Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity authentication bypass. The flaws affect customer-managed deployments, including certain FIPS and NDcPP builds, as well as SecurAccess. Organizations are urged to apply the patches immediately.
A critical vulnerability has been discovered in the Elementor Pro WordPress plugin that could allow attackers to upload executable files, leading to remote code execution (RCE) on the server. This could result in full site compromise, data theft, and malware distribution. The vendor has been notified, and users are advised to update as soon as a patch is available.
Kaseya has published guidance for Managed Service Providers (MSPs) on detecting and containing phishing attacks that evade traditional email filters. With AI enabling more personalized and convincing lures, the vendor recommends monitoring identity, email, and endpoint activity to identify and respond to threats that reach the inbox.
The Grandoreiro banking Trojan has resurfaced following a law enforcement takedown, deploying enhanced evasion and obfuscation features in a targeted campaign against Mexican users. The malware is designed to steal banking credentials and facilitate financial fraud, with new techniques aimed at bypassing security controls and analysis.
Microsoft has disclosed a maximum-severity remote code execution vulnerability in its cloud-based identity service, Entra ID (formerly Azure Active Directory), tracked as CVE-2026-69836 with a CVSS score of 10.0. The company confirmed that the flaw has been exploited in the wild, but stated that no customer action is required, indicating the issue has been mitigated at the service level.
Toronto's Hospital for Sick Children (SickKids) confirmed a cybersecurity incident that exposed the personal information of current and former employees and job applicants. The breach stemmed from a flaw in third-party software, and the organization confirmed that clinical systems and patient records remained unaffected.
Threat actors are exploiting FTP server banner configurations to conceal and execute commands that deliver two previously undocumented remote access trojans, E4del and PINHOLE, targeting Windows systems. The abuse of FTP banners allows attackers to hide malicious instructions within legitimate server responses, facilitating initial access and remote control.
A new investigation reveals that more than 9,300 Amazon Web Services (AWS) access keys have been publicly exposed since August 2022 and remain active and valid. The exposure provides attackers with full control over corporate AWS accounts, enabling unauthorized access, data exfiltration, and resource manipulation. The findings underscore the ongoing risk of credential leakage in cloud environments and the need for robust secret management practices.
Check Point Research has disclosed a technique that leverages Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems. The method, which requires no software flaw exploitation and does not import external drivers, affects Windows versions ranging from Windows 7 through Windows 11 25H2. The disclosure raises concerns about the privileges granted to legitimate security drivers and the potential for bypassing boot-time security controls.
Kaspersky researchers have identified a new malware family targeting Android-based vehicle head unit firmware developed by DoFun. Discovered in June 2026 and publicly reported in August 2026, the malware spreads through the built-in updaters of the firmware. Its ultimate goal is to serve as a multi-stage downloader enabling ad fraud and the creation of a proxy botnet. The full extent of affected vehicles and exploitation mechanisms remains under investigation.
The Open Worldwide Application Security Project (OWASP) has released a new Top 10 security list tailored for the modern AI era alongside a Universal Skill Format designed to add consistency and security to AI add-ons. The initiative addresses growing concerns about skill integrity and security in AI integrations.
Security researchers have identified a previously unknown malware family, SynkLoader, being distributed through Microsoft Teams phishing campaigns. The attack leverages fake lock screen interfaces to deceive users into revealing credentials, potentially leading to initial access to victim systems. The campaign has been reported by BleepingComputer and is currently under active analysis.
Researchers from Trend Micro have identified 14 trojanized npm packages that disguise themselves as functional calendar and streak utilities. These packages execute a bundled binary to deliver RedC2 4.0, a Linux backdoor with AI-assisted command-and-control capabilities, potentially granting remote access to threat actors.
Cisco has released security updates addressing nine vulnerabilities across its Crosswork platform and Secure Workload Software. Five of the flaws have been assigned CVSS scores of 10.0, the maximum severity rating. The vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration, with one additional flaw impacting Secure Workload Software. The patches are part of Cisco's continued comprehensive internal security review.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring federal agencies to prioritize patching two actively exploited vulnerabilities in TrueConf Server. The flaws, tracked as CVE-2026-20201 and CVE-2026-20202, enable unauthenticated remote code execution and privilege escalation respectively. CISA's directive underscores the severity of in-the-wild exploitation and urges immediate application of vendor-released patches to mitigate active threats.
Researchers have disclosed a technique dubbed 'CoSnitch' that purportedly manipulates Microsoft Copilot into revealing its own system architecture and security configurations through crafted prompts. The method, described as 'meta-hacking,' is said to trick the AI service into mapping its internal structure. Details regarding the exact mechanics, verified impact, and Microsoft's response remain unconfirmed and should be treated as reported.
A ransomware affiliate is posing as an incident-recovery service to target victims of ransomware attacks. The actor offers aid to victims, masking its true intention of diverting ransom payments. Victims seeking recovery assistance may suffer additional financial loss and system compromise.
Security researchers have identified a Python-based malware framework operating under the name 'TwinLoot' that leverages Microsoft cloud infrastructure to conduct stealthy operations. The framework employs living-off-the-land tactics to blend with legitimate cloud services, featuring a modular implant capable of credential theft and system persistence.
Security researchers and VMware have confirmed active exploitation of CVE-2026-59310, a critical flaw in vCenter Server. The vulnerability, disclosed on August 13, 2026, allows remote attackers to gain unauthorized access and control over affected systems. While patching is recommended, analysts warn it may not be sufficient to fully remediate the active threat campaign targeting deployments worldwide.
Dark Reading reports that the Jewelbug APT group, described as hackers-for-hire, conducts both state-sponsored cyber espionage and financially motivated cryptocurrency theft operations from the same web panel infrastructure. The dual-use approach allows the threat actor to balance intelligence collection with financial gain, potentially affecting government and cryptocurrency entities. Specific exploitation methods, victim counts, and financial losses remain unconfirmed and require further verification.
A ransomware attack has been reported against Colombia's Ministry of Justice, occurring days before a scheduled presidential transition. The incident adds to a pattern of increased ransomware activity targeting critical infrastructure and government-linked organizations across Latin America. Details regarding the ransomware variant, specific systems affected, and data exfiltration remain limited and unconfirmed.
The Gunra ransomware-as-a-service operation has been observed exploiting vulnerabilities in Fortinet firewall and VPN appliances to bypass multi-factor authentication and target critical infrastructure organizations. The attacks leverage leaked Conti ransomware code and known older flaws in Fortinet products, with reported successes against global critical infrastructure targets.
Reports indicate that cyber attacks targeting ill-secured, Internet-exposed Programmable Logic Controllers (PLCs) at water systems are expanding across a dozen US states. Iranian threat actors are suspected, though attribution remains provisional. The intrusions exploit default credentials, known vulnerabilities, or misconfigurations in OT/ICS environments, raising concerns about potential disruption to water supply and treatment operations.
A maximum-severity vulnerability in the Metabase business-analytics platform has been identified as actively exploited in the wild. The flaw allows remote, unauthenticated administrator access to Metabase instances, potentially compromising downstream data pipelines and users. No CVE has been assigned, and no official patch is currently available.
.jpg?width=720&quality=80&disable=upscale)