A chain of vulnerabilities in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, could allow unauthenticated attackers to issue arbitrary commands to the spacecraft and instrument command bus. The issue is tracked as GHSA-p9r8-2q67-fp86 and has a CVSS v3.1 score of 9.4.
Zimperium zLabs researchers have detailed an updated version of the ToxicPanda (aka TgToxic) Android banking malware, now featuring 167 remote commands and a PIN harvesting workflow that targets more than 140 banking and cryptocurrency applications. The malware's global footprint has expanded, and it is being used alongside GoldDigger to enhance on-device fraud capabilities.
Researchers from Socket Threat Research have identified 40 malicious Mozilla Firefox extensions that pose as legitimate Web3 products, including OKX Wallet, Rabby Wallet, and TronLink, to facilitate cryptocurrency wallet theft. These extensions are part of a larger campaign dubbed "Offside Wallet Theft Factory," which encompasses 77 browser add-ons sharing source code and infrastructure overlaps. The malicious extensions were designed to mimic the appearance and functionality of trusted wallet interfaces, tricking users into revealing private keys or seed phrases, which were then exfiltrated to attacker-controlled servers. The findings highlight a significant threat to the Firefox add-on ecosystem and users interacting with decentralized finance (DeFi) platforms.
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the MLflow open-source AI engineering platform to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the flaw. Federal civilian agencies have been directed to remediate the vulnerability by a specified deadline. The advisory highlights the risk of unauthorized access or compromise of systems running vulnerable MLflow instances, though specific exploitation details, affected versions, and patch information remain limited in the public report.
Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity authentication bypass. The flaws affect customer-managed deployments, including certain FIPS and NDcPP builds, as well as SecurAccess. Organizations are urged to apply the patches immediately.
A critical vulnerability has been discovered in the Elementor Pro WordPress plugin that could allow attackers to upload executable files, leading to remote code execution (RCE) on the server. This could result in full site compromise, data theft, and malware distribution. The vendor has been notified, and users are advised to update as soon as a patch is available.
Kaseya has published guidance for Managed Service Providers (MSPs) on detecting and containing phishing attacks that evade traditional email filters. With AI enabling more personalized and convincing lures, the vendor recommends monitoring identity, email, and endpoint activity to identify and respond to threats that reach the inbox.
The Grandoreiro banking Trojan has resurfaced following a law enforcement takedown, deploying enhanced evasion and obfuscation features in a targeted campaign against Mexican users. The malware is designed to steal banking credentials and facilitate financial fraud, with new techniques aimed at bypassing security controls and analysis.
Microsoft has disclosed a maximum-severity remote code execution vulnerability in its cloud-based identity service, Entra ID (formerly Azure Active Directory), tracked as CVE-2026-69836 with a CVSS score of 10.0. The company confirmed that the flaw has been exploited in the wild, but stated that no customer action is required, indicating the issue has been mitigated at the service level.
Toronto's Hospital for Sick Children (SickKids) confirmed a cybersecurity incident that exposed the personal information of current and former employees and job applicants. The breach stemmed from a flaw in third-party software, and the organization confirmed that clinical systems and patient records remained unaffected.
Threat actors are exploiting FTP server banner configurations to conceal and execute commands that deliver two previously undocumented remote access trojans, E4del and PINHOLE, targeting Windows systems. The abuse of FTP banners allows attackers to hide malicious instructions within legitimate server responses, facilitating initial access and remote control.
A new investigation reveals that more than 9,300 Amazon Web Services (AWS) access keys have been publicly exposed since August 2022 and remain active and valid. The exposure provides attackers with full control over corporate AWS accounts, enabling unauthorized access, data exfiltration, and resource manipulation. The findings underscore the ongoing risk of credential leakage in cloud environments and the need for robust secret management practices.
Check Point Research has disclosed a technique that leverages Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems. The method, which requires no software flaw exploitation and does not import external drivers, affects Windows versions ranging from Windows 7 through Windows 11 25H2. The disclosure raises concerns about the privileges granted to legitimate security drivers and the potential for bypassing boot-time security controls.
Kaspersky researchers have identified a new malware family targeting Android-based vehicle head unit firmware developed by DoFun. Discovered in June 2026 and publicly reported in August 2026, the malware spreads through the built-in updaters of the firmware. Its ultimate goal is to serve as a multi-stage downloader enabling ad fraud and the creation of a proxy botnet. The full extent of affected vehicles and exploitation mechanisms remains under investigation.
The Open Worldwide Application Security Project (OWASP) has released a new Top 10 security list tailored for the modern AI era alongside a Universal Skill Format designed to add consistency and security to AI add-ons. The initiative addresses growing concerns about skill integrity and security in AI integrations.
Security researchers have identified a previously unknown malware family, SynkLoader, being distributed through Microsoft Teams phishing campaigns. The attack leverages fake lock screen interfaces to deceive users into revealing credentials, potentially leading to initial access to victim systems. The campaign has been reported by BleepingComputer and is currently under active analysis.
Researchers from Trend Micro have identified 14 trojanized npm packages that disguise themselves as functional calendar and streak utilities. These packages execute a bundled binary to deliver RedC2 4.0, a Linux backdoor with AI-assisted command-and-control capabilities, potentially granting remote access to threat actors.
Cisco has released security updates addressing nine vulnerabilities across its Crosswork platform and Secure Workload Software. Five of the flaws have been assigned CVSS scores of 10.0, the maximum severity rating. The vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration, with one additional flaw impacting Secure Workload Software. The patches are part of Cisco's continued comprehensive internal security review.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring federal agencies to prioritize patching two actively exploited vulnerabilities in TrueConf Server. The flaws, tracked as CVE-2026-20201 and CVE-2026-20202, enable unauthenticated remote code execution and privilege escalation respectively. CISA's directive underscores the severity of in-the-wild exploitation and urges immediate application of vendor-released patches to mitigate active threats.
Researchers have disclosed a technique dubbed 'CoSnitch' that purportedly manipulates Microsoft Copilot into revealing its own system architecture and security configurations through crafted prompts. The method, described as 'meta-hacking,' is said to trick the AI service into mapping its internal structure. Details regarding the exact mechanics, verified impact, and Microsoft's response remain unconfirmed and should be treated as reported.
A ransomware affiliate is posing as an incident-recovery service to target victims of ransomware attacks. The actor offers aid to victims, masking its true intention of diverting ransom payments. Victims seeking recovery assistance may suffer additional financial loss and system compromise.
Security researchers have identified a Python-based malware framework operating under the name 'TwinLoot' that leverages Microsoft cloud infrastructure to conduct stealthy operations. The framework employs living-off-the-land tactics to blend with legitimate cloud services, featuring a modular implant capable of credential theft and system persistence.
Security researchers and VMware have confirmed active exploitation of CVE-2026-59310, a critical flaw in vCenter Server. The vulnerability, disclosed on August 13, 2026, allows remote attackers to gain unauthorized access and control over affected systems. While patching is recommended, analysts warn it may not be sufficient to fully remediate the active threat campaign targeting deployments worldwide.
Dark Reading reports that the Jewelbug APT group, described as hackers-for-hire, conducts both state-sponsored cyber espionage and financially motivated cryptocurrency theft operations from the same web panel infrastructure. The dual-use approach allows the threat actor to balance intelligence collection with financial gain, potentially affecting government and cryptocurrency entities. Specific exploitation methods, victim counts, and financial losses remain unconfirmed and require further verification.
