Latest Cybersecurity News, page 32

DDark readinginMalware·Aug 27high

NVIDIA OpenClaw Networking Vulnerability Enables LLM Poisoning via Ollama API

Security researchers have identified a networking vulnerability in NVIDIA's OpenClaw framework that could allow attackers to gain unauthenticated access to local model servers through the Ollama API. The flaw potentially enables persistent large language model poisoning and manipulation of AI agent behavior. The issue is classified under the 'Malware' category due to its impact on AI system integrity rather than traditional malware delivery.

11m

TThe Hacker NewsinThreat Actors·Aug 27info

U.S. Treasury Sanctions Iran-Linked Actors Over Critical Infrastructure Breaches

The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an "unprecedented, whole-of-government, economic campaign" against the nation and its enablers. The measures target financial connections and individuals assessed to be enabling or conducting cyber operations against critical infrastructure, though specific breach details and victim entities were not disclosed in the advisory.

11m

TThe Hacker NewsinCyber Attacks·Aug 27high

Attackers Exploit Unauthenticated Bypasses in miniOrange SAML Plugin to Gain WordPress Admin Access

Security researchers have identified two unauthenticated authentication bypass vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. The flaws, tracked as CVE-2026-61979 and CVE-2026-61980, allow attackers to sign in as any WordPress user without valid credentials. Exploitation has been observed in the wild, granting attackers administrative access and potentially leading to full site compromise. Users are urged to update the plugin to the latest patched version immediately.

12m

BBleepingComputerinCyber Attacks·Aug 27high

Hackers breached over 270 Zimbra servers in ongoing attacks

Threat actors have compromised over 270 Zimbra Collaboration Suite instances through remote code execution attacks exploiting a high-severity vulnerability. The attacks are ongoing, with the full scope of data exposure yet to be determined. Zimbra administrators are advised to apply security updates and monitor for indicators of compromise.

11m

TThe Hacker NewsinPhishing·Aug 27high

24 npm Packages Exploit unpkg Mirrors to Host Fake Cloudflare CAPTCHA Phishing Pages

Researchers have detailed a campaign involving 24 malicious npm packages that do not contain traditional malware but instead host a single HTML page. When loaded, this page redirects users to fake Cloudflare CAPTCHA interfaces hosted via unpkg mirrors. The attack leverages ClickFix-style techniques to trick users into executing commands, potentially leading to credential theft or malware installation. The threat actors are using the npm registry as free phishing infrastructure rather than targeting developers who install the packages.

12m

TThe Hacker NewsinMalware·Aug 27high

E4del and PINHOLE RATs Exploit FTP Banners as Dead Drop Resolvers

A newly identified campaign leverages FTP banners as dead drop resolvers (DDRs) to deliver two previously undocumented remote access trojans, E4del and PINHOLE. Threat actors abuse legitimate FTP services to embed C2 commands within standard banner text, allowing malware to retrieve instructions while blending with normal network traffic. The campaign was reported by The Hacker News on August 25, 2026.

11m

BBleepingComputerinSecurity Advisories·Aug 27info

WhatsApp Introduces Multiple Passkeys and Enhanced Two-Step Verification

WhatsApp has begun rolling out several new account security features, including support for multiple passkeys and stronger two-step verification. The updates aim to improve account protection against unauthorized access and account takeover attempts. No active exploitation has been reported, and the features are being deployed as part of a global rollout.

11m

TThe Hacker NewsinSecurity Advisories·Aug 27low

WhatsApp Expands Passkey Support to Multiple Devices, Bolstering Phishing Resistance

Meta has announced that WhatsApp now supports multiple passkeys per account across iOS and Android, enhancing phishing-resistant authentication. The feature allows users to register several passkeys on different devices, reducing reliance on passwords. Over 1 billion people reportedly use passkeys to log into WhatsApp, though this figure is unverified.

11m

TThe Hacker NewsinVulnerability·Aug 27high

Marimo Notebook Vulnerability Allows MCP Command Execution Before Cell Execution

Marimo has patched a high-severity vulnerability in its notebook software that could allow an attacker to execute attacker-supplied Model Context Protocol (MCP) commands as local subprocesses when a specially crafted notebook is opened in edit mode. The flaw, reported by VulnCheck's CNA, triggers command execution before any cell runs, potentially leading to local code execution or unauthorized actions on the victim's system. Users are advised to apply the latest updates and avoid opening untrusted notebooks.

