Latest Cybersecurity News, page 9

BBleepingComputerinCyber Attacks·Sep 25high

Placeholder Domain third-party.com Repurposed for ClickFix Attacks Targeting Windows Users

The domain third-party.com, traditionally used as a placeholder in developer documentation and code examples, has been compromised and is now serving fake Cloudflare verification pages. These pages target Windows users by prompting them to execute PowerShell commands under the guise of completing a verification process, representing a ClickFix-style social engineering attack.

11m

BBleepingComputerinCyber Attacks·Sep 25high

EvilTokens Phishing-as-a-Service Platform Disrupted by Microsoft DCU

Microsoft's Digital Crimes Unit, in coordination with law enforcement partners, has disrupted the EvilTokens Phishing-as-a-Service (PhaaS) platform. The operation compromised credentials of over 12,000 Microsoft accounts across more than 10,000 organizations. The platform facilitated credential phishing attacks targeting Microsoft accounts and enabled the theft of session tokens. No software patch is required; affected organizations are advised to rotate compromised credentials and enable multi-factor authentication.

11m

BBleepingComputerinsecurity-advisory·Sep 25info

Wazuh Publishes Guidance on Reducing Shadow IT Visibility Gaps

Wazuh has released security guidance addressing the challenges of shadow IT, emphasizing endpoint inventory, agentless monitoring, and centralized analysis as methods to identify unmanaged endpoints and unauthorized software operating outside existing security monitoring scopes. The advisory targets global organizations seeking to improve asset visibility.

11m

TThe Hacker NewsinCyber Attacks·Sep 25high

Microsoft Disrupts EvilTokens Device-Code Phishing Infrastructure

Microsoft, in coordination with Health-ISAC and industry partners including Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, and Shadowserver, disrupted the EvilTokens device-code phishing service operating under court authorization from the U.S. District Court for the Eastern District of Virginia. The service allegedly used artificial intelligence throughout its attack chain to compromise email inboxes via device-code phishing, bypassing multi-factor authentication. The operation aims to mitigate further inbox compromises estimated at over 12,000 across healthcare, finance, and technology sectors.

11m

TThe Hacker NewsinVulnerability·Sep 25critical

Critical Next.js ImageResponse Vulnerability Enables Server-Side Code Execution via SVG Injection

A critical vulnerability in the Next.js ImageResponse feature has been disclosed, potentially allowing attackers to execute arbitrary code on the server. The issue stems from improper handling of SVG input, where attacker-controlled values—such as those extracted from request URLs—are embedded into generated images. Vercel released a fix on September 22, 2026, in version 15.2.3. Users are strongly advised to update immediately.

11m

BBleepingComputerinWindows Security·Sep 25medium

Microsoft September 2026 Updates Reported to Disrupt Always On VPN Connections on Windows 11

Microsoft's September 2026 security updates for Windows 11 have been reported to break Always On VPN connections on some systems, potentially disrupting remote access for affected users. Microsoft has not yet issued an official advisory, but the issue appears to be a compatibility break rather than an exploited vulnerability.

11m

DDark readinginSecurity Advisories·Sep 25info

CISA Releases 'Deception by Design' Guide to Deploy Deception Technologies Against Cybercriminals

The Cybersecurity and Infrastructure Security Agency (CISA) has published a guide titled 'Deception by Design' that provides defensive guidance on implementing deception technologies. The advisory aims to help organizations detect, confuse, and attribute cyber threat actors by setting traps such as fake credentials, decoy files, and misconfigured services, offering a strategic approach for defenders with limited security budgets.

11m

BBleepingComputerinZero-Day·Sep 24high

Arista Networks Patches Actively Exploited Zero-Day in VeloCloud Orchestrator On-Prem

Arista Networks has released security patches to address a zero-day vulnerability that is being actively exploited in the wild. The flaw impacts VeloCloud Orchestrator (VCO) On-Prem deployments. While specific technical details regarding the CVE identifier and exploitation methodology were not disclosed in the source summary, the company confirmed that patches are now available to mitigate the risk.

