Threat actors are exploiting FTP server banner configurations to conceal and execute commands that deliver two previously undocumented remote access trojans, E4del and PINHOLE, targeting Windows systems. The abuse of FTP banners allows attackers to hide malicious instructions within legitimate server responses, facilitating initial access and remote control.
A new investigation reveals that more than 9,300 Amazon Web Services (AWS) access keys have been publicly exposed since August 2022 and remain active and valid. The exposure provides attackers with full control over corporate AWS accounts, enabling unauthorized access, data exfiltration, and resource manipulation. The findings underscore the ongoing risk of credential leakage in cloud environments and the need for robust secret management practices.
Check Point Research has disclosed a technique that leverages Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems. The method, which requires no software flaw exploitation and does not import external drivers, affects Windows versions ranging from Windows 7 through Windows 11 25H2. The disclosure raises concerns about the privileges granted to legitimate security drivers and the potential for bypassing boot-time security controls.
Kaspersky researchers have identified a new malware family targeting Android-based vehicle head unit firmware developed by DoFun. Discovered in June 2026 and publicly reported in August 2026, the malware spreads through the built-in updaters of the firmware. Its ultimate goal is to serve as a multi-stage downloader enabling ad fraud and the creation of a proxy botnet. The full extent of affected vehicles and exploitation mechanisms remains under investigation.
The Open Worldwide Application Security Project (OWASP) has released a new Top 10 security list tailored for the modern AI era alongside a Universal Skill Format designed to add consistency and security to AI add-ons. The initiative addresses growing concerns about skill integrity and security in AI integrations.
Security researchers have identified a previously unknown malware family, SynkLoader, being distributed through Microsoft Teams phishing campaigns. The attack leverages fake lock screen interfaces to deceive users into revealing credentials, potentially leading to initial access to victim systems. The campaign has been reported by BleepingComputer and is currently under active analysis.
Researchers from Trend Micro have identified 14 trojanized npm packages that disguise themselves as functional calendar and streak utilities. These packages execute a bundled binary to deliver RedC2 4.0, a Linux backdoor with AI-assisted command-and-control capabilities, potentially granting remote access to threat actors.
Cisco has released security updates addressing nine vulnerabilities across its Crosswork platform and Secure Workload Software. Five of the flaws have been assigned CVSS scores of 10.0, the maximum severity rating. The vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration, with one additional flaw impacting Secure Workload Software. The patches are part of Cisco's continued comprehensive internal security review.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring federal agencies to prioritize patching two actively exploited vulnerabilities in TrueConf Server. The flaws, tracked as CVE-2026-20201 and CVE-2026-20202, enable unauthenticated remote code execution and privilege escalation respectively. CISA's directive underscores the severity of in-the-wild exploitation and urges immediate application of vendor-released patches to mitigate active threats.
Researchers have disclosed a technique dubbed 'CoSnitch' that purportedly manipulates Microsoft Copilot into revealing its own system architecture and security configurations through crafted prompts. The method, described as 'meta-hacking,' is said to trick the AI service into mapping its internal structure. Details regarding the exact mechanics, verified impact, and Microsoft's response remain unconfirmed and should be treated as reported.
A ransomware affiliate is posing as an incident-recovery service to target victims of ransomware attacks. The actor offers aid to victims, masking its true intention of diverting ransom payments. Victims seeking recovery assistance may suffer additional financial loss and system compromise.
Security researchers have identified a Python-based malware framework operating under the name 'TwinLoot' that leverages Microsoft cloud infrastructure to conduct stealthy operations. The framework employs living-off-the-land tactics to blend with legitimate cloud services, featuring a modular implant capable of credential theft and system persistence.
Security researchers and VMware have confirmed active exploitation of CVE-2026-59310, a critical flaw in vCenter Server. The vulnerability, disclosed on August 13, 2026, allows remote attackers to gain unauthorized access and control over affected systems. While patching is recommended, analysts warn it may not be sufficient to fully remediate the active threat campaign targeting deployments worldwide.
