Latest Cybersecurity News, page 21

TThe Hacker NewsinCVE·Sep 10critical

SAP Patches Critical Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP has released security updates addressing CVE-2026-44756, a kernel-adjacent memory corruption vulnerability in the Extended Passport (EPP) Processing component. With a CVSS score of 10.0, the flaw could allow unauthenticated remote attackers to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability. No public exploitation has been confirmed at the time of disclosure.

11m

BBleepingComputerinCVE·Sep 10critical

Cisco Confirms CVE-2026-20079 Actively Exploited in the Wild

Cisco has confirmed that a maximum-severity authentication bypass vulnerability (CVE-2026-20079) in Secure Firewall Management Center (FMC) software is being actively exploited in attacks. The flaw allows unauthenticated remote attackers to bypass authentication controls and gain administrative access to the FMC web interface. Cisco has released security updates; users are urged to upgrade to patched versions immediately.

11m

TThe Hacker NewsinMalware·Sep 10high

Researchers Demonstrate Zero-Click WeChat Worm Spreading via Incoming Calls

Researchers at the security firm Calif have demonstrated a zero-click worm that takes over WeChat accounts on iPhone and Android through incoming calls. The attack requires the caller to already be in the target's WeChat contact list. The target does not need to answer or interact with the phone. The flaw was reported to Tencent in July 2026. The demonstration involved three test phones, and Tencent's remediation status remains unconfirmed.

11m

TThe Hacker NewsinCyber Attacks·Sep 10high

Liquid Network Sidechain Hackers Return 3,400 Bitcoin, ~598.5 BTC Still Missing

On Sunday, September 6, 2026, unknown threat actors exploited a vulnerability in the Liquid Network Bitcoin sidechain, stealing approximately 4,000 bitcoin. By Monday, September 7, 2026, the actors returned 3,400 bitcoin via blockchain analysis. Approximately 598.5 bitcoin, valued at around $47 million at current market rates, has not been returned. The Liquid Network remains paused, preventing holders from redeeming L-BTC tokens for bitcoin. The incident is attributed to unknown threat actors; the root cause and exploitation method remain unconfirmed.

11m

BBleepingComputerinWindows Security·Sep 10medium

Microsoft August 2026 Update Triggers 0xc0000409 Errors on Windows Server 2016

Microsoft has confirmed that the August 2026 security update for Windows Server 2016 may trigger error code 0xc0000409 on systems where the Compatibility Appraiser diagnostic service is enabled. The issue appears to stem from a compatibility conflict introduced by the update, potentially preventing successful installation or causing service disruptions. Microsoft is currently investigating the issue and has not yet published an official fix.

11m

TThe Hacker NewsinThreat Actors·Sep 10high

Slim Spider Threat Actor Targets Brazilian Financial Institutions to Steal Crypto Custody Secrets

CrowdStrike attributes a series of financially motivated attacks against Brazilian financial institutions to a previously undocumented threat actor tracked as Slim Spider. Active since at least March 2026, the group leverages deep operational knowledge of Brazil's instant payment infrastructure to steal crypto custody secrets and sensitive financial data.

11m

BBleepingComputerinData Breaches·Sep 10medium

ShinyHunters Claim Breach of Florida DMV "DAVID" Database

The ShinyHunters extortion group has publicly claimed responsibility for breaching the Florida Department of Motor Vehicles' "DAVID" online platform, asserting the theft of more than 200,000 driver records. As of reporting, the Florida DMV and independent sources have not confirmed the intrusion or verified the volume and sensitivity of the alleged data.

11m

BBleepingComputerinSecurity Advisories·Sep 10critical

Microsoft September 2026 Patch Tuesday: Record 966 Flaws Fixed, Two Zero-Days Patched

Microsoft released security updates on September 8, 2026, as part of the September 2026 Patch Tuesday, fixing a record-breaking 966 vulnerabilities. Among the patches are two zero-day vulnerabilities confirmed to be actively exploited in the wild. The updates cover Windows, Microsoft Office, and various enterprise platforms. Microsoft urges organizations to prioritize patching, particularly for the actively exploited zero-days, via Windows Update, WSUS, or Intune.

