Latest Cybersecurity News, page 8

CCISA Advisoriesinvulnerability·Sep 26critical

Siemens Siveillance Control Critical Vulnerability: Arbitrary File Upload Leads to Root Access

Siemens has identified a critical vulnerability in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro. Tracked as CVE-2026-50093, the flaw permits unrestricted file upload (CWE-434), enabling an attacker to upload arbitrary files and gain unauthorized root-level access on the OIS server. The vulnerability carries a CVSS v3.1 base score of 9.0 (CRITICAL). Affected versions include Siveillance Control Pro V3.0 before 3.0.12.2173, Siveillance Control Pro V4.0 before 4.0.9.2178, Siveillance Control V3.0 before 3.0.22.2177, and Siveillance Control V4.0 before 4.0.11.2177. Siemens has released vendor fixes and recommends updating to the latest patched versions. CISA has added the vulnerability to its ICS advisories and issued defensive guidance to minimize exploitation risk.

12m

TThe Hacker NewsinSecurity Research·Sep 26info

XRanges Introduces Standardized Benchmark for Autonomous Security Agent Vulnerability Detection

Researchers have unveiled XRanges, a tool designed to provide standardized metrics for assessing autonomous security agents' ability to find vulnerabilities. The framework addresses the current lack of reliable measurement methodologies in the field, where agent-generated reports often contain confident prose without verifiable findings. Early evaluation suggests the tool can help distinguish real security issues from agent hallucinations.

11m

DDark readinginThreat Intelligence·Sep 26high

AI Chatbot Manipulation Campaign Targets Users via Disinformation and Phishing

Security researchers have identified a coordinated campaign in which attackers are manipulating responses from major generative AI platforms, including ChatGPT, Gemini, and Google AI Overview. The operation involves seeding the web with malicious links and data, then optimizing content to influence AI outputs. The goal appears to be amplifying disinformation and directing users to phishing sites designed to harvest credentials.

11m

BBleepingComputerinVulnerability·Sep 26info

Microsoft resolves File History backup failure following September 2026 security updates

Microsoft has issued a fix for an issue that rendered the Windows File History backup feature inoperable on certain systems after the September 2026 security updates were applied. The resolution is delivered via cumulative updates and does not address a security vulnerability.

11m

CCISA AdvisoriesinVulnerability·Sep 26high

Multiple Critical Vulnerabilities Discovered in Botslab G980H Dashcam Firmware

CISA has issued an industrial control systems advisory warning of 13 vulnerabilities in Botslab G980H Dashcam firmware. The flaws span authorization, session management, predictable identifier generation, and path traversal, with CVSS scores up to 8.8. Exploitation could allow unauthenticated attackers with adjacent network access to bypass authentication, access privileged functionality, exfiltrate data, and disrupt device operation. No official patch has been confirmed from the vendor.

11m

TThe Hacker Newsinmalware·Sep 26high

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

Manifold Security researcher Ax Sharma has reported that the domain third-party[.]com, frequently used as a generic documentation placeholder across software projects, is being exploited by threat actors. The domain serves a ClickFix social engineering lure specifically to Windows browser users, while displaying a harmless decoy to other visitors. The domain's widespread use in approximately 1,700+ repositories has increased the likelihood of encounter by developers and researchers. No software patch is available for the domain itself; mitigation focuses on user awareness of ClickFix tactics.

11m

CCISA AdvisoriesinVulnerability·Sep 26critical

Critical Vulnerabilities Affect Eufy Robot Vacuum Firmware

CISA has issued advisory ICSA-26-267-02 detailing multiple security vulnerabilities in Eufy Omni C20 and Omni X10 Pro robot vacuums. The flaws, affecting firmware versions below 1.6.4, include an unauthenticated command injection vulnerability, hard-coded credentials enabling credential exposure, and improper certificate validation susceptible to man-in-the-middle attacks. Eufy recommends upgrading to firmware 1.6.4 or later to mitigate the risks.