21m

TThe Hacker Newsinvulnerability·Sep 24high

Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

Security researcher DepthFirst has released exploit code for CVE-2026-80521, a use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem. The flaw, patched upstream on August 6, 2026, allows unauthenticated attackers to escape container isolation and gain root-level access on the host system. Ubuntu has not yet delivered the fix to its 22.04, 24.04, and 26.04 LTS releases, leaving users exposed despite the availability of an upstream kernel patch.

11m

TThe Hacker NewsinCyber Attacks·Sep 24high

GitLab Issue Email Address Leak Enables Unauthorized Code Pushes and CI Job Execution

A security issue in GitLab has been reported where the private email addresses provided to users for filing issues via email can be exploited by attackers. By sending a specially crafted email to a user's assigned address, an attacker can cause GitLab to commit content to the user's repositories in their name, targeting any branch the user has push access to (including main). Furthermore, the attacker can trigger CI/CD pipelines that execute with the victim's permissions. The issue stems from how GitLab processes inbound email to create work items, treating the sender's address as an implicit credential.

11m

TThe Hacker NewsinMalware·Sep 24high

Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry

Security researchers have identified a campaign in which threat actors uploaded malicious Terraform providers and Go modules to the HashiCorp provider registry and Go module proxy, respectively. The actors leveraged these trusted channels to distribute Go-based malware targeting container environments and orchestration platforms. This marks the first observed use of the HashiCorp registry as a distribution vector for malicious payloads, exploiting the trust users place in officially indexed providers and modules.

11m

DDark readinginApplication Security·Sep 24medium

GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks

A security concern has been identified in the GitLab platform where incoming email addresses automatically assigned to users contain highly privileged access tokens. These tokens could potentially be leveraged by attackers to execute supply chain attacks, compromising software projects and downstream users hosted on GitLab instances.

11m

DDark readinginMalware·Sep 24high

EDR Evasion Stack Helps Process Injection Slip Past Defenses

A process parameter-poisoning technique has been identified that evades Endpoint Detection and Response (EDR) solutions by injecting code into process initialization structures without leveraging the Windows APIs typically monitored by security tools. The method allows code injection to occur during process creation, bypassing alerts associated with APIs such as CreateRemoteThread and WriteProcessMemory.

11m

BBleepingComputerinMalware·Sep 24high

New RemControl Android Banking MaaS Targets Users in Europe and Canada

Security researchers have identified a new Android malware-as-a-service platform named RemControl being used in malvertising campaigns that impersonate the TVTap IPTV application. The campaigns target users in Europe and Canada, aiming to steal financial information and credentials.

11m

TThe Hacker NewsinCVE·Sep 24critical

F5 Patches Actively Exploited Zero-Day in BIG-IP APM OAuth Server

F5 has released engineering hotfixes for CVE-2026-94127, a critical vulnerability in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution when APM functions as an OAuth authorization server. The flaw was disclosed on September 22, 2026, and is reported to be actively exploited in the wild. Systems where APM issues access tokens to applications are affected; configurations not using APM as an OAuth server are not at risk.

11m

CCISA AdvisoriesinSecurity Advisories·Sep 24high

FBI and CISA Issue Guidance on Third-Party ICS Integrator Risks to Critical Infrastructure

The FBI and CISA have published a fact sheet warning critical infrastructure operators about the risks of granting third-party industrial control system integrators excessive access. The guidance highlights concerns including the principle of least privilege, supply chain vulnerabilities, and geopolitical risks associated with foreign-owned integrators. A key case study involves malicious foreign cyber actors accessing the network of a U.S. industrial automation solutions company between March and April 2025, where they searched for SCADA-related terms and compiled approximately 800 files containing customer data for potential exfiltration.