11m

CCISA AdvisoriesinThreat Intelligence·Sep 9high

U.S. Intelligence Agencies Warn of Industrial-Scale AI Model Distillation Campaigns by China-Based Firms

A joint cybersecurity advisory from the NSA, CISA, and FBI reveals that China-based AI companies, including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, have conducted large-scale knowledge distillation campaigns against U.S. frontier AI models since late 2024. The agencies report that these actors extracted billions of tokens from models including Claude, GPT, Gemini, and Grok via native APIs, cloud providers, third-party aggregators, and gray-market proxies known as "transfer stations" to bypass geographic restrictions and terms of use. The advisory states the distillation is not a supplement but the core of these companies' AI development strategies, enabling shorter timelines and reduced costs. The agencies warn the activities likely occur with Chinese government awareness and violate U.S. AI companies' terms of use.

12m

BBleepingComputerinSecurity Advisories·Sep 9medium

Microsoft releases Windows 10 KB5122878 extended security update

Microsoft has released the KB5122878 extended security update for Windows 10, bundling this month's Patch Tuesday security fixes along with cumulative bug fixes. The update is targeted at Windows 10 systems still within extended support.

11m

BBleepingComputerinMalware·Sep 9high

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Security researchers have identified a Linux rootkit targeting F5 BIG-IP APM devices. The malware intercepts PHP file loading to inject a fileless web shell directly into memory, avoiding disk writes and traditional security controls. The origin and active exploitation status of the rootkit remain unconfirmed.

11m

BBleepingComputerinSecurity Advisories·Sep 9info

EU Cyber Resilience Act Vulnerability Reporting Requirements Take Effect September 11

The European Union's Cyber Resilience Act introduces mandatory vulnerability reporting obligations for software vendors, requiring disclosure of actively exploited flaws within 24 hours of discovery. The requirements, effective September 11, 2026, place emphasis on maintaining accurate software inventory and vulnerability tracking capabilities to ensure compliance with the new regulatory framework.

11m

BBleepingComputerinCyber Attacks·Sep 9high

DoppelCart Fraud Network Exploits 119,000 Fake Shops to Steal Credit Card Data

Security researchers have identified a large-scale fraud campaign, designated DoppelCart, utilizing more than 119,000 domains to host counterfeit e-commerce sites. The operation targets shoppers globally by mimicking legitimate retailers, capturing credit card details and personally identifiable information during checkout, and exfiltrating the data to actor-controlled servers.

11m

KKrebs on SecurityinSecurity Advisories·Sep 9high

Microsoft Issues Record-Breaking Security Update Patching 974 Vulnerabilities

On September 8, 2026, Microsoft Corp. released updates to address at least 974 security vulnerabilities across Windows and other Microsoft products, marking the company's largest single patch batch to date. The company attributed part of the discovery process to artificial intelligence, while security experts cautioned that the sheer volume poses prioritization and deployment challenges for organizations.

11m

DDark readinginPhishing·Sep 9high

Attackers Use Multi-Hop Google Redirects for Phishing Campaign

Threat actors have been observed conducting a phishing campaign that leverages multi-hop redirects through Google services to bypass security filters. The attack chain ultimately harvests credentials or installs ScreenConnect remote access software on victim systems. The use of Google infrastructure as a redirect layer helps obfuscate the final malicious destination, making the campaign harder to detect with traditional email security tools.

11m

DDark readinginCVE·Sep 9high

Microsoft Patch Tuesday 2026: Record 974 CVEs Released, Including Actively Exploited Flaws

Microsoft's September 2026 Patch Tuesday update cycle addressed a record 974 CVEs across its product portfolio. Of these, two are confirmed to be actively exploited in the wild, and a further 58 are assessed as having a higher likelihood of exploitation. The update affects Windows, Office, Exchange, Azure, and other Microsoft platforms globally.

