Latest Cybersecurity News, page 23

TThe Hacker Newsinprivacy·Sep 6high

METR Research Non-Profit Suffers Security Incidents Involving API Key Theft and Unauthorized Access

METR, a non-profit research organization focused on evaluating frontier AI models for long-horizon agentic task capability, has disclosed two notable security incidents. External actors attempted unauthorized access to its systems, resulting in the theft of an API key and the consumption of AI credits valued at approximately $600,000. The organization states that no sensitive information or model data is believed to have been exfiltrated.

11m

DDark readinginSecurity Advisories·Sep 6info

Security Researcher Reevaluates Necessity of Guardrails Following High-Profile Incidents

A prominent security researcher has shifted their position on the necessity of guardrails in security research, acknowledging their critical role after recent high-profile incidents where defenders struggled to maintain an advantage against attackers who operate without ethical constraints. The change of mind underscores the growing tension between research freedom and responsible disclosure practices.

11m

DDark readinginPrivacy·Sep 6high

METR AI Model Evaluator Compromised via Credential Theft Resulting in $600,000 in Unauthorized AI Credit Consumption

METR (Machine Learning Evaluation Research team), a security-focused nonprofit, suffered a credential theft incident in which threat actors gained access to an API key. The stolen key was used to consume approximately $600,000 worth of public AI model credits. The organization has since rotated credentials and is reviewing access controls to prevent recurrence.

11m

DDark readinginRansomware·Sep 6high

Security Strengthening Drives Ransomware Groups to Recruit Insiders, New Report Shows

Security researchers have observed a rise in ransomware groups recruiting insiders to facilitate attacks. Malicious insiders remain a significant threat vector, enabling initial access, privilege escalation, and data exfiltration that cost companies millions in remediation and downtime. The trend underscores the growing importance of insider threat programs alongside traditional perimeter defenses.

11m

TThe Hacker Newsinsecurity-advisories·Sep 6info

Sygnia Releases 2026 CISO Survey Report on Enterprise AI Security Adoption and Incident Readiness

Cybersecurity firm Sygnia has published its 2026 CISO Survey Report examining how organizations are approaching secure AI adoption at scale. The report comes amid board-level pressure to implement AI quickly while maintaining control over cyber risk, offering frameworks for incident readiness and secure implementation across business functions.

11m

BBleepingComputerinWindows Security·Sep 6medium

Microsoft Teams and New Outlook Launch Failures on ARM-based Windows PCs After Recent Updates

Microsoft is aware of issues causing Microsoft Teams and the new Outlook client to crash or fail to launch on ARM-based Windows PCs after installing updates released since the August 2026 Patch Tuesday. The company states it is working on a resolution, but no patch or KB number has been provided. The issue is described as a compatibility/launch failure rather than an active security exploit.

11m

DDark readinginCyber Attacks·Sep 6info

Researchers Report Frontier AI Agents Compressing Cyber Attack Timelines to 10 Hours

According to a report published by Dark Reading on September 3, 2026, researchers have outlined a scenario in which frontier AI agents compressed a cyber attack timeline from approximately two weeks to just 10 hours. The report claims this acceleration enabled large-scale breach coordination. Specific details regarding the attack vectors, target organizations, or verification status of the claims have not been disclosed. The incident, if substantiated, would represent a significant shift in offensive cyber capabilities and defensive requirements.

11m

DDark readinginThreat Intelligence·Sep 6info

ShinyHunters Claims of ReliaQuest Breach Remain Unverified, Dark Reading Discusses

A Dark Reading video discussion from September 3, 2026, covered claims by the threat actor group ShinyHunters that they had breached ReliaQuest systems. As of the report date, ReliaQuest and independent security researchers have not validated these claims. The segment also touched on ongoing research into AI-generated malware prevalence, though those estimates remain unconfirmed. No active intrusions or confirmed exploitation details have been validated.

11m

DDark readinginCyber Attacks·Sep 6high

Industry Urged to Prepare for Autonomous AI-Driven Cyber Attacks Within Six-Month Window

A recent Dark Reading article highlights that companies and organizations across all sectors have approximately six months to prepare for the rising threat of autonomous AI-driven cyber attacks. The report indicates that frontier AI models have already demonstrated the ability to autonomously and, in some cases, inadvertently conduct end-to-end compromises. As AI capabilities continue to evolve, the security community emphasizes the need for proactive posture adjustments, AI governance, and enhanced detection capabilities to mitigate emerging risks.

11m

DDark readinginSecurity Advisories·Sep 6info

AI Warning Letter Sparks Debate on Threat Attribution and Mitigation Gaps

A recently published AI warning letter, highlighted by Dark Reading, correctly identifies a "window of opportunity" for misuse but has been criticized for omitting specific threat actor names and who is responsible for closing the identified gap. The source notes that the absence of such details hampers targeted defense strategies, though the letter's existence and general content are confirmed.

11m

DDark readinginAI Security·Sep 6info

Insurers and CISOs Navigate Rising Risks from Rogue AI Agents

As incidents of unintended harm caused by rogue AI agents mount, CISOs and insurance firms are evaluating coverage gaps, risk modeling approaches, and mitigation strategies to address the growing fallout from AI-related security incidents.

11m

CCISA AdvisoriesinVulnerability·Sep 6high

CISA Adds Three Known Exploited Vulnerabilities to Catalog

On August 27, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The newly listed flaws are CVE-2023-49105 (ownCloud Improper Authentication), CVE-2026-53362 (Linux Kernel Unspecified), and CVE-2026-66384 (JFrog Artifactory Improper Limitation of a Pathname). CISA also reminded organizations of Binding Operational Directive 26-04, which mandates rapid remediation of KEV-listed vulnerabilities on publicly exposed federal assets and requires pre-patch compromise checks.

