Latest Cybersecurity News, page 31

TThe Hacker NewsinVulnerability·Aug 28critical

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU humanoid robot. The vulnerabilities, tracked as CVE-2026-76639 and CVE-2026-76640, allow an attacker to achieve root-level access on the robot's Locomotion PC. One chain is exploitable over Bluetooth Low Energy (BLE), while the other uses a network-adjacent path through the chat_go and bashrunner components. Successful exploitation could let an attacker take full control of the robot, potentially causing physical harm. Patch information is not yet available.

11m

TThe Hacker NewsinPhishing·Aug 28high

Mirage2FA Phishing Campaign Hits 4,500 Companies, Bypasses Microsoft 365 MFA

A large-scale phishing campaign using the Mirage2FA toolkit has affected approximately 4,500 companies in the US and EU between 2024 and 2026. The toolkit abuses legitimate Microsoft 365 login flows and uses adversary-in-the-middle techniques to bypass two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised, with most victims based in the US.

12m

DDark readinginPhishing·Aug 28high

'NovaCookies' Phishing Kit Targets Microsoft 365 Sessions for $320 a Month

A new adversary-in-the-middle (AitM) phishing kit named NovaCookies is being sold for $320 per month, enabling attackers to steal Microsoft 365 session cookies and bypass multi-factor authentication. The service lowers the barrier to entry for cybercriminals, allowing them to conduct sophisticated phishing attacks without advanced technical skills.

12m

BBleepingComputerinSecurity Advisories·Aug 28info

Webinar to Dissect Real-World Google Workspace Breaches and First-Hour Response

A new webinar will explore how Google Workspace breaches often start with social engineering or overlooked third-party integrations, rather than sophisticated exploits. The session will analyze real-world incidents, the crucial first hours after detection, and the security controls that can significantly reduce risk.

11m

TThe Hacker NewsinCVE·Aug 28critical

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel has patched two critical-severity vulnerabilities in Next.js that allow unauthenticated remote code execution. One flaw is a path traversal issue affecting Windows filesystems (CVE-2026-75604), and the other involves specially crafted AVIF image files. Users are urged to update immediately.

11m

TThe Hacker NewsinSecurity Advisories·Aug 28high

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

CISA has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list includes a high-severity remote code execution flaw in Citrix NetScaler ADC and NetScaler Gateway (CVE-2019-1068), along with bugs affecting Linux and Microsoft SQL Server. Organizations are urged to apply patches immediately.

11m

CCISA AdvisoriesinVulnerability·Aug 28high

Critical Flaws in All-Line Fuel-Boss Systems Allow Remote Code Execution

CISA has published an advisory (ICSA-26-239-02) detailing two high-severity vulnerabilities in All-Line Equipment Company's Fuel-Boss V1 systems. The flaws, identified as CVE-2018-19518 and CVE-2019-11043, could allow remote attackers to execute arbitrary commands or code on affected devices. Exploitation could disrupt fuel management operations in critical infrastructure sectors, including manufacturing, defense, emergency services, and transportation. Patches are available for some models, but others remain unfixed or have no planned remediation.

12m

BBleepingComputerinHardware Security·Aug 28high

New GPUThor Attack Bypasses NVIDIA ECC to Achieve Root Privilege Escalation

A newly disclosed Rowhammer attack, dubbed GPUThor, can bypass error-correcting code (ECC) protections on NVIDIA GPUs, allowing attackers to cause denial-of-service (DoS) and escalate privileges to root. The attack exploits hardware-level vulnerabilities in GPU memory, potentially affecting data centers and high-performance computing environments where NVIDIA GPUs are prevalent.

12m

BBleepingComputerinSecurity Advisories·Aug 28medium

Snowflake phases out legacy service-account passwords, pushing enterprises toward passwordless migration

Snowflake is ending password authentication for legacy service accounts, requiring organizations to migrate to passwordless methods. Token Security notes that the harder part is identifying what uses each account, who owns it, and how much access it still needs. No active exploitation has been reported; the change is a security improvement to reduce password-related risks.

12m

TThe Hacker NewsinPhishing·Aug 28high

Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

SOCRadar Threat Research Unit (STRU) has disclosed a phishing-as-a-service (PhaaS) platform called AnonyMousKIT that uses rented AI voice agents to impersonate Apple Support. The agents call victims of device theft, posing as Apple representatives, and request the device passcode and two-factor authentication (2FA) codes. This enables threat actors to strip Apple's Activation Lock from stolen iPhones, iPads, and Macs, facilitating resale and further compromising victims' privacy. The service is credit-metered, indicating a commercial criminal ecosystem.

11m

BBleepingComputerinCyber Attacks·Aug 27high

Boston Scientific Reports Global Operational Disruption Following Cyberattack

Boston Scientific has acknowledged a cyberattack that disrupted its IT infrastructure, leading to operational disruptions across its global operations. The company has stated that specific impacts on patient care or data remain undisclosed.

11m

TThe Hacker NewsinThreat Intelligence·Aug 27high

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

The U.S. Department of Justice, in coordination with the FBI, has disrupted two hacking platforms—QScan and QTRouter—operated by a Chinese state-sponsored group known as QTFY. The infrastructure was employed by Nanjing Xinjiuwei Network Technology Company to target critical infrastructure and other sensitive networks in the United States, with the aim of stealing data. The disruption action is intended to prevent further unauthorized access, though it does not reverse data previously exfiltrated.

11m

TThe Hacker NewsinCyber Attacks·Aug 27high

Nimbus Manticore Expands Toolset with Previously Undocumented Malware and SSH Tunneler

Researchers from Group-IB have identified additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps. The new strain features capabilities resembling the TWOSTROKE backdoor and an SSH tunneler, indicating enhanced remote access and persistence mechanisms for the threat actor.

11m

DDark readinginMalware·Aug 27high

Android Malware Hijacks Update System for Car Head Units

Threat actors associated with a known click-fraud botnet have begun targeting Android-based vehicle infotainment head units. The malware exploits legitimate update functionality to deliver and execute malicious code on vehicle systems, raising concerns about persistent access and data exfiltration in connected cars.

11m

DDark readinginThreat Actors·Aug 27high

Researchers Identify Red Flags Exposing Fake North Korean IT Workers

A Dark Reading report highlights how North Korean state-sponsored operatives are refining their impersonation tactics to infiltrate organizations as IT workers, and outlines specific red flags researchers have identified to detect these fraudulent hires before they can cause harm.

11m

BBleepingComputerinZero-Day·Aug 27critical

Critical Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution

A critical vulnerability chain in the Avada WordPress theme allows unauthenticated remote code execution. Exploitation does not require user authentication and can lead to full server compromise. No official patch has been released at the time of reporting; users are advised to monitor vendor updates and implement WAF rules.

11m

DDark readinginMalware·Aug 27medium

Dark Caracal Augments Cyber Espionage Arsenal with New GoCaracal Malware Framework

A new modular malware framework designated GoCaracal has been attributed to the Dark Caracal threat actor, broadening their capabilities for data theft and maintaining persistent access to compromised systems. The report was published by Dark Reading on August 26, 2026, though specific technical details, infection vectors, and target information remain limited.

11m

TThe Hacker NewsinCVE·Aug 27high

Unpatched Kaltura mwEmbed Vulnerabilities Allow Remote File Read and Code Execution

The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library. Tracked as CVE-2026-19913 and CVE-2026-19912, the flaws stem from unsafe deserialization in the mwEmbedLoader.php endpoint. A remote, unauthenticated attacker can exploit these weaknesses to read arbitrary files from the server and execute arbitrary code. No patch is currently available, and exploitation in the wild has not been confirmed at the time of disclosure.

11m

BBleepingComputerinVulnerability·Aug 27critical

Ubiquiti releases security patches for three maximum-severity vulnerabilities

Ubiquiti has released security patches addressing three maximum-severity vulnerabilities that can be exploited remotely without authentication. The flaws affect Ubiquiti product lines and require immediate firmware updates to mitigate the risk of full device compromise.

11m

CCISA AdvisoriesinSecurity Advisories·Aug 27info

CISA Issues Comprehensive Vulnerability Review for Fiscal Years 2024-2025, Emphasizes Basic Security Failures and Prioritization Framework

The Cybersecurity and Infrastructure Security Agency (CISA) has published its Vulnerability Review covering fiscal years 2024 and 2025. The analysis of CISA and open source data establishes a baseline of today's vulnerability landscape, demonstrating that most compromises result from basic security failures rather than advanced techniques. The review identifies common software weaknesses, promotes Secure by Design principles, and provides a prioritization framework evaluating vulnerabilities based on exposure status, Known Exploited Vulnerability (KEV) Catalog status, potential for automated exploitation, and technical impact per Binding Operational Directive 26-04.

12m

CCISA AdvisoriesinCVE·Aug 27high

Critical Authenticated OS Command Injection Flaw in ZoneMinder

ZoneMinder versions 1.37.48 and 1.38.3 contain an authenticated OS command injection vulnerability (CVE-2026-76060) in the event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server. CISA reports a public proof-of-concept has been released, but no confirmed active exploitation has been observed in the wild. The vendor has released version 1.38.3 as a fix.

11m

TThe Hacker NewsinSecurity Advisories·Aug 27info

Analysis: Systemic Challenges in Vulnerability Management Amid AI Evolution

A published analysis from The Hacker News examines the historical and evolving relationship between vulnerability management and patch management teams within cybersecurity programs. The article discusses how this symbiotic relationship has undergone waves of contention and appreciation since the dawn of the cybersecurity discipline, with particular attention to systemic challenges and the potential impact of frontier AI technologies on these practices. The piece serves as industry commentary on management dynamics rather than reporting on a specific active exploit or breach.

11m

DDark readinginanalysis·Aug 27info

Dark Reading Warns of Cyber Affordability Crisis Threatening Small Businesses and Supply Chains

A Dark Reading analysis published on August 25, 2026, examines whether the cybersecurity industry is facing an affordability crisis. The report notes that breach costs have reached record highs and defense spending is nearing $240 billion, suggesting that small businesses are dangerously exposed. This exposure is identified as a potential threat to supply chain security, as smaller entities may lack the resources to maintain adequate defenses.

11m

BBleepingComputerinThreat Intelligence·Aug 27info

Global Law Enforcement Cracks Down on Cybercrime Networks Coordinated by African Groups

A multinational law enforcement operation coordinated by Europol and involving agencies from 22 countries has led to the identification of 263 suspects and the arrest of 58 individuals linked to cybercrime networks coordinated by African crime groups. The operation targeted coordinated cybercrime activities but specific technical details of the crimes committed were not disclosed in the available reports.

11m