intelligence·Sep 11high

US Accuses Six Chinese AI Firms of Industrial-Scale Model Distillation Attacks

U.S. cybersecurity and intelligence agencies have accused six Chinese AI companies of conducting industrial-scale distillation attacks on American frontier AI models, extracting billions of tokens since at least late 2024. The operations threaten proprietary AI intellectual property and could accelerate Chinese AI capabilities, prompting calls for enhanced access controls and monitoring.

12m

TThe Hacker NewsinCyber Attacks·Sep 11high

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

The U.S. Department of Justice announced coordinated actions against Xinbi Guarantee, an illicit online marketplace offering scam services. Authorities seized Telegram channels, confiscated two cryptocurrency wallets, and froze $52.8 million in crypto assets. The Scam Center Strike Force was deployed to Madagascar to disrupt 13 scam compounds operated by Chinese organized crime.

12m

TThe Hacker NewsinVulnerability·Sep 11critical

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

A vulnerability chain in FreeIPA and 389 Directory Server could let an anonymous client create a Kerberos identity of its own choosing and add it to the administrators group, effectively granting full administrative control over the Linux domain. Red Hat has released a security advisory; users are urged to apply patches immediately.

12m

BBleepingComputerinThreat Intelligence·Sep 11medium

Security Researchers Detail AI Frameworks Used for Automated Credential Theft

Recent reporting indicates that threat actors and security researchers are developing and deploying multi-agent AI frameworks designed to automate various stages of cyber attacks, specifically targeting credential theft. These frameworks lower the technical barrier for malicious actors by automating reconnaissance, phishing, and data exfiltration. The reporting originates from BleepingComputer and notes that while the frameworks exist, specific details regarding exact deployment, targeted victims, and exploitation methods remain under review.

11m

TThe Hacker NewsinVulnerability·Sep 11critical

Microsoft's September 2026 Patch Tuesday Addresses Record 974 Flaws, Including Two Actively Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday release sets a new record by patching 974 vulnerabilities across its product portfolio, including two zero-days that are actively exploited. The update covers 723 Windows flaws, 111 in Office/Office 2016, 62 in SQL, and 22 in Developer Tools, with more than 110 rated critical. Organizations are urged to prioritize patching, especially for the exploited zero-days.

11m

BBleepingComputerinZero-Day·Sep 11high

Google patches seventh actively exploited Chrome zero-day of 2026

Google has released security updates for Chrome addressing a zero-day vulnerability actively exploited in the wild. This marks the seventh Chrome zero-day exploited in 2026. The update also patches 230 total vulnerabilities. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by a deadline.

11m

BBleepingComputerinZero-Day·Sep 11high

Microsoft Defender 'ShieldCrash' Zero-Day Exploit Publicly Released, Grants SYSTEM Access

A security researcher known as Nightmare Eclipse has publicly released a zero-day exploit named 'ShieldCrash' targeting Microsoft Defender. The exploit reportedly allows local privilege escalation to SYSTEM, potentially leading to full host compromise. The release came shortly after Microsoft's September 2026 Patch Tuesday updates. No patch or official mitigation has been announced, and Microsoft has not yet responded. Active exploitation has not been confirmed.

11m

BBleepingComputerinPrivacy·Sep 11high

Ohio Man Sentenced to 15 Years for AI-Generated Sextortion

An Ohio man was sentenced to 15 years in prison for orchestrating a sextortion scheme that leveraged AI-generated sexually explicit material to target and intimidate victims. The case highlights the growing misuse of generative AI in cyber-enabled abuse.

11m

TThe Hacker NewsinZero-Day·Sep 11high

Google Patches Actively Exploited Chrome Zero-Day CVE-2026-87491

Google has released security updates patching 230 vulnerabilities in Chrome, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine that is under active exploitation in the wild. The vulnerability enables code execution inside the Chrome sandbox, potentially allowing threat actors to bypass isolation guarantees. No CVSS score was assigned in the initial report, but the flaw is classified as medium severity. Users should update Chrome to the latest version to mitigate the risk.

11m

TThe Hacker NewsinVulnerability·Sep 11critical

cPanel WHM Vulnerability Allows Hosting Account to Escalate to Root

cPanel has released patches for a security flaw affecting cPanel and WHM that permits an authenticated hosting account with mail-related privileges to escalate privileges and execute code as the root user. The vulnerability stems from the EmailTrack component, which can be leveraged to create arbitrary files on the server, enabling full root-level access.

11m

TThe Hacker Newsinmalware·Sep 11high

Sophos Reports Memory-Resident PHP Web Shell Injection on F5 BIG-IP APM Appliances

Sophos researchers have identified malware linked to break-in incidents that injects a PHP web shell into the memory of F5 BIG-IP Access Policy Manager (APM) appliances. The malicious code attaches to the appliance's own PHP scripts in memory when Apache loads them, leaving no persistent file on disk. This technique allows the web shell to evade traditional file-based security scans and forensic analysis. F5 has released security advisories and patches; administrators are urged to apply the latest firmware and monitor for indicators of compromise.

