https://krebsonsecurity.com/feed/ Events collected by UnlimitedPipe 0.3.2 UnlimitedPipe 0.3.2 Fri, 25 Sep 2026 23:10:21 +0000 https://krebsonsecurity.com/2026/09/u-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions/ 094391b406d1f02caeb8 Fri, 25 Sep 2026 21:44:40 +0000 A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims. DDoS-for-Hire Ne'er-Do-Well News Ransomware AT&T Bureau of Prisons Cameron John Wagenius Connor Riley Moucka CVE-2023-45208 Defense Criminal Investigative Service Judische Kenneth Schuchman Kiberphant0m Paul Russell Verizon https://www.bleepingcomputer.com/news/security/kiteworks-urges-6-hour-server-shutdown-over-potential-zero-day-attacks/ 01ffce2f4b7070d816e8 Fri, 25 Sep 2026 21:41:07 +0000 Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. [...] Security https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-participatory-squid-dissection-in-october-in-tennessee.html 1cf918086649b1ccb3cd Fri, 25 Sep 2026 21:08:14 +0000 I feel like someone who reads this blog will want to go to this : Families are invited to dive into the fascinating world of marine biology during an exciting, hands-on Family Squid Dissection at the Hands-On Science Center. Designed for curious learners of all ages, this unique experience combines an interactive lesson with the opportunity to explore the anatomy and adaptations of real ocean life. […] During the guided squid dissection, each family will work together to examine a squid up… Uncategorized squid https://www.bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/ de80708e5218b5f561a6 Fri, 25 Sep 2026 20:57:55 +0000 The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...] Security https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/ d26fd42694cde41a7f60 Fri, 25 Sep 2026 18:13:33 +0000 A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...] Security https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/ 921fc620f7626ce73cef Fri, 25 Sep 2026 17:24:20 +0000 The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...] Security https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-rolls-out-up-to-250-in-free-claude-code-credits-but-only-for-cloud-sessions/ da905e80e074a602e838 Fri, 25 Sep 2026 16:00:00 +0000 Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free usage credits, so more users can give it a try. [...] Artificial Intelligence Technology https://www.bleepingcomputer.com/news/artificial-intelligence/openai-is-preparing-a-500-chatgpt-pro-max-plan-with-faster-codex/ f903264c128d29e8cd18 Fri, 25 Sep 2026 14:54:33 +0000 OpenAI appears to be preparing a new ChatGPT Pro Max subscription that could cost $500 per month, but it's unclear when it'll begin rolling out. [...] Artificial Intelligence Technology https://www.bleepingcomputer.com/news/security/with-the-rise-of-ai-agents-soc-2-should-adapt-or-risk-irrelevance/ 490161c416be9bed78c2 Fri, 25 Sep 2026 14:51:10 +0000 AI agents can operate through human credentials and take actions that existing SOC 2 controls may not distinguish from human activity. Token Security explains why SOC 2 needs to adapt to address the security gaps created by agent identities. [...] Security https://thehackernews.com/2026/09/compromised-github-actions-came-back.html 942d0346b4630694e3d1 Fri, 25 Sep 2026 14:44:41 +0000 Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html b09c72148b9e7ddf20c5 Fri, 25 Sep 2026 13:18:06 +0000 Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material https://www.bleepingcomputer.com/news/microsoft/microsoft-to-deprecate-windows-deployment-services-after-windows-server-2025/ 5f5fb392e3a68a87893c Fri, 25 Sep 2026 12:40:59 +0000 Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role starting with the next Windows Server release. [...] Microsoft https://thehackernews.com/2026/09/the-soc-doesnt-need-to-start-over-with.html dc3ccce438cec1395772 Fri, 25 Sep 2026 11:30:00 +0000 Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead end used to cost hours of documentation reading, https://www.bleepingcomputer.com/news/security/rydox-marketplace-admin-pleads-guilty-faces-22-years-in-prison/ 6a56391c4f4bcd021106 Fri, 25 Sep 2026 11:35:14 +0000 A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. [...] Security https://www.schneier.com/blog/archives/2026/09/on-anthropics-ai-misuse-report.html 16c240c5bb6e798f73b7 Fri, 25 Sep 2026 11:07:22 +0000 Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs. The report describes attackers using AI to industrialize credential theft, cloud compromise… Uncategorized AI reports https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html 06f2f381d02831792c6c Fri, 25 Sep 2026 10:35:55 +0000 Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain https://www.bleepingcomputer.com/news/microsoft/microsoft-recent-windows-updates-cause-desktop-loading-issues/ 0f2c29e5269d42ec7f87 Fri, 25 Sep 2026 10:30:38 +0000 Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates. [...] Microsoft https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html d294514a142234ea3175 Fri, 25 Sep 2026 10:14:02 +0000 The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace() backslash https://www.bleepingcomputer.com/news/security/hackers-steal-3516-million-in-bitget-crypto-exchange-hack/ f43c4a6d3f37eb3b5f71 Fri, 25 Sep 2026 08:33:44 +0000 ​Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets. [...] Security CryptoCurrency https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html