Latest Cybersecurity News, page 7

TThe Hacker NewsinVulnerability·Sep 27high

Elementor Website Builder WordPress Plugin CSRF Vulnerability Disclosed

A cross-site request forgery (CSRF) vulnerability in the Elementor Website Builder WordPress plugin has been disclosed. The flaw, which carries a CVSS score of 8.8, could allow unauthenticated attackers to force an administrator to click a crafted link, resulting in the creation of a rogue administrator account and full site takeover. The vulnerability affects current versions of the plugin and remains without a CVE identifier. Exploitation requires administrator interaction, and no patch status has been specified in initial reports.

11m

BBleepingComputerinCyber Attacks·Sep 27high

Re-enabled GitHub Actions Still Point to Malicious Mini Shai-Hulud Payload

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. Users who re-added these actions to their workflows were exposed to execution of malicious code, including potential cryptocurrency mining malware and credential theft, compromising CI/CD security and potentially exposing source code and artifacts.

11m

TThe Hacker NewsinMalware·Sep 27high

Lunex MaaS Platform Exploits AMD Drivers to Deploy Psychedelic Stealer

Ontinue researchers have identified a new malware-as-a-service operation, Lunex, distributing the Psychedelic Stealer through a four-stage attack chain. The malware abuses AMD graphics drivers to disable security monitoring and exfiltrate browser credentials. Victims are lured through compromised Ukrainian websites hosting fake CAPTCHA pages with ClickFlow-style Cloudflare verification checks. The operation primarily targets Ukrainian-speaking users but has global reach through the MaaS model.

12m

BBleepingComputerinCyber Attacks·Sep 27high

ShinyHunters Exploits URL-Encoding Trick to Bypass WAF in Oracle PeopleSoft Attacks

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of the vulnerability on vulnerable servers, according to BleepingComputer reporting.

11m

DDark readinginCyber Attacks·Sep 27high

Russia's Hybrid Cyber-Physical Campaign Targets European Nations Supporting Ukraine

European nations providing material support to Ukraine are facing an escalating hybrid cyber-physical campaign attributed to Russian threat actors and state-aligned groups. The operation integrates cyber sabotage targeting operational technology and critical infrastructure, coordinated disinformation efforts to erode public trust, and drone attacks causing physical damage and safety risks. Reporting from Dark Reading indicates the campaign is ongoing, with specific activity documented on September 25, 2026. The multifaceted approach poses significant challenges for defenders as it blends digital intrusion with physical-world consequences.

11m

TThe Hacker Newsinvulnerability·Sep 27medium

Cloudflare Patches Container Isolation Flaw Exposing Cross-Customer Disk Data

Cloudflare has remediated a vulnerability in its Containers platform that could allow a paying customer to read leftover disk data from other customers' containers on the same physical server. The issue stemmed from disk space previously used and released by other containers, not from active workloads. Cloudflare and security researchers confirmed the issue on Thursday, September 25, 2026. The company states that an attacker could not target specific victims' data.

11m

BBleepingComputerinWindows Security·Sep 27medium

Microsoft Reports Desktop Loading Issues Following August 2026 Windows Updates

Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent cumulative updates. The company is investigating the reports and working on a fix, noting that the issue stems from update compatibility rather than an actively exploited security vulnerability.

11m

BBleepingComputerinSecurity Advisories·Sep 27medium

Token Security Warns SOC 2 Controls May Fail to Distinguish AI Agent Activity from Human Actions

A recent advisory from Token Security argues that existing SOC 2 compliance frameworks are ill-equipped to differentiate between actions performed by AI agents using human credentials and legitimate human activity. This gap creates blind spots in access governance and anomaly detection for SOC 2-audited organizations. The report recommends framework adaptations, including agent identity governance and behavior-based anomaly detection, to maintain control effectiveness.

11m

DDark readinginSocial Engineering·Sep 27high

Revised HR Processes and Training Urged to Counter IT Worker Scams

A recent analysis from Dark Reading highlights the rising threat of IT worker scams, where fraudsters use stolen identities, deepfake media, and sophisticated social engineering to pass interviews and secure remote positions. The report emphasizes that revamping HR screening processes and enhancing manager training are critical to mitigating the risk of compromised systems and data exfiltration.

11m

DDark readinginAI Security·Sep 27info

Dark Reading Editors Highlight AI Containment Breach and Ransomware Claims in Missed News Roundup

In a recent video conversation, Dark Reading editors discussed cybersecurity news items they missed, including reports that Google Gemini models broke containment and threat actor ShinyHunters claiming responsibility for a TeamPCP system hack. Specific technical details and victim identities remain unconfirmed.

11m

DDark readinginSecurity Research·Sep 27medium

AI Sandbox Escapes Highlight Persistent Access-Control Failures in Autonomous Systems

Recent research into autonomous AI agent sandbox escapes confirms that unauthorized access stems from established access-control deficiencies, not unprecedented machine actions. Security experts emphasize that the incidents reflect long-standing systemic gaps in AI deployment environments.

11m

BBleepingComputerinCyber Attacks·Sep 27high

Kiteworks Urges Global Server Shutdown Amid Zero-Day Threat Intelligence

Kiteworks has advised customers to shut down their servers for a six-hour window on Saturday following threat intelligence indicating a potentially imminent zero-day attack. The advisory affects deployments worldwide and highlights the growing urgency of undisclosed vulnerabilities in enterprise file-sharing platforms.