11m

BBleepingComputerinVulnerability·Sep 11medium

Over 36,000 Exposed Plex Media Servers Vulnerable to Unpatched Flaws

Researchers have identified more than 36,000 Plex Media Server instances exposed online that remain unpatched against recently disclosed security vulnerabilities. The exposure of these servers presents potential risk for unauthorized access and network pivoting, though specific vulnerability details and exploitation activity require further verification.

11m

TThe Hacker NewsinVulnerability·Sep 11medium

DeepSeek Harness Flaw Allows AI Agents to Disable Their Own File Sandbox

A vulnerability in DeepSeek Harness, an open-source tool for running AI coding agents on developer machines, was disclosed on September 9, 2026. The flaw permits a sandboxed AI agent to disable its own file sandbox with a single command, potentially granting unauthorized access to the host file system despite existing sandbox protections.

11m

TThe Hacker NewsinVulnerability·Sep 10high

Critical Vulnerability Disclosed in Alby Hub Self-Hosted Lightning Wallet

Alby has disclosed a critical security flaw in Alby Hub, a self-hosted Bitcoin Lightning wallet, that could allow an attacker to take control of a wallet and send its funds. The vulnerability only affects instances where the Alby Hub software has been made reachable from the internet. Users running affected versions are urged to update immediately.

11m

BBleepingComputerinSecurity Advisories·Sep 10high

MFA's Weakest Link: Account Recovery Processes Become New Attack Vector

Research indicates that attackers are increasingly targeting account recovery mechanisms to bypass multi-factor authentication. The investigation highlights how social engineering at service desks can reset passwords and authentication methods, turning account recovery into a primary attack path for unauthorized access.

11m

TThe Hacker NewsinPrivacy·Sep 10high

Infostealer Logs Enable Replay of AI Session Tokens, Bypassing MFA Protections

Recent reporting indicates that information stealer malware such as Lumma Stealer and Vidar are being used to harvest reusable session tokens and API credentials from compromised endpoints. These tokens, once extracted, can be replayed by attackers to gain illicit access to artificial intelligence platform accounts from Google, Anthropic, and other providers. The technique allows bypass of multi-factor authentication protections by reusing valid session identifiers rather than performing credential-based login. The scope of affected accounts and the precise mechanics of the token replay process remain under investigation.

11m

BBleepingComputerinData Breaches·Sep 10high

Veradigm Reports Patient Data Breach Following Third-Party Ransomware Incident

Veradigm, a healthcare technology company, has disclosed a data breach involving patient personal data. The incident stems from a cybersecurity event at one of the company's third-party vendors, which was claimed by a ransomware group. The exact scope of data exposed and the vendor's identity have not been specified in initial reports.

11m

TThe Hacker NewsinThreat Intelligence·Sep 10high

Four Espionage Groups Deploy BlueMoon Exploit Kit Chaining Windows and Chrome Vulnerabilities

Multiple espionage-motivated threat activity clusters have been observed deploying a previously undocumented exploit kit named BlueMoon. The kit chains together multiple vulnerabilities in Microsoft Windows and Google Chrome to gain initial access for in-the-wild espionage operations. Four distinct threat groups were observed using the kit within a single week, marking a significant concentration of coordinated activity. The first attributed use has been linked to APT31, a China-aligned state-sponsored group, with additional clusters also identified. No specific victim counts or data exfiltration details have been disclosed.

11m

BBleepingComputerinNetwork Security·Sep 10high

Skullcandy Dime 3 Earbuds Vulnerable to Bluetooth Pairing Hijacking

The Carnegie Mellon University CERT Coordination Center (CERT/CC) has issued a warning regarding security flaws in the Skullcandy Dime 3 wireless earbuds. Research indicates the devices accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction, potentially enabling unauthorized access and audio hijacking.

11m

BBleepingComputerinData Breaches·Sep 10high

AdaptHealth Confirms 4.1 Million People Exposed in July Cyberattack Attributed to ShinyHunters

AdaptHealth, a major healthcare services provider, has confirmed a data breach affecting approximately 4.1 million individuals. The incident, discovered in July 2026, was attributed to the ShinyHunters threat group. The breach exposed personal and health information, raising concerns about identity theft and medical fraud.

11m

TThe Hacker NewsinCVE·Sep 10critical

CISA Adds Maximum-Severity N-able N-central RCE Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-86218, a pre-authentication remote code execution vulnerability in N-able N-central, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw carries a CVSS score of 10.0 and requires Federal Civilian Executive Branch (FCEB) agencies to apply mitigating fixes by September 11, 2026.

11m