Latest Cybersecurity News, page 5

TThe Hacker NewsinCyber Attacks·Sep 30high

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

31m

CCISA AdvisoriesinCVE·Sep 30high

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

12m

BBleepingComputerinZero-Day·Sep 30critical

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Cybersecurity firms report that attackers are exploiting a zero-day vulnerability in Citrix NetScaler to deploy custom web shells and tunneling malware. The exploitation grants root access, enables credential theft, and facilitates lateral movement into internal networks. Citrix has released patches and security advisories addressing CVE-2026-88772.

11m

BBleepingComputerinThreat Actors·Sep 30high

FBI Warns ShinyHunters Members Following Dutch Police Arrest of Alleged Leader

The FBI has issued warnings to members of the ShinyHunters extortion group, urging them to turn themselves in following the arrest of an alleged leader by Dutch police. The operation marks a coordinated law enforcement effort to disrupt the group's activities.

11m

DDark readinginApplication Security·Sep 30high

Unsloth Studio Vulnerability Enables Arbitrary Code Execution During Model Inspection

A vulnerability in Unsloth Studio's model inspection feature has been patched. The flaw allows malicious AI models to execute arbitrary Python code when the trust_remote_code setting is enabled, potentially compromising systems running the inspection tool. The issue has been addressed in a recent update, and users are advised to update to the latest version.

11m

CCISA AdvisoriesinCVE·Sep 30high

CISA Adds CVE-2026-86950 to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability affects Apple Multiple Products and involves an out-of-bounds write flaw. Evidence of active exploitation has been confirmed, prompting CISA to require Federal Civilian Executive Branch agencies to prioritize rapid remediation on publicly exposed assets per Binding Operational Directive 26-04.

11m

TThe Hacker NewsinCyber Attacks·Sep 30high

Bitget Reports $388M Loss Following Exploitation of Third-Party Security Product Flaw

Bitget disclosed that an attacker stole approximately $388 million by exploiting a vulnerability in a third-party security product integrated into the exchange's infrastructure. The threat actor used the flaw to obtain high-level internal credentials, which were subsequently used on September 24 to issue fraudulent withdrawal commands to Bitget's wallet system. The exchange confirmed that most user funds remain secure, though the full extent of exposure is under investigation.

11m

TThe Hacker NewsinCVE·Sep 30high

Apple Patches Actively Exploited CoreGraphics Vulnerability in iOS, iPadOS, and macOS

Apple has released security updates to address CVE-2026-86950, an out-of-bounds write vulnerability in the CoreGraphics component. The company reports the flaw may have been exploited in targeted attacks against older versions of iOS, iPadOS, and macOS. Successful exploitation could lead to arbitrary code execution in the context of the user. The updates are now available for affected devices.

11m

TThe Hacker NewsinCyber Attacks·Sep 30high

JADEPUFFER-Linked Attackers Deploy Compromised Service Principals to Delete Azure Resources

Microsoft has attributed a series of destructive operations in early June 2026 to the threat actor tracked as JADEPUFFER, also known as Storm-3168. The attackers used compromised service principals to gain elevated privileges and delete Azure resources over a period of approximately 18 hours. Microsoft describes this activity as an evolution of the threat actor's tradecraft, leveraging identity-based attacks rather than traditional exploit chains.

11m

TThe Hacker NewsinCVE·Sep 30critical

CISA Adds Two Critical Citrix NetScaler Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities (KEV) catalog. The move follows reports of active exploitation in the wild and applies mandatory remediation requirements for U.S. federal agencies. Organizations using unpatched appliances are advised to apply security updates immediately.

11m

DDark readinginCyber Attacks·Sep 29high

JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack

A threat actor identified as JadePuffer leveraged exposed credentials to gain unauthorized access to a Microsoft Azure tenant, resulting in the deletion of cloud-based storage, applications, and databases. The attack is described as destructive, though the exact victim organization, volume of data lost, and actor attribution details remain unconfirmed.

11m

BBleepingComputerinRansomware·Sep 29high

JadePuffer Agentic AI Attacks Target Azure Tenants, Destroy Cloud Resources

Security researchers have observed the JadePuffer ransomware operator conducting agent-driven attacks against Azure cloud tenants. The attacks involve reconnaissance, credential theft, and the destruction of core cloud components. Details regarding the specific use of agentic AI remain reported but unconfirmed.

11m

DDark readinginMalware·Sep 29high

Chrome Web Store 'Poper Blocker' Extension Exfiltrates User Data

A browser extension named 'Poper Blocker' available on the Google Chrome Web Store has been identified as spyware that exfiltrates sensitive user data. Despite reports from researchers warning of its malicious nature, the extension maintained Google's seal of approval and was downloaded by millions of users before being removed.

