Latest Cybersecurity News, page 25

TThe Hacker NewsinMalware·Sep 5high

Shai-Hulud Infostealer Worm Expands Scanning to 469 Credential Locations Across Developer Environments

GitGuardian researchers have identified a new variant of the Shai-Hulud infostealer worm that has expanded its credential scanning capability from 189 to 469 locations. The variant targets developer environments, CI/CD tooling, cloud configurations, and AI tool configurations, significantly broadening the attack surface for credential theft. The findings were published in early August 2026 and covered by The Hacker News on September 3, 2026.

12m

TThe Hacker NewsinCyber Attacks·Sep 5high

US Leads Global Targets in RMM Phishing Campaign Spanning 46 Countries

Researchers from ANY.RUN have identified a Remote Monitoring and Management (RMM) phishing campaign operating across 46 countries. While the campaign initially appeared Canada-focused due to the use of Canada Revenue Agency (CRA) tax forms as lures, analysis revealed the United States as the primary target, accounting for roughly 45% of the approximately 601 observed cases. The operation leverages RMM tools as a delivery mechanism for phishing emails designed to mimic legitimate tax or financial notifications.

11m

CCISA AdvisoriesinSecurity Advisories·Sep 5info

CISA and G7 Issue Call to Action for Post-Quantum Cryptography Transition

CISA and the Group of Seven (G7) Cyber Security Working Group released 'Preparing for the Post-Quantum Era: A Call to Action,' urging immediate transition to post-quantum cryptography (PQC) to protect sensitive data, authentication systems, and critical assets from future quantum computing threats. The advisory outlines five priorities including raising awareness, developing national strategies, advancing R&D, fostering public-private partnerships, and integrating PQC into procurement processes. No specific CVE or active exploitation is reported; the risk stems from the potential for 'harvest now, decrypt later' attacks by threat actors storing encrypted data for future quantum decryption.

12m

TThe Hacker NewsinMalware·Sep 5high

BraZetsu Malware Framework Exploits Windows Hosts for Underground Marketplace

Researchers have detailed a new Python-based Windows malware framework called BraZetsu that transforms compromised hosts into commercial marketplace inventory. The framework is designed to empower Initial Access Brokers (IABs) by providing a comprehensive toolkit for monetizing system access beyond standard infostealer capabilities. Disclosure was reported by The Hacker News on September 3, 2026.

11m

TThe Hacker NewsinData Breaches·Sep 5high

Thomson Reuters Court Software Breach Exposes Sensitive Judicial Data

Thomson Reuters disclosed a data breach affecting its West Publishing Corporation's C-Track court case management platform. An unauthorized party obtained files from the system in March 2026, with discovery occurring on June 30, 2026. The breach impacts courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. Potential data exposure includes Social Security Numbers and sealed judicial information, though specific victim counts and verification status remain unconfirmed.

11m

BBleepingComputerinCVE·Sep 5high

HPE patches critical ArubaOS-CX remote code execution flaw

Hewlett Packard Enterprise has released security updates to address a critical remote code execution vulnerability in the ArubaOS-CX network operating system. The patch resolves the flaw, though detailed exploitation information, CVSS scoring, and affected version specifics remain pending full disclosure.

11m

TThe Hacker NewsinPhishing·Sep 5high

Threats Roundup: CEO Phishing Kits, Dropbox Account Compromises, and OAuth Token Theft

A threats roundup published by The Hacker News in September 2026 highlights multiple cybersecurity campaigns including CEO phishing kits targeting organizational finance, malicious Dropbox shared links compromising approximately 5,000 accounts, and OAuth 2.0 token theft attacks leveraging fake consent prompts. The report emphasizes that attacks often appear normal, leveraging trusted tools and social engineering to bypass security measures.

11m

BBleepingComputerinMalware·Sep 5high

Coder's Registry Infrastructure Compromised to Distribute Malicious Terraform Modules

Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. The supply chain attack targeted infrastructure-as-code pipelines, potentially exposing credentials and enabling unauthorized access for users of Coder Registry.