Dark Reading reports that the Jewelbug APT group, described as hackers-for-hire, conducts both state-sponsored cyber espionage and financially motivated cryptocurrency theft operations from the same web panel infrastructure. The dual-use approach allows the threat actor to balance intelligence collection with financial gain, potentially affecting government and cryptocurrency entities. Specific exploitation methods, victim counts, and financial losses remain unconfirmed and require further verification.
A ransomware attack has been reported against Colombia's Ministry of Justice, occurring days before a scheduled presidential transition. The incident adds to a pattern of increased ransomware activity targeting critical infrastructure and government-linked organizations across Latin America. Details regarding the ransomware variant, specific systems affected, and data exfiltration remain limited and unconfirmed.
The Gunra ransomware-as-a-service operation has been observed exploiting vulnerabilities in Fortinet firewall and VPN appliances to bypass multi-factor authentication and target critical infrastructure organizations. The attacks leverage leaked Conti ransomware code and known older flaws in Fortinet products, with reported successes against global critical infrastructure targets.
Reports indicate that cyber attacks targeting ill-secured, Internet-exposed Programmable Logic Controllers (PLCs) at water systems are expanding across a dozen US states. Iranian threat actors are suspected, though attribution remains provisional. The intrusions exploit default credentials, known vulnerabilities, or misconfigurations in OT/ICS environments, raising concerns about potential disruption to water supply and treatment operations.
A maximum-severity vulnerability in the Metabase business-analytics platform has been identified as actively exploited in the wild. The flaw allows remote, unauthenticated administrator access to Metabase instances, potentially compromising downstream data pipelines and users. No CVE has been assigned, and no official patch is currently available.
New research indicates that AI browsers from top vendors remain susceptible to prompt injection attacks, even with multiple security guardrails in place. The findings highlight the difficulty of securing AI-integrated browsing environments against adversarial prompts designed to override system instructions.
Security researchers have identified Cascading Style Sheets (CSS) as a potential vector for data exfiltration from webmail clients. The technique allegedly leverages CSS features to transmit sensitive information from affected platforms. Specific attack methodologies, targeted vendors, and real-world exploitation instances are not detailed in the available report. The advisory notes that some webmail vendors may not have implemented adequate defenses against CSS-based data leakage. As of the publication date, no specific CVEs, patches, or vendor statements have been publicly disclosed.
A recent analysis has identified 15 security bugs in TP-Link network devices that expose risks in automated zero-trust provisioning workflows. The findings, reported through Dark Reading, focus on inherent risks in automated network device onboarding rather than confirmed active exploitation in the wild.
Unitel, Angola's dominant mobile operator and government-owned telco, experienced a cyberattack causing widespread service outages on the day of its initial public offering. The incident occurred shortly before the company was set to go public, disrupting operations and raising concerns about the resilience of critical infrastructure during high-profile financial events.
Threat actors are conducting active RMM-fueled phishing campaigns as of August 2026, using diverse social engineering lures and rotating payloads to deliver ScreenConnect and establish persistent remote access to compromised networks. The campaign targets global victims via email and web lures, with reported potential for data exfiltration, lateral movement, and ransomware deployment. Specific threat actor attribution and victim counts remain unverified.
CISA has published an advisory (ICSMA-26-218-01) detailing CVE-2026-17264, a heap out-of-bounds write vulnerability in Medixant RadiAnt DICOM versions 2025.2 and earlier. Successful exploitation requires a user to open a maliciously crafted DICOM file containing JPEG-compressed pixel data, potentially leading to application crash or remote code execution. The vendor has released version 2026.1 to address the issue. No public exploitation has been reported.
.jpg?width=720&quality=80&disable=upscale)
_Ivelin_Radkov_Alamy.png?width=720&quality=80&disable=upscale)