11m

TThe Hacker NewsinMalware·Sep 29high

RatHat Android Banking Trojan Console Leverages Gemini AI for Victim Targeting

Cleafy researchers have traced nearly 100 deployments of the RatHat Android banking trojan console since April 2026. The console, operated under a malware-as-a-service model, uses Google's Gemini AI to analyze collected data and identify higher-value victims. Infected devices face financial theft and potential exposure of sensitive data.

11m

BBleepingComputerinData Breaches·Sep 29high

Misconfigured Supabase Apps Expose Data in Over 16,000 Databases

Security researchers have identified more than 16,000 Supabase-backed applications with publicly accessible databases. The exposure stems from default allow rules that permit unrestricted read access to tables containing personally identifiable information, passwords, and authentication tokens. The findings highlight the risk of misconfigured backend-as-a-service platforms when security defaults are not adjusted for production use.

11m

BBleepingComputerinThreat Actors·Sep 29info

Dutch Police Confirm Arrest of 24-Year-Old in ShinyHunters Investigation

Dutch authorities have confirmed the arrest of a 24-year-old man from Amsterdam in connection with an investigation targeting the ShinyHunters hacking group. The operation forms part of broader law enforcement efforts to disrupt the threat actor's activities, though specific details regarding the evidence or the suspect's alleged role remain under investigation.

11m

TThe Hacker NewsinMalware·Sep 29high

NeedyMantis Malware Used for Long-Term Persistence in Targeted Intrusions

Microsoft has identified a malware family named NeedyMantis being used by threat actors to maintain long-term, unauthorized access to already-breached networks. The malware has been observed in targeted intrusions across a range of sectors, including telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activity has been tracked since at least 2023 and remains ongoing.

11m

DDark readinginMalware·Sep 29high

Carbonato Botnet Leverages Hermes Agent AI Framework to Compromise Docker Hosts

Security researchers have identified a new botnet campaign, tracked as Carbonato, that repurposes the open-source Hermes Agent AI framework to compromise Docker hosts. The malware leverages exposed container endpoints to execute arbitrary commands through Telegram integration and harvests AI API keys and other sensitive credentials stored on compromised systems.

11m

DDark readinginVulnerability·Sep 29high

One Packet Can Crash OT Servers in Industrial Sectors

A high-severity zero-day vulnerability in the TDengine time-series database allows a single malformed packet to crash OT servers, potentially disrupting industrial, IoT, energy, and automotive operations. Details regarding exploitation status and remediation remain limited.

11m

BBleepingComputerinRansomware·Sep 29high

Keio Corporation Confirms Ransomware Attack Disrupts Business Systems

Keio Corporation, a major private railway operator in Japan, confirmed that a ransomware attack over the weekend disrupted some of its business systems. The incident affected operational networks, though the extent of service disruption and any data exfiltration or ransom demand remains unconfirmed.

11m

BBleepingComputerindata-breach·Sep 29high

ShinyHunters Claims FBI Breach via Oracle PeopleSoft Zero-Day

The ShinyHunters ransomware operation claims it breached FBI systems using a previously unknown Oracle PeopleSoft vulnerability, exfiltrating sensitive employee and applicant data. As of now, neither the FBI nor Oracle has confirmed the breach or the existence of a zero-day CVE.

11m

TThe Hacker NewsinMalware·Sep 29high

CTM360 Report Details ClickFix Evolution From Novelty to Subscription Malware Service

A new global threat report from CTM360 traces the ClickFix malware distribution technique from its emergence in late 2023 to a sophisticated subscription product utilizing on-chain infrastructure and a state-sponsored user base. The report identifies ClickFix as the most common method for attackers to gain initial access to enterprise networks, noting that the technique operates without exploits, attachments, or files on disk, rendering traditional domain blocking ineffective.

11m

DDark readinginRansomware·Sep 29high

Summer 2026 Cyber Landscape: AI Supply Chain Breach, Ransomware Targets Dairy Giant, and Iranian-Linked Threat Actors Target US Water Systems

This report covers three distinct cybersecurity events from the summer of 2026: unauthorized access involving AI agents on the Hugging Face platform, a ransomware attack impacting the Fairlife dairy brand, and Iranian-linked threat actors compromising multiple US water systems. These incidents underscore the diverse nature of current threats targeting both software supply chains and critical infrastructure.

11m

BBleepingComputerinThreat Intelligence·Sep 29critical

Citrix NetScaler Zero-Days Exploited in the Wild; Agencies Urge Immediate Restriction

Cybersecurity agencies, security researchers, and IT providers are warning that two zero-day vulnerabilities in Citrix NetScaler products are being actively exploited in the wild. Exploitation was reported in late September 2026, with private and public advisories issued ahead of patches expected to be released next week. Organizations using unpatched NetScaler appliances face risks of unauthorized access, data exfiltration, and service disruption. Until patches are applied, administrators are advised to shut down or restrict NetScaler appliances.

11m