efa02bb8be11761df99f Fri, 25 Sep 2026 04:49:22 +0000 A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html 03885e93f49e4f3da1e8 Fri, 25 Sep 2026 04:46:34 +0000 The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/ 007eb56edb7b0dd0311f Thu, 24 Sep 2026 20:53:35 +0000 A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...] Security https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/ a5bb982d4a39aae0dcfe Thu, 24 Sep 2026 20:10:48 +0000 A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...] Security Artificial Intelligence https://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.html ac3e5f023a68b2521e3f Thu, 24 Sep 2026 18:10:18 +0000 A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html 8a262103243c6c89de4a Thu, 24 Sep 2026 17:52:43 +0000 This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts look real enough. And some attacks barely need an exploit at all — just https://www.bleepingcomputer.com/news/security/exposed-gitlab-project-email-addresses-let-attackers-push-code/ b0f87ae8633db31f7aa1 Thu, 24 Sep 2026 17:47:44 +0000 Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. [...] Security https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html e04d2b8beb8af581852c Thu, 24 Sep 2026 15:27:32 +0000 The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold Security's Head of Research, Ax Sharma, said. "Unlike 'example[.]com,' third-party[.]com https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html 11bc09d731bc9d0d7e0d Thu, 24 Sep 2026 14:29:06 +0000 An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the https://www.bleepingcomputer.com/news/security/fedramp-vdr-and-ver-daily-scans-are-only-the-beginning/ b27fe55a49d3df0ad506 Thu, 24 Sep 2026 14:02:12 +0000 FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated compliance validation. [...] Security https://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/ 3b88e89da3fa766e9bab Thu, 24 Sep 2026 13:27:57 +0000 A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...] Security https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5124010-update-released-with-46-changes-and-fixes/ 3dd60f8e552b6a534382 Thu, 24 Sep 2026 12:16:32 +0000 Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2, with 46 changes including Bluetooth improvements and the ability to remap the Copilot key. [...] Microsoft https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html 8c43dcccbaf6ef342ae7 Thu, 24 Sep 2026 12:05:27 +0000 The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.corp.mdm" Corp MDM https://www.schneier.com/blog/archives/2026/09/malicious-npm-packages-that-evade-defenses.html 08b4e83b33713ea9b0c9 Thu, 24 Sep 2026 11:07:42 +0000 This is an impressive piece of malware . Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution. Uncategorized defense malware https://thehackernews.com/2026/09/secrets-sprawl-is-identity-problem-that.html df1bbfbfd33d61d09d86 Thu, 24 Sep 2026 11:00:00 +0000 AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of human-written ones. Most of the fastest-growing categories of leaked credentials are now connected to AI https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/ eea62150121acf40cca5 Thu, 24 Sep 2026 10:42:37 +0000 ​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. [...] Security https://www.bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site-probed-data-providers/ afa45af01e2488a8125c Thu, 24 Sep 2026 09:38:53 +0000 OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project. [...] Security https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html b48ab760b2c28d3202e4 Thu, 24 Sep 2026 09:14:21 +0000 ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-backup-feature-broken-by-september-updates/ b1305cec387e13bdb884 Thu, 24 Sep 2026 08:14:47 +0000 Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates. [...] Microsoft https://thehackernews.com/2026/09/openai-agent-bypassed-australian.html 8ec85966dc1dfde35b5d Thu, 24 Sep 2026 07:07:25 +0000 An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal https://thehackernews.com/2026/09/teamfiltration-compromises-seven.html a107a9d4884ec7fcb245 Thu, 24 Sep 2026 06:32:03 +0000 Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts – https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html afad1ccbc7ca91524262 Thu, 24 Sep 2026 05:36:18 +0000 Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/ 4276ef94121eb2c0925b Wed, 23 Sep 2026 22:46:01 +0000 The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...] Security https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/ ac6b44577acbe7d11cc9 Wed, 23 Sep 2026 21:25:13 +0000 A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...] Security Mobile https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/ 53249e653028dfc44c66 Wed, 23 Sep 2026 19:53:54 +0000 Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...] Security https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/ 7efef70923bd019435cd Wed, 23 Sep 2026 18:31:22 +0000 Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...] Security https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html 6487e981f380ea069b8b Wed, 23 Sep 2026 18:06:30 +0000 Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/ https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html 8fccc478b4854bce25b3 Wed, 23 Sep 2026 16:53:10 +0000 The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/ 4b28438ee3d37b50205f Wed, 23 Sep 2026 16