13m

BBleepingComputerinCVE·Sep 24high

Check Point Reports Active Exploitation of CVE-2026-85102 in Security Gateway VPN

Check Point researchers have confirmed that threat actors are actively exploiting CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of Security Gateway products. Exploitation does not require authentication, and the vendor has not disclosed full technical details in the available summary.

11m

TThe Hacker NewsinZero-Day·Sep 24high

BigDiskBuster Zero-Day PoC Published, Blocks Microsoft Defender Updates

A zero-day proof-of-concept tool named BigDiskBuster was published on GitHub on September 19, 2026. Created by former Microsoft security researcher Abdelhamid Naceri, the tool exploits a design limitation in Microsoft Defender's update mechanism by filling all available disk space, thereby blocking the installation of critical platform and signature updates. No CVE, patch, or Microsoft advisory has been issued at the time of disclosure.

11m

DDark readinginCyber Attacks·Sep 24high

CrowdSec GitHub Compromise via Former Employee OAuth Token

CrowdSec confirmed that threat actors gained unauthorized access to 170 private repositories on GitHub by leveraging an OAuth token stolen from a former employee's personal computer. The attack vector involved a supply chain compromise of the TanStack npm package, which was used to facilitate access to the GitHub resources. The incident was first reported by Dark Reading on September 22, 2026. CrowdSec has indicated that the compromised OAuth tokens have been revoked and additional access controls may have been implemented, though specific technical details of the supply chain mechanism remain limited in the public report.

11m

BBleepingComputerinMalware·Sep 24medium

New ClosedQuorum Windows Malware Leverages AI Models for Post-Compromise Decisions

A newly identified Windows malware strain, ClosedQuorum, has been reported to integrate multiple large language models—including Google Gemini, DeepSeek, Qwen, and Mistral—to autonomously determine actions during the post-compromise phase of cyber attacks. Reported by BleepingComputer on September 22, 2026, the malware represents a convergence of AI capabilities and traditional threat infrastructure. The specific distribution method and technical verification of AI model integration remain unconfirmed, but the report highlights a potential evolution in malware adaptability and decision-making autonomy.

11m

TThe Hacker NewsinVulnerability·Sep 24critical

WordPress Patches Critical Vulnerability Allowing Unauthenticated Remote Code Execution

WordPress has released version 7.1.2 to address a critical security vulnerability that allows unauthenticated attackers to load arbitrary PHP files from outside the theme folders. On certain server configurations, this flaw can be leveraged to achieve full remote code execution. The update patches all supported branches back to version 4.7 and has been added to CISA's Known Exploited Vulnerabilities catalog.

11m

DDark readinginPhishing·Sep 24high

Microsoft Disrupts EvilTokens Device Code Phishing Service

Microsoft, in coordination with international law enforcement, seized 50 websites and disabled over 150 domains associated with the EvilTokens phishing-as-a-service platform. The operation disrupted a campaign that abused the Microsoft 365 device code authentication flow to steal credentials and session tokens from enterprise accounts.

11m

BBleepingComputerinCyber Attacks·Sep 24high

Chinese-speaking threat actor exploits ZyXEL and WordPress vulnerabilities to exfiltrate government data

A Chinese-speaking threat actor has been exploiting known vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress platforms to steal sensitive data from 996 devices and over 18,500 records stored in backend databases. The campaign leverages multiple technologies to gain initial access and exfiltrate information from government targets.

11m

CCISA AdvisoriesinCVE·Sep 23high

Siemens Desigo CC Family Client Code Execution Vulnerability (CVE-2026-34223)

A Client Code Execution (CCE) vulnerability has been identified in Siemens Desigo CC family products V6 and V7. The flaw stems from insufficient input validation when handling scripts embedded within user-defined graphics documents. Successful exploitation could allow an attacker to execute arbitrary code on client devices, write arbitrary files to the operating system, and facilitate lateral movement within the organization. The vulnerability carries a CVSS 3.1 base score of 8.2 (HIGH) and has been assigned CVE-2026-34223. No patch is currently available; mitigation focuses on authorization policy review and network exposure reduction.

12m