Latest Cybersecurity News, page 4

BBleepingComputerinCyber Attacks·Oct 2critical

Bitget breach attributed to zero-day in third-party security products

Bitget confirmed that a cyber attack last week resulted in the theft of approximately $387.5 million. The exchange stated that the breach was facilitated by exploitation of a zero-day vulnerability in third-party security products integrated into its infrastructure. The incident was disclosed on September 30, 2026. Details regarding the specific vulnerability, affected products, and exploitation vector remain unconfirmed.

11m

BBleepingComputerinVulnerability·Oct 2high

TeamViewer Urges Immediate Patching of High-Severity Vulnerabilities

TeamViewer has warned customers to immediately patch a set of high-severity vulnerabilities affecting its remote access client and host software. The company stated that security updates have been released and should be applied as soon as possible to mitigate potential risks.

11m

TThe Hacker NewsinCyber Attacks·Oct 2high

Security Researchers Identify Six Prevalent Browser-Based Attack Techniques for 2026 Threat Landscape

A recent analysis published by The Hacker News identifies six dangerous browser-based attack techniques expected to be prevalent in the 2026 threat landscape. The report highlights that modern breaches frequently begin in browser sessions and can complete the entire attack chain from initial access to data exfiltration without leaving the browser environment. Security teams are urged to prioritize browser security configurations and monitoring given the pervasive nature of these threats.

11m

DDark readinginThreat Intelligence·Oct 1high

Russia's Star Blizzard APT Adopts New "RedFlick" Phishing Tactic to Deploy CosmicPulse Backdoor

The Russian APT actor Star Blizzard has been observed pivoting from its previously documented ClickFix tactic to a new approach designated RedFlick. The campaign targets Ukrainian-linked organizations globally, including non-governmental organizations, think tanks, and journalists, with the objective of deploying a previously referenced backdoor identified as CosmicPulse. The shift in tactics is intended to widen the phishing net and evade existing detection mechanisms.

11m

TThe Hacker NewsinMalware·Oct 1high

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver Remote Access Trojans (RATs). Huntress observed the activity in late September 2026, marking another instance of abuse in trusted artificial intelligence platforms. The campaign directs victims from AI-generated content to external sites using ClickFix social engineering lures that trick users into executing commands that deliver malware.

11m

BBleepingComputerinCVE·Oct 1critical

CISA Adds Critical Pre-Auth RCE Vulnerability in MikroTik RouterOS to KEV Catalog

CISA has added a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS to its Known Exploited Vulnerabilities catalog, mandating patching for U.S. federal civilian executive branch agencies. The flaw allows remote attackers to execute arbitrary code or cause denial-of-service without authentication. MikroTik has released patched versions 7.12.3 and 7.13.1rc to address the vulnerability.

11m

TThe Hacker NewsinCyber Attacks·Oct 1high

Attackers Abuse MSP360 RMM to Deploy ScreenConnect in Dual-RMM Phishing Campaigns

Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. Once executed, the legitimate MSP360 installer establishes remote management access on affected endpoints, and ScreenConnect is subsequently deployed to provide dual-RMM persistence. The campaigns leverage deceptive file names and social-engineering themes to trick users into executing the installer. No zero-day vulnerabilities are exploited; the attack relies on user execution. Microsoft and MSP360 advise user vigilance, email filtering, and verifying software sources, and recommend keeping MSP360 and ScreenConnect updated to the latest versions.

11m

BBleepingComputerinZero-Day·Oct 1critical

Cisco Patches Actively Exploited Zero-Day in Catalyst SD-WAN Manager

Cisco has released security updates to address CVE-2026-76504, a critical zero-day vulnerability in Catalyst SD-WAN Manager that is being actively exploited in the wild. The flaw allows authentication bypass and privilege escalation to admin privileges, potentially enabling full compromise of SD-WAN infrastructure.

11m

DDark readinginSecurity Advisories·Oct 1info

Swimlane Research Reveals Paradox: AI Boosts SOC Efficiency but Hinders Professional Development

A new Swimlane survey, as reported by Dark Reading, finds a dual trend in Security Operations Centers: while AI-driven detection and response tools are essential for gaining a defensive edge, a significant portion of practitioners believe these same tools limit skill development. The research indicates that 91% of respondents report rising satisfaction, but nearly 50% say entry-level career paths are getting harder. The findings highlight the need for balanced AI integration alongside structured training and mentorship to prevent stagnation of the cybersecurity workforce.

11m

BBleepingComputerinMalware·Oct 1high

Russian State Actor Star Blizzard deploys CosmicPulse backdoor via new RedFlick technique

According to BleepingComputer, the Russian state actor Star Blizzard has been observed using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor. The report indicates this technique was used in targeted campaigns, though specific exploitation details, target geography, and the scope of affected systems remain unverified. No patch or mitigation guidance specific to RedFlick was provided in the source material.

11m

DDark readinginmalware·Oct 1high

Malicious Custom GPTs Used as RAT Delivery Lure in ClickFix-Style Campaign

Security researchers report a campaign in which threat actors create and promote malicious Custom GPTs on the OpenAI platform, using legitimate Google domains as lures. The social engineering approach mimics ClickFix tactics, persuading users to execute commands that deploy remote access trojans (RATs) or other malware. No specific CVE or zero-day vulnerability has been identified; the attack relies on user interaction and trust in legitimate AI services.