11m

CCISA AdvisoriesinVulnerability·Sep 9high

Hard-Coded Credential Vulnerability in CareCam Pro IP Cameras (CVE-2026-85083)

CISA has issued an advisory (ICSA-26-251-01) detailing a hard-coded credential vulnerability in CareCam Pro IP Cameras using ANJIA AJL33PC0801 firmware. The flaw, tracked as CVE-2026-85083, involves the use of hard-coded credentials for bootloader authentication. An attacker with physical access to the device may exploit this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration, potentially resulting in complete device compromise. The advisory notes no known public exploitation and that the vulnerability is not exploitable remotely. CVSS scores are 6.8 (MEDIUM) under v3.1 and 7.0 (HIGH) under v4.0. CareCam has not responded to CISA's coordination attempts, and no patch is currently available.

11m

CCISA AdvisoriesinCVE·Sep 9high

CISA Adds Four Known Exploited Vulnerabilities to Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The additions include CVE-2026-75650 affecting Adobe Commerce and Magento, CVE-2026-81963 and CVE-2026-85880 affecting Microsoft Windows, and CVE-2026-86218 affecting N-able N-central. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of these KEV Catalog vulnerabilities on publicly exposed assets.

12m

TThe Hacker NewsinMalware·Sep 8high

BengalSEO Campaign Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

Researchers from the DFIR Report have detailed a long-running search engine optimization (SEO) poisoning campaign codenamed BengalSEO. The operation manipulates Bing search results to elevate malicious sites, facilitating the delivery of MayaBot malware and tech support scams. The campaign, attributed to two IT service providers based in Rajasthan, India, has been active since at least 2015.

11m

TThe Hacker NewsinPrivacy·Sep 8high

Grindr Agrees to £26 Million Settlement Over U.K. HIV Data Sharing Allegations

Grindr has agreed to pay £26 million ($35.1 million) to settle a U.K. lawsuit alleging the company shared users' personal information, including HIV status, with third parties for commercial purposes such as advertising. The lawsuit, filed in April 2024, accused Grindr of violating U.K. privacy laws. The settlement was announced in September 2026.

11m

BBleepingComputerinData Breaches·Sep 8high

220 Million Traveler Records Exposed in Vietnam-Linked APIS Database Leak

A cloud-based Advance Passenger Information System (APIS) database linked to Vietnam was found exposed on the internet, containing approximately 220 million records of passenger and crew data. The leak included sensitive personally identifiable information such as names, passport numbers, dates of birth, nationalities, and flight details dating from 2017 to 2026. Researchers discovered the exposed system through a cloud-based path using default credentials. The database has since been secured or taken offline following disclosure, though the exact owner and origin of the data remain unconfirmed.

11m

TThe Hacker Newsinthreat_intelligence·Sep 8high

Weekly Cybersecurity Recap: Chrome Zero-Day, Router Hijacking, and Supply Chain Attack

During the week of September 7, 2026, security researchers and threat intelligence sources documented several significant incidents including a Chrome zero-day vulnerability being actively exploited, router hijacking campaigns, a software supply chain attack delivering credential-stealing code, and exploitation of a network management protocol. Users are advised to apply available updates and exercise caution with software sources.

11m

TThe Hacker NewsinVulnerability·Sep 8high

Telerik UI Padding-Oracle Chain Chained to Unauthenticated RCE

Security researcher firm TantoSec has published a proof-of-concept exploit chain that transforms an AES-CBC padding oracle vulnerability in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. The chain is contingent on a non-default application configuration, and Progress Software has released a patch addressing the vulnerability in July 2026. No confirmed reports of wild exploitation have been observed as of the publication date.

11m

BBleepingComputerinData Breaches·Sep 8high

Mathspace Data Breach Exposes Information of Over 1 Million Users

Online maths learning platform Mathspace disclosed a data breach affecting more than 1 million students, staff, and parents. Attackers gained unauthorized access to the organization's Metabase internal reporting system and exfiltrated data. The full scope of categories of information accessed and the initial intrusion method remain under investigation.

11m