GeoNetwork has addressed two vulnerabilities that can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog. The flaws affect government and agency geoportals relying on the software. Patches were shipped on July 8, 2026, for versions 4.4.12 and 4.2.17, with vulnerability details published on August 31, 2026.
The U.S. Department of Justice has charged Russian national Searzhudin Tamirlanovich Aktulaev, 40, with orchestrating a malware campaign between 2016 and 2017 that used approximately 255 fake accounts on a freelance platform to distribute malware-laced Excel attachments to approximately 80,000 users. Aktulaev was arrested in Cyprus in May 2025 and extradited to the United States on August 28, 2026. The charges were unsealed on September 2, 2026.
Microsoft is investigating reports that Defender for Office 365 is incorrectly blocking access to legitimate Google search links, treating them as malicious. The issue appears to be a false positive detection affecting users globally. Microsoft states it is working on a fix and recommends monitoring official security advisories.
SonicWall has released emergency security updates to address two zero-day vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series VPN appliances. The flaws, CVE-2026-83548 and CVE-2026-83549, are being actively exploited in the wild. CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) vulnerability with a CVSS score of 10.0. The vulnerabilities may be chained together to enable remote code execution or unauthorized access. SonicWall researchers William Perry and Adam Babis discovered the issues internally. Patches are available via SonicWall's support portal.
Dropbox has warned that some user accounts were compromised after a threat actor exploited a flaw in Lenovo's email verification process. The actor used fraudulent Lenovo IDs, registered through the manipulated process, to gain unauthorized access to Dropbox accounts. Both companies are investigating the incident and advising users to secure their accounts.
CISA, the Federal Bureau of Investigation, and international partners have published new guidance titled 'Communicating Under Pressure: Best Practices for Service Providers.' The advisory outlines how organizations can plan and execute clear, timely, accurate, and audience-appropriate communications during IT and operational technology (OT) outages, regardless of the root cause—including cyber threat actors, human error, equipment failure, or natural hazards. The guidance emphasizes that outages can cascade across interconnected systems, increasing uncertainty and alarm, and details key elements of effective crisis messaging to inform stakeholders and the public while aligning with legal requirements and law enforcement efforts. CISA's CI Fortify initiative is also highlighted as a resource to help critical infrastructure organizations prepare to isolate and recover vital OT systems during major cyber incidents.
Hackers exploited a Border Gateway Protocol (BGP) hijack to divert update traffic intended for Softaculous, using the rerouted connection to deliver a malicious Virtualizor package to target installations. A hosting provider reported that 5 of 34 examined Virtualizor hypervisors sustained root-level compromise. The incident window began around August 28, 2026. The attack leverages update mechanism compromise to establish persistent root access on affected systems.
Researchers from ThreatFabric have detailed a new Android banking trojan named StreamRat, which was promoted through a fake television-streaming advertisement campaign on Meta platforms. The campaign, focused on Spain, reached an estimated 570,950 Meta accounts in the European Union. StreamRat is capable of granting operators near-complete control of infected devices, enabling banking theft and other malicious activities.
Manifold Security has identified eight security flaws across seven command-line AI coding agents. Exploitation occurs when a repository's Git configuration names a command that the agent runs on the developer's machine. The executed command runs as the user, outside the agent's sandbox and without an approval prompt. Four of the eight flaws remain unpatched as of publication.
A Chinese-speaking cybercrime cluster identified as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers belonging to Brazilian government and educational institutions. These modules divert visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research has tracked the campaign since mid-2025, with modules observed in September 2026. The exact exploitation vector and specific module names remain under investigation.
Acronis has released a six-point checklist designed to help managed service providers (MSPs) strengthen ransomware resilience. The advisory outlines capabilities spanning reduced exposure, attack detection, recovery point preservation, and rapid operational restoration. The guidance is advisory in nature and does not address a specific active exploit or vulnerability.
A threat actor group identified as 'Spring Ring' is conducting vishing attacks targeting Microsoft Teams users. The operation aims to compromise user sessions, spread malware, and potentially take over infrastructure, according to a Dark Reading report published on September 2, 2026. The claims of a coordinated operation and specific attribution remain unverified.
Threat actors are exploiting a severe unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 to achieve remote code execution and deploy reverse shells without requiring credentials. The flaw, tracked as CVE-2026-9586 with a CVSS score of 9.3, affects enterprise VoIP infrastructure globally. Sangoma has released security updates; users are advised to apply patches immediately to mitigate active exploitation risk.
A malware campaign has been observed distributing fake software installers through bogus download websites. The installers modify system settings to disable Windows Update and real-time protection in Microsoft Defender, disabling critical security updates and real-time malware protection on compromised systems. The campaign primarily targets China-based operations of multinational organizations and Chinese-speaking users. Microsoft has not released a specific patch for this campaign; users are advised to ensure Windows Update is enabled, avoid downloading software from unofficial sources, and keep Microsoft Defender real-time protection active.
On September 2, 2026, Google announced Gemini 3.8 Flash Cyber, described as its most capable cybersecurity model, and launched the Fairwind Program to provide early access to high-priority defenders including governments, healthcare providers, and telecommunications companies. Concurrently, Anthropic and OpenAI announced their own cybersecurity-focused AI offerings and safeguards. The announcements were made at DEF CON AI Village and focus on improving threat detection, incident response, and secure code analysis while introducing model-level safeguards to prevent misuse. The Fairwind The user wants me to act as a cybersecurity news analyst and produce a JSON object based on the provided via the provided source. The source is about Google, Anthropic, and OpenAI announcing cyber AI models. I need to extract relevant info and output JSON only. Looking at the source content, it's about Google, Anthropic, and OpenAI announcing cyber AI models. The source is from The Hacker News. The published date is the source says 2026-09-02. The content is about new AI models for cybersecurity. Now I need to output JSON with the required fields: headline, subtitle, summary, article, keyTakeaways, seoTitle, seo...
A SQL injection vulnerability has been identified in the All-in-One WP Migration and Backup plugin for WordPress. The flaw potentially allows unauthenticated attackers to execute arbitrary SQL commands, which could lead to remote code execution and full website takeover. The vulnerability affects installations of the plugin across millions of WordPress sites. No specific CVE has been assigned at the time of reporting. Users are advised to update the plugin to the latest patched version to mitigate the risk.
Multiple zero-day vulnerabilities in SonicWall SMA 1000 edge devices are being actively exploited in the wild, allowing unauthenticated remote code execution. This exploitation follows earlier zero-day attacks on other SonicWall edge device flaws reported earlier in 2026, indicating a sustained pattern of targeted exploitation. Affected organizations should prioritize firmware patching and monitor official advisories.
Security researchers and BleepingComputer report that threat actors are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform. The flaw enables remote code execution, allowing attackers to deploy reverse shells and potentially achieve full system compromise. Sangoma has released security updates to address the vulnerability, and administrators are urged to apply them immediately.
Kaspersky has attributed two previously undocumented malware families to the Iranian Nimbus Manticore group. The threat actors pose as recruiters on professional platforms, enticing victims with fraudulent job offers and coding test assignments. Execution of these tests delivers cross-platform RATs capable of infecting Linux and Apple macOS systems, marking an expansion of the group's targeting footprint beyond traditional Windows operations.
Novocure, a healthtech company specializing in cancer treatment technologies, confirmed a cyberattack in mid-August 2026 that exposed the data of more than 1,400 U.S. cancer patients and an undisclosed number of employees. The breach was first reported publicly on September 1, 2026.
A threat actor campaign identified as ClickFix has compromised 31 organizations by abusing the Polygon blockchain. The campaign deploys EtherHiding malware, which uses blockchain transactions as a mechanism to dynamically update command-and-control (C2) server addresses. This technique allows the malware to evade traditional network-based blocking and maintain persistence. The abuse of the blockchain functions as an attacker-controlled address book, fetching updated C2 information. While the exact compromise methods and victim industry verticals remain under verification, the campaign represents a novel convergence of malware and decentralized ledger technology for malicious infrastructure management.
Cybersecurity researchers report that unidentified threat actors hijacked BGP routing for Virtualizor's update infrastructure, redirecting update requests to malicious servers. Users applying these compromised updates risk full system compromise of their VPS environments.
Brazilian financial services, retail, and e-commerce organizations have been targeted by a financially motivated threat actor tracked as Breeze Comet (formerly UNC5669) since 2024. The actor specializes in manipulating payment systems and banking software to conduct fraudulent transfers, according to Google Threat Intelligence Group (GTIG) and Mandiant. The activity was reported in September 2026, with hundreds of fraudulent transactions observed. Exact victim counts, specific exploitation techniques, and financial loss figures remain unconfirmed and require further investigation.
Aesto LLC, operating as Aesto Health, has disclosed a data breach affecting more than 9.5 million individuals. The incident involves personal and protected health information. The breach was discovered recently and publicly disclosed on September 1, 2026. The company states that the scope and specific data types are under investigation, and no public details regarding the attack vector or exploitation method have been released.