11m

BBleepingComputerinSecurity Advisories·Oct 1info

Microsoft to Block External Script Injection Attacks in Entra ID Starting October 2026

Microsoft has announced that the Entra ID authentication system will receive enhanced protections against external script injection attacks beginning in October 2026. The advisory, reported by BleepingComputer, serves as a preventive measure with no active exploitation currently reported.

11m

TThe Hacker NewsinCVE·Oct 1critical

Cisco Advises Urgent Patching of Critical Authentication Bypass in SD-WAN Manager

Cisco has confirmed that a critical vulnerability in Catalyst SD-WAN Manager is being actively exploited. The flaw, tracked as CVE-2026-76504, allows a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and Cisco states there is no workaround. The advisory was published on September 30, 2026.

11m

CCISA AdvisoriesinVulnerability·Oct 1critical

Critical Vulnerabilities Affect Lantronix G520 Series Cellular Gateways

CISA has issued an industrial control systems advisory detailing two critical vulnerabilities in the Lantronix G520 Series Cellular Gateway. CVE-2026-84409 involves improper neutralization of input during web page generation (cross-site scripting) combined with a command execution interface, allowing attackers with metadata influence to execute arbitrary code with root privileges. CVE-2026-91191 stems from improper verification of cryptographic signatures and an exposed production private key, enabling unauthorized software packages to be accepted as authentic and executed with root privileges during boot. Both vulnerabilities affect firmware version 2.6.0.4R6_stable.

12m

DDark readinginsecurity-advisories·Oct 1info

Nvidia Introduces Open Agent Safety Platform for AI Security Oversight

Nvidia has announced the Open Agent Safety Platform, a security initiative designed to monitor AI agent activities and quarantine those exhibiting unruly or harmful behavior. The platform combines hardware and software components to provide oversight for autonomous AI systems.

11m

BBleepingComputerinPrivacy·Oct 1info

Signal Completes Cross-Platform Rollout of Encrypted Local Backups

Signal Labs, Inc. released version 8.30 of the Signal messaging app, finalizing the deployment of its encrypted local backup feature across Android, iOS, Linux, macOS, and Windows. The update allows users to create end-to-end encrypted local copies of their chat history for data recovery purposes. The feature was previously available on Android and is now fully cross-platform. No known exploitation has been reported, and the feature is designed with end-to-end encryption to secure backups against unauthorized access.

11m

BBleepingComputerinMalware·Oct 1high

CISA Issues Emergency Directive to Patch Actively Exploited Citrix NetScaler Vulnerabilities

The Cybersecurity and Infrastructure Security Agency has issued an emergency directive requiring U.S. federal agencies to patch two critical Citrix NetScaler vulnerabilities that are being actively exploited in the wild. The directive sets a deadline of Wednesday for remediation to prevent potential unauthorized access and data exfiltration on government networks.

11m

BBleepingComputerinCyber Attacks·Oct 1high

Bitget Resumes Bitcoin Withdrawals After $387.5 Million Crypto Heist

Bitget, a cryptocurrency exchange, has resumed Bitcoin withdrawals after suspending them last week amid reports of a suspected breach by North Korean hackers. The incident resulted in the theft of over $350 million, with some reports citing $387.5 million. The exchange had suspended withdrawals as a containment measure while investigating the intrusion.

11m

KKrebs on SecurityinThreat Actors·Oct 1high

Dutch Police Arrest Suspected Shiny Hunters Affiliate; Hackers Escalate Attacks on FBI and Cl0p

Dutch authorities have arrested a 23-year-old convicted cybercriminal on suspicion of aiding the Shiny Hunters hacking group. In the days following the arrest, remaining members of Shiny Hunters reportedly escalated their operations, stealing sensitive data from the FBI and issuing extortion claims targeting the Russian ransomware group Cl0p.

11m

BBleepingComputerinData Breaches·Sep 30high

Times Car Confirms Data Breach Affecting 6.6 Million User Accounts

Times Car, a Japanese car-sharing service, has confirmed a data breach compromising approximately 6.6 million user accounts. The incident was disclosed late last week, with the exact attack vector and nature of exposed personal information yet to be fully specified. Authorities and the company are reportedly investigating the breach.

11m

TThe Hacker NewsinVulnerability·Sep 30high

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

21m

BBleepingComputerinCyber Attacks·Sep 30high

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

21m

TThe Hacker Newsindata-breaches·Sep 30high

French Tax Administration Data Breach Exposed Hundreds of Thousands of Records via Stolen Staff Credentials

An unauthorized access incident at France's Direction Générale des Finances Publiques (DGPP) compromised tax data belonging to hundreds of thousands of taxpayers and businesses between June and July 2026. According to a report published by France's national cybersecurity agency ANSSI on 29 September 2026, the attacker used stolen staff passwords to gain entry. The agency stated the attack was 'not sophisticated' and went undetected for seven weeks due to weak security controls. ANSSI noted that neither the tax administration nor the agency itself observed data exfiltration, though the breach resulted in unauthorized access to sensitive fiscal information.

21m