11m

DDark readinginCyber Attacks·Sep 5high

Dark Reading Reports on 'Phantom Deal' Campaign Targeting Large Enterprises

According to Dark Reading, threat actors are conducting a campaign dubbed 'Phantom Deal' that targets large enterprises. The actors are reportedly studying companies in extreme detail to dupe midlevel employees into initiating large financial transfers, impersonating legitimate merger and acquisition parties. No zero-day or malware exploit has been reported; the method relies on social engineering and detailed company research.

11m

BBleepingComputerinData Breaches·Sep 4high

French Hospital Fined €500,000 Following Data Breach Exposing 727,000 Records

France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients' and their relatives' data in a breach affecting approximately 727,000 individuals. The incident underscores the regulatory risks associated with inadequate data security measures in the healthcare sector.

11m

BBleepingComputerinCVE·Sep 4critical

Critical Elementor Pro Vulnerability Exploited in the Wild

A critical vulnerability in the Elementor Pro plugin for WordPress, tracked as CVE-2026-32475, is being actively exploited in attacks that deliver webshell payloads and enable arbitrary command execution. Elementor has released a patch; users are urged to update immediately.

11m

CCISA AdvisoriesinCVE·Sep 4critical

Critical CRLF Injection Vulnerability in IXON VPN Client (CVE-2026-75925)

CISA and IXON have disclosed a critical CRLF injection vulnerability (CVE-2026-75925) affecting IXON VPN Client versions below 1.4.7. The flaw stems from improper neutralization of CRLF sequences in the local configuration service, allowing an unauthenticated attacker to inject malicious directives into a file later consumed by a privileged subprocess. Exploitation could result in remote code execution with root or SYSTEM-level privileges. The injected configuration persists across client and operating system restarts, and the VPN connection operates normally, making detection difficult. As of August 5, 2026, IXON cloud infrastructure rejects connections from unpatched clients at both the portal and back-end API, blocking the exploit chain for cloud-reliant deployments.

12m

CCISA AdvisoriesinVulnerability·Sep 4critical

Critical Vulnerabilities Discovered in Tycon Systems TPDIN-Monitor-WEB2 Firmware

CISA and researcher Abdiwelli Guled have disclosed two vulnerabilities in Tycon Systems TPDIN-Monitor-WEB2 (Update A) firmware versions prior to 2.4.5. CVE-2026-61884 allows unauthenticated full device control due to missing authentication on the web management interface. CVE-2026-55985 permits authenticated users to view system credentials stored in cleartext. Both vulnerabilities affect firmware <2.4.5 and have been resolved in the latest release.

12m

CCISA AdvisoriesinVulnerability·Sep 4medium

CISA Advises Mitigation for OPC UA LocalDiscoveryServer Installation Privilege Interception Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-77477 to its Known Exploited Vulnerabilities catalog. The vulnerability exists in OPCFoundation OPC UA LocalDiscoveryServer (LDS) Installers prior to 1.04.420. Successful exploitation could allow an attacker with local access to intercept a high-privilege console window launched during installation and execute arbitrary commands. Exploitation requires the attacker to launch an installer with elevated privileges and have access to the keyboard and display during the installation process. The vulnerability has a CVSS v3 base score of 4.6 (MEDIUM) and is not exploitable remotely. OPCFoundation recommends updating to version 1.04.420 or later.

12m

CCISA AdvisoriesinCVE·Sep 4high

Critical Vulnerability in Inductive Automation Ignition Allows Unauthorized Project Creation

A critical vulnerability in Inductive Automation Ignition Gateway, tracked as CVE-2026-77393, stems from an incorrect default permission where the "Create Project Role(s)" setting shipped blank. This allowed any authenticated user capable of executing gateway scripts to create projects without restriction. The issue affects versions 8.1.53 and earlier; version 8.1.54 and later, as well as the 8.3 series, are not affected. The vulnerability has been reported by two independent researchers and carries a CVSS v3 base score of 8.8 (HIGH).

11m

CCISA AdvisoriesinCVE·Sep 4high

Three Vulnerabilities Discovered in Tycon Systems TPDIN-Monitor-WEB3 Firmware

CISA has issued an industrial control systems advisory (ICSA-26-246-08) detailing three vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3 firmware versions 2.2.9 and prior. The flaws involve use of hard-coded credentials (CVE-2026-77847), cross-site request forgery (CVE-2026-82712), and missing authorization (CVE-2026-82684). Successful exploitation could allow man-in-the-middle attacks, factory resets, credential wiping, sensitive information retrieval, and unauthorized state-changing operations. Tycon Systems has released firmware version 2.4.2 as a remediation, with specific update instructions for legacy units.

12m

CCISA AdvisoriesinCVE·Sep 4critical

Critical Buffer Overflow Vulnerability Affects Pyramid Solutions NetStaX EtherNet/IP Stack

A stack-based buffer overflow vulnerability (CVE-2026-78012) in Pyramid Solutions NetStaX EtherNet/IP Stack versions prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. Successful exploitation may result in memory corruption, device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating the request could not be processed. The vulnerability affects Adapter and Scanner kits in both DLL and Development Kit formats, including Secure variants. Pyramid Solutions has released NetStaX v5.6.1 with mitigations including compile-time assertions and runtime payload-size checks. CISA has added the vulnerability to its ICS advisories, noting worldwide deployment across critical infrastructure sectors.

12m

TThe Hacker NewsinCVE·Sep 4critical

Cisco Patches Critical Nexus 9000 Vulnerability and Releases IOS XR Hardening Update

Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root (CVE-2026-20212, CVSS 9.8). Concurrently, an IOS XR hardening release bundles fixes for seven umbrella CVEs, two of which are rated 9.8, with Cisco stating there are no workarounds for any IOS XR version.

11m

CCISA AdvisoriesinVulnerability·Sep 4high

Schneider Electric Advises Patches for Multiple ICS Products Tracked as CVE-2026-4827

Schneider Electric has released security updates addressing CVE-2026-4827, a vulnerability across its Easergy, EcoStruxure Power Automation, PowerLogic, and Saitel product families. The flaw could allow session hijacking, enabling unauthorized operations within affected industrial control systems. CISA has published the advisory ICSA-26-169-07. No public exploitation has been confirmed, but risk increases for unpatched systems.

13m

BBleepingComputerinZero-Day·Sep 4critical

SonicWall Warns of Actively Exploited SMA1000 Zero-Day Flaws

SonicWall has issued an advisory warning that threat actors are actively exploiting two zero-day vulnerabilities in SonicWall SMA1000 appliances. The vulnerabilities are being chained to achieve remote code execution, affecting SMA1000 devices globally. No official patch has been released; the advisory urges immediate review and mitigation.

11m

TThe Hacker NewsinSecurity Research·Sep 4high

AI-Assisted Exploit Porting Demonstrated Against WAGO PLCs via CVE-2021-31886

Researchers from Forescout Vedere Labs demonstrated the use of Anthropic's Claude AI to port a working pre-authentication remote code execution exploit from one WAGO programmable logic controller model to another. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command. The ported exploit was executed on live WAGO PLC hardware, executing attacker-supplied ARM shellcode. The demonstration highlights the potential for AI to accelerate exploit development and porting across industrial control system platforms.

11m

TThe Hacker Newsinmalware·Sep 4high

Authorities Disrupt Sality P2P Botnet, Sever Malware Payload Distribution

The U.S. Department of Justice announced the takedown of the Sality peer-to-peer botnet on September 2, 2026. Law enforcement agencies from the United States, Bulgaria, Hungary, and Romania, in collaboration with CrowdStrike and the Shadowserver Foundation, disrupted the botnet's update mechanism on August 31, 2026. The operation severed the channel used by operators to distribute new malware payloads and commands to infected systems. While existing malware on infected hosts remains unless actively cleaned, the takedown prevents further propagation of updated threats through the P2P network.

11m

BBleepingComputerinCyber Attacks·Sep 4high

Sality Botnet Infrastructure Dismantled in Joint Global Takedown

International law enforcement agencies and private cybersecurity partners have seized infrastructure associated with the Sality peer-to-peer botnet in a coordinated global operation. The takedown aims to disrupt the malware's command capabilities and reduce further distribution, though the full extent of seized systems and operational details remain under confirmation.

11m

BBleepingComputerinMalware·Sep 4high

US Indicts Russian National for Phishing Campaign Targeting Freelancers

A California federal grand jury has unsealed an indictment against a Russian national accused of conducting a phishing campaign that infected freelancers with TVRAT and DarkVNC malware. The operation allegedly compromised approximately 80,000 systems, enabling unauthorized access and data theft.

11m