12m

CCISA AdvisoriesinIncident Response·Aug 27high

CISA Reports Divergent Outcomes in Simultaneous Red Team Assessments of Critical Infrastructure Organizations

The Cybersecurity and Infrastructure Security Agency (CISA) conducted two simultaneous red team assessments using similar threat actor tradecraft. In both environments, the red team achieved full domain compromise and accessed sensitive business systems and cloud resources. However, Organization A failed to detect or contain the activity, whereas Organization B quickly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. The advisory details the red team's activity and offers lessons learned for improving IT, cloud, and operational technology (OT) security postures.

11m

BBleepingComputerinData Breaches·Aug 27medium

Nutex Health Reports Data Exfiltration in Cyberattack

Nutex Health, a hospital operator, has confirmed a cyberattack in which an unauthorized third party exfiltrated information from its corporate servers. The investigation is ongoing, and the full scope of impacted data remains unspecified.

11m

TThe Hacker NewsinMalware·Aug 27high

Oasis Security Warns of NVIDIA NemoClaw Vulnerability Allowing Web-Based AI Model Poisoning

Oasis Security has disclosed a vulnerability in NVIDIA NemoClaw that could allow an attacker-controlled webpage to gain unauthenticated control of a local Ollama instance. The flaw potentially enables the injection of hidden instructions into the underlying AI model, facilitating prompt injection attacks against AI agents. The findings have been reported to NVIDIA's Product Security Incident Response Team.

11m

BBleepingComputerinCyber Attacks·Aug 27high

Massive DDoS Attack Disrupts Norway's Government Digital Services

A large-scale distributed denial-of-service (DDoS) attack has been disrupting Norway's shared government digital infrastructure since Monday, affecting public sector services. The threat actor identity, motivation, and full extent of outages remain unconfirmed.

11m

CCISA AdvisoriesinCVE·Aug 26critical

CISA Issues Advisory for Multiple Critical Vulnerabilities in Ebyte NE2-D11 Firmware

The Cybersecurity and Infrastructure Security Agency (CISA) has published advisory ICSA-26-237-06 disclosing four vulnerabilities in the Ebyte NE2-D11 firmware (FW-9167-0-11). The flaws span missing authentication for critical functions, cleartext transmission of sensitive information, insufficiently protected credentials, and client-side authentication bypass. CVSS scores reach 9.8, indicating critical severity. Ebyte has acknowledged the issues and stated a patch is under development, but has not coordinated remediation with CISA, and no patch is currently available.

12m

CCISA AdvisoriesinCVE·Aug 26high

CISA Issues Advisory for Critical Missing Authorization Vulnerability in PayRange API

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control systems advisory (ICS-26-237-04) regarding a missing authorization vulnerability in the PayRange API. The flaw, tracked as CVE-2026-18965, affects all versions of the PayRange API and carries a CVSS 3.1 base score of 8.8. Successful exploitation could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify devices, cause denial of service, or alter a device's displayed image. The vulnerability stems from missing proper authorization on management endpoints, making verbose details of every device on the PayRange network publicly accessible, with or without an account. CISA reports that PayRange has not responded to requests to coordinate mitigation, and no known public exploitation has been reported to CISA at this time.

12m

CCISA AdvisoriesinCVE·Aug 26critical

CISA Issues Urgent Advisory: Two Critical Vulnerabilities in Bendix EC80 Brake ECU

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent industrial control systems advisory (ICSA-26-237-05) detailing two critical vulnerabilities affecting the Bendix EC80 Brake ECU. The flaws, tracked as CVE-2026-67560 and CVE-2026-68967, have CVSS scores of 7.5 and 7.7 respectively. Successful exploitation could allow attackers to crash the electronic control unit, remotely execute arbitrary code, or inject arbitrary Controller Area Network (CAN) bus traffic, potentially disabling critical safety functions including Anti-lock Braking System (ABS), steering assist, speedometer, and shifting capabilities in commercial vehicles. The advisory covers multiple firmware revisions identified by part numbers Z228999, Z266494, and Z286098.

12m

BBleepingComputerinPhishing·Aug 26high

AnonyMousKIT PhaaS Platform Exploits Voice AI to Phish iPhone Passcodes

Security researchers have identified a phishing-as-a-service (PhaaS) platform named AnonyMousKIT that uses voice AI agents to automate the phishing of iPhone passcodes. The operation targets Apple device users globally, aiming to retrieve verification codes and bypass Activation Lock on stolen devices. The platform leverages social engineering through AI-driven voice interactions to trick victims into revealing sensitive credentials.

11m

DDark readinginAI Security·Aug 26medium

Hidden HTML Prompts Manipulate AI Email Summarizers

Researchers have identified a technique where hidden HTML elements can inject malicious prompts into AI-powered email summarization systems. The manipulation causes the AI to generate false or misleading summaries that are invisible to the end user, potentially enabling social engineering attacks. The findings highlight security gaps in how AI models process HTML input and the need for robust input sanitization.

12m

BBleepingComputerinPhishing·Aug 26medium

Hackers Abuse npm Mirrors to Host Phishing Redirect Pages

Threat actors have been observed abusing npm and its mirrors to host malicious HTML pages that mimic Cloudflare CAPTCHAs. These pages are designed to redirect visitors to attacker-controlled websites, potentially facilitating credential theft or malware installation. The abuse of trusted package mirrors highlights the ongoing risk of supply chain manipulation in the developer ecosystem.

11m

BBleepingComputerinData Breaches·Aug 26medium

LACMA Data Breach Exposed Social Security and Medical Information

The Los Angeles County Museum of Art (LACMA) confirmed a data breach compromising personal information, including Social Security numbers and medical data, though specific technical details and the scope of affected individuals remain under investigation.

11m

CCISA AdvisoriesinCVE·Aug 26high

CISA Warns of Critical Credential Exposure in Rently Smart Home

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory regarding a vulnerability in Rently Smart Home software. Successful exploitation of CVE-2026-75960 could allow an attacker to retrieve sensitive authentication credentials, including the Master Pin, thereby overriding standard user permissions. The flaw stems from insufficiently protected credentials within the affected software versions. Rently has released a patch in late June 2026; no user action is required for those running updated versions. The vulnerability carries CVSS v3 base scores of 8.1 and CVSS v4 base scores of 8.7, both rated HIGH. CISA notes no known public exploitation at this time but recommends defensive measures to minimize risk.

12m

CCISA AdvisoriesinVulnerability·Aug 26critical

Critical Authentication Bypass in Siemens SIMATIC IoT2050 Advanced Enables Remote Code Execution

Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are affected by a missing authentication vulnerability in the Node-RED HTTP interface (CVE-2026-58115). An unauthenticated remote attacker could exploit this weakness to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. The vulnerability carries a CVSS 3.1 base score of 10.0 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Siemens has released version 4.3.4.1 or later as a fix. CISA and Siemens advise minimizing network exposure and isolating control system devices.

11m

CCISA AdvisoriesinVulnerability·Aug 26critical

CISA Warns of Critical Hard-Coded Credential Vulnerabilities in FURUNO FA-50 Class B AIS Transponder

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory warning of two vulnerabilities affecting the FURUNO FA-50 Class B Automatic Identification System (AIS) Transponder. The device, which ended production in October 2020, is affected by CVE-2026-59769 and CVE-2026-67578. CVE-2026-59769, rated CRITICAL with a CVSS v3.1 score of 9.1, involves the use of hard-coded credentials that could allow an attacker with network access to alter device settings. CVE-2026-67578, rated HIGH with a CVSS v3.1 score of 7.5, involves missing authentication for critical functions on the management screen. No known public exploitation has been reported, but the end-of-life status of the product means remaining deployed units face persistent risk without future software updates from the vendor.

12m

TThe Hacker NewsinSecurity Advisories·Aug 26medium

AI Coding Tools Accelerate Development but Introduce Unmanaged Vulnerability Backlog

A recent analysis highlights that the accelerated adoption of AI coding assistants is introducing open-source packages and code at a velocity security teams were not designed to manage. This creates a growing backlog of vulnerabilities and remediation debt, as the pace of dependency introduction outstrips traditional review and patching processes.

11m