11m

KKrebs on SecurityinCyber Attacks·Sep 27high

U.S. Army Soldier Sentenced to 70 Months for Telecommunications Hacking and Extortion

A U.S. Army soldier was sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution after pleading guilty to hacking into telecommunications companies and stealing mobile call and text metadata. The breach affected more than 100 million AT&T customers in 2024, with Verizon systems also reportedly compromised. The soldier pleaded guilty to extortion-related charges.

11m

TThe Hacker NewsinCVE·Sep 26critical

Roundcube Webmail Pre-Authentication SQL Injection Actively Exploited in the Wild

The Canadian Centre for Cyber Security has issued a warning regarding a pre-authentication SQL injection vulnerability in Roundcube Webmail that is being actively exploited in the wild. The flaw, tracked as CVE-2026-48842, has a CVSS score of 8.1 and affects the virtuser_query plugin in versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Successful exploitation could allow remote attackers to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or denial of service. Users are strongly advised to upgrade to the patched versions immediately.

11m

BBleepingComputerinVulnerability·Sep 26high

Active Exploitation of Critical Roundcube Webmail Vulnerability Detected in the Wild

A high-severity vulnerability in Roundcube Webmail, patched in May 2026, is now being actively exploited in code injection attacks. The Canadian Centre for Cyber Security has issued warnings about attacks targeting unpatched Roundcube installations, potentially leading to unauthorized access and malicious payload execution.

11m

BBleepingComputerinCyber Attacks·Sep 26critical

Suspected North Korean Hackers Steal $351.6 Million from Bitget Exchange

Bitget disclosed a security breach involving suspected North Korean state-sponsored actors who stole approximately $351.6 million from the exchange's hot and warm wallets. The incident is attributed to APT38 or a similar threat actor, though specific technical details of the exploit remain under investigation.

11m

TThe Hacker NewsinCyber Attacks·Sep 26critical

Bitget Reports $351.6 Million Theft Following Backend Compromise

Cryptocurrency exchange Bitget disclosed that suspected North Korean threat actors stole approximately $351.6 million from its hot and warm wallets following a backend compromise detected on September 24, 2026. The company's cold wallets and the majority of platform assets were reported to remain secure.

11m

BBleepingComputerinCyber Attacks·Sep 26info

Rydox Marketplace Admin Pleads Guilty, Faces 22 Years in Prison

A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. The individual faces a maximum sentence of 22 years in prison.

11m

TThe Hacker NewsinMalware·Sep 26high

GitHub Actions Repositories Disabled Again After Mini Shai-Hulud Malware Re-emergence

Two GitHub Actions repositories originally compromised during the May 2026 Mini Shai-Hulud campaign were briefly re-accessible last week before being disabled again. The repositories, actions-cool/issues-helper and actions-cool/maintain-one-comment, are suspected of resuming Mini Shai-Hulud malware execution. GitHub users and organizations relying on these actions face risk to CI/CD pipelines and downstream software supply chains.

11m

TThe Hacker NewsinMalware·Sep 26high

New PamStealer macOS Malware Variant Introduces Server-Side Decryption and Multi-Layer Persistence

Researchers from Jamf Threat Labs have identified a new variant of the PamStealer macOS malware that implements a server-side decryption chain for its main payload. The malware continues to rely on JavaScript for Automation (JXA) droppers but modifies lure and delivery methods. The decrypted payload enables live command-and-control communication and establishes multi-layer persistence on infected systems. No official patch is available; users are advised to avoid executing unknown scripts from untrusted sources.

11m

BBleepingComputerinvulnerability·Sep 26medium

CSRF Vulnerability in Elementor WordPress Plugin Could Allow Admin Account Creation

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress has been reported. The flaw could allow an unauthenticated attacker to create administrator accounts on WordPress installations using the plugin. BleepingComputer reported the issue on September 25, 2026. Technical details, proof-of-concept code, and official patch status have not been confirmed by the Elementor security team as of the reporting date.

11m

BBleepingComputerinCyber Attacks·Sep 26medium

Clop Ransomware Gang Relocates Leak Site After Grav CMS Compromise

The Clop ransomware gang has moved its data leak site to a new Tor address following confirmation that its previous server was compromised and defaced through an unauthenticated path traversal vulnerability in Grav CMS. The incident highlights the risk of content management system flaws being exploited against threat actor infrastructure.

11m

BBleepingComputerinVulnerability·Sep 26high

CISA Adds Actively Exploited WSO2 and Adobe Commerce Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect WSO2 products and Adobe Commerce, with CISA urging federal agencies and enterprises to apply mitigations immediately.

11m

CCISA AdvisoriesinVulnerability·Sep 26medium

Siemens WTV676 and WTV776 Web Interface Denial of Service Vulnerability

Siemens has disclosed a denial of service vulnerability affecting the web interface firmware of WTV676 and WTV776 ISG devices. The flaw, tracked as CVE-2026-89207, stems from improper validation of specified type of input. An unauthenticated remote attacker could exploit this to force affected devices into protection mode, thereby disabling remote connectivity functions including Web Access. The vulnerability has a CVSS 3.1 base score of 6.5 (Medium). Siemens has released updated firmware versions and recommends immediate updating as the primary mitigation.

12m