12m

TThe Hacker NewsinCyber Attacks·Sep 26medium

Weekly Cybersecurity Threat Landscape: AI Search Poisoning, Coding Tool Leaks, and One-Click Code Execution Risks

During the week of September 24, 2026, cybersecurity researchers and vendors reported a cluster of threats leveraging trusted digital pathways. These include AI search results being manipulated to deliver malicious content, AI coding assistants potentially exposing private repository data, and vulnerabilities enabling one-click code execution through seemingly benign interfaces. The common thread involves attackers compromising systems through channels users typically trust, such as search engines, update mechanisms, and development tools.

11m

TThe Hacker NewsinMalware·Sep 25high

Malicious npm Package 'indexed-btree' Disguised as Legitimate Utility

Researchers from Checkmarx have identified a malicious npm package named 'indexed-btree' that impersonated the legitimate 'sorted-btree' package. The threat actor concealed malicious loader code within runtime application logic rather than using traditional npm lifecycle scripts, suggesting a tactical shift to evade security controls. The package has since been removed from the npm registry.

11m

TThe Hacker NewsinCyber Attacks·Sep 25high

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Proofpoint researchers have detailed an active cyberespionage campaign tracked as UNK_CondorFiltration (also referred to as TeamFiltration) that targeted over 5,700 Microsoft 365 accounts across 28 tenants. The operation primarily targeted Chilean retail and financial institutions and leveraged default passwords to gain initial access to seven accounts. The campaign originated from 1,487 unique AWS EC2 source IP addresses.

11m

BBleepingComputerinCyber Attacks·Sep 25critical

CISA Warns of Active Exploitation of JetBrains TeamCity Flaw by Ransomware Gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive warning that ransomware gangs are actively exploiting a critical vulnerability in JetBrains TeamCity. The flaw, tracked as CVE-2024-27198, was patched by JetBrains in July 2024, but threat actors have begun leveraging the vulnerability despite the available fix. CISA's alert urges federal agencies to apply the patch immediately or disconnect affected systems to mitigate the risk of ransomware deployment and unauthorized access.

11m

BBleepingComputerinCyber Attacks·Sep 25high

Exposed GitLab Project Email Addresses Enable Unauthorized Code Pushes

A report from BleepingComputer details how private GitLab project email addresses, intended for issue and task submission, are being exposed in README files, contributing guides, and support pages. This exposure allows attackers to send specially crafted emails that trigger unauthorized code pushes to private projects, bypassing intended access controls. The issue stems from project visibility settings and owner configurations rather than a core GitLab vulnerability.

12m

TThe Hacker Newsinvulnerability·Sep 25high

Unpatched OnePlus Vulnerabilities Enable Root Access via Malicious Installed Apps

A researcher has demonstrated that two chained vulnerabilities in OnePlus's OxygenOS allow a malicious application installed on a OnePlus 15 to gain root privileges without requesting any special permissions. OnePlus has confirmed the same flaws affect many of its own devices and OPPO smartphones, though no patches have been released as of the report date.

11m

BBleepingComputerinMalware·Sep 25high

New Carbonato Malware Targets Exposed Docker Daemons to Deploy Hermes Agent AI Framework

Security researchers have identified a new botnet malware strain, Carbonato, which targets Docker hosts exposed to the network without authentication. The malware is designed to install the Hermes Agent AI framework on compromised systems, potentially leveraging them for AI workloads or further malicious operations. The report indicates that attackers are scanning the internet for insecure Docker daemon configurations to exploit.

11m

BBleepingComputerinMalware·Sep 25high

MacSync Malware Exploits Public iCloud Calendars to Deliver Native Payloads on macOS

Security researchers have identified a new variant of the MacSync malware targeting macOS systems that uses public iCloud calendar events as a covert mechanism to deliver and execute native malicious payloads. The attack chain leverages calendar events to trigger code execution, though specific technical details of the delivery mechanism remain limited in initial reporting.

11m

DDark readinginMalware·Sep 25high

SectopRAT Returns, Hiding Inside Legitimate Applications

Security researchers have observed a renewed campaign involving SectopRAT, a remote access Trojan that conceals itself within legitimate applications. The tactic is designed to bypass trust-based security controls that rely on software provenance and signing, prompting recommendations for behavior-based monitoring.