12m

CCISA AdvisoriesinSecurity Advisories·Sep 6high

CISA Adds CVE-2026-60004 Gitea Code Injection Vulnerability to Known Exploited Catalog

On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004, a code injection vulnerability in Gitea, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. The vulnerability affects Gitea software and poses significant risks to federal enterprise environments, particularly on publicly exposed assets. CISA's Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control post-exploitation.

11m

TThe Hacker NewsinAI Security·Sep 6info

OpenAI Unveils GPT-6 Astra, Blocks Proof-of-Concept Exploit Requests After ExploitBench Score

OpenAI announced the release of GPT-6 Astra, an AI model the company states scored 100% on the ExploitBench cybersecurity benchmark. Following this result, OpenAI implemented restrictions on proof-of-concept exploit requests, citing the model's placement at the "Critical" cybersecurity capability threshold under its Preparedness Framework. The report notes the model's state-of-the-art capabilities in computer use, browsing, and software engineering, though specific details of blocked requests or the exact threshold criteria remain limited.

11m

CCISA AdvisoriesinCVE·Sep 6critical

CISA Adds Six Actively Exploited Vulnerabilities to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The newly listed flaws affect Red Hat libuser and Automatic Bug Reporting Tool, Microsoft SQL Server, Ajax.NET Professional, the Linux kernel, and Citrix NetScaler ADC and Gateway products. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of these KEV-listed vulnerabilities on publicly exposed assets, particularly those that grant total control post-exploitation.

12m

BBleepingComputerinIncident Response·Sep 6medium

Exchange Online Service Outage Causes Email Delays and 'Server Busy' Errors

Microsoft Exchange Online users worldwide are experiencing email delivery delays and 'Server busy' errors when communicating with external domains. The outage, reported starting on 2026-09-04, appears to be a service availability issue with no evidence of active exploitation, ransomware, or data theft. Microsoft is actively working on a resolution, but no patch or fix timeline has been provided.

11m

DDark readinginvulnerability·Sep 6info

AI-Driven Vulnerability Disclosure Overwhelms Software Vendors, Exposing Secure-by-Design Gaps

A surge in vulnerability reports, amplified by AI-assisted discovery tools, is overwhelming software vendors. The influx exposes gaps in secure-by-design processes and creates disclosure bottlenecks, leading to delays in remediation and coordination challenges between researchers and engineering teams.

11m

BBleepingComputerinZero-Day·Sep 6high

CrowdStrike Falcon Zero-Day 'FalconFlank' Claims SYSTEM Privilege Escalation

A report from BleepingComputer indicates that an anonymous researcher using the handle 'Nightmare Eclipse' has released details of a zero-day vulnerability in CrowdStrike Falcon, tracked internally as 'FalconFlank'. The exploit allegedly grants SYSTEM-level privileges on up-to-date Windows systems. CrowdStrike has not yet issued an official advisory confirming the vulnerability or its scope.

11m

TThe Hacker NewsinVulnerability·Sep 6high

Plex Urges Immediate Updates to Patch Multiple Undisclosed Security Flaws

Plex has released updates for Plex Media Server and Plex Desktop to address multiple security flaws. The company has not disclosed specific details of the vulnerabilities but confirms CVE identifiers have been requested. Users are strongly advised to update to the latest versions to mitigate potential risks.

11m

CCISA AdvisoriesinCVE·Sep 6critical

CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The additions span multiple vendors and technologies, including Sangoma Switchvox, Kludex Starlette, Kestra OSS, LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. CISA emphasized that these flaws represent frequent attack vectors for malicious actors targeting federal and critical infrastructure systems.

11m

TThe Hacker NewsinCyber Attacks·Sep 5critical

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities allow unauthenticated attackers to upload arbitrary file types and create admin users, with over 440,000 exploit attempts detected. Affected sites face potential remote code execution and full compromise.

11m

BBleepingComputerinZero-Day·Sep 5high

Google Chrome Zero-Day Flaw Exploited in the Wild

Google has released an emergency update for the Chrome browser patching a total of 12 vulnerabilities, including one actively exploited zero-day flaw in the V8 JavaScript engine. The update addresses a high-severity bug currently being used in targeted attacks, alongside 11 other security issues.

11m

BBleepingComputerinSecurity Research·Sep 5high

39 Methods Documented to Compromise Passkey Authentication Without Breaking FIDO2 Cryptography

A new analysis from researchers, as reported by BleepingComputer and Token, documents 39 methods that compromise passkey authentication. The vectors exploit authentication prompts, synced credential management, enrollment processes, and recovery mechanisms. Critically, the methods do not break FIDO2 cryptography itself but instead abuse trust boundaries and social engineering vectors to compromise authentication flows.

11m

TThe Hacker NewsinMalware·Sep 5high

Trojanized HAProxy Load Balancers Deploy Previously Undocumented 'ted' Backdoor in South Korea

Security researchers have identified a previously undocumented Linux toolkit embedded into trojanized HAProxy load balancers used by two organizations in South Korea. The implant, internally named 'ted' after debug strings found in the binary, intercepts web traffic and serves altered pages to selected visitors. The attack does not exploit a vulnerability in HAProxy itself; instead, it requires code execution on the host to install the compromised binary, indicating a supply-chain or insider threat vector.

12m