11m

DDark readinginApplication Security·Sep 25high

Salesbleed: Agentic AI Exploits Salesforce to Smuggle Phishing Instructions into Slack

Security researchers have identified a vulnerability in Salesforce Agentic AI integrations that allows arbitrary web instructions to be smuggled across application boundaries into trusted Slack communications channels. The flaw enables threat actors to craft phishing messages that appear to originate from internal sources, potentially leading to credential theft and data exfiltration.

12m

TThe Hacker NewsinCVE·Sep 25critical

Active Exploitation of Critical WordPress Vulnerability CVE-2026-87902 Reported Within Hours of Disclosure

Security researchers and threat intelligence sources report that active exploitation of CVE-2026-87902 has been observed in the wild within hours of the vulnerability's public disclosure. The flaw, rated CVSS 9.2, affects WordPress core and could allow unauthenticated attackers to include arbitrary local .php files via page-template resolution, potentially leading to remote code execution. WordPress version 6.6.2 contains the fix; administrators are advised to update immediately.

11m

TThe Hacker NewsinMalware·Sep 25high

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors compromised legitimate MemTensor packages on the npm and Python Package Index (PyPI) repositories, injecting a platform-specific Go-based implant dubbed 'sckit'. The malware functions as a credential stealer targeting users across Windows, Linux, and macOS operating systems. Security researchers from Aikido, SafeDep, Socket, and StepSecurity identified the compromise, which leverages the trust associated with popular machine learning package names.

11m

BBleepingComputerinCyber Attacks·Sep 25high

InfraTrust Report Warns of Active Exploitation of Network Management Systems

A recent report from security research organization InfraTrust highlights a growing trend of attackers targeting network management systems that control enterprise infrastructure. The findings indicate that critical vulnerabilities in these platforms are being actively exploited in the wild before or shortly after vendors disclose them, posing significant risk to global enterprise networks.

11m

TThe Hacker NewsinMalware·Sep 25medium

Cisco Talos Analyzes Novel Windows Malware CLOSEDQUORUM with AI Model Voting Mechanism

Cisco Talos researchers have analyzed a new Windows malware strain designated CLOSEDQUORUM. The malware is designed to route malicious actions through a voting mechanism involving up to four AI models rather than a traditional attacker-controlled command-and-control server. Reported capabilities include the theft of Windows credentials, saved browser passwords, and cryptocurrency wallet data. Talos has not observed the full attack chain functioning end-to-end, and the public version of the malware does not operate as intended.

11m

BBleepingComputerinVulnerability·Sep 25critical

Hackers start exploiting critical WordPress flaw for code execution

Security researchers report that threat actors are actively exploiting a critical vulnerability in WordPress to achieve remote code execution. The flaw allows attackers to write arbitrary files to the server's disk, which can then be executed to run shell commands. Exploitation marks a shift from earlier probing activity to active weaponization. The vulnerability affects widely deployed WordPress installations, raising concerns about widespread compromise if not patched promptly.

11m

TThe Hacker NewsinCyber Attacks·Sep 25high

SideCopy Expands Spear-Phishing Campaigns to Target Indian Academic Institutions with ReverseRAT

The SideCopy threat actor has broadened its operations to target academic institutions in India via spear-phishing campaigns. The attacks abuse mshta.exe to execute malicious scripts and deliver ReverseRAT, marking a strategic expansion beyond previous government entity focus.

11m

TThe Hacker NewsinSecurity Advisories·Sep 25info

DORA Year Two Assessment: SOC Visibility Gaps Expose EU Financial Sector to Undetected Cyber Risks

The Digital Operational Resilience Act (DORA) entered its second year of enforcement in January 2026, transitioning financial entities from administrative compliance tasks to operational resilience requirements. A key focus of Year Two is whether SOCs possess the visibility needed to detect and respond to cyber attacks in real time, rather than merely documenting governance frameworks and third-party risk assessments completed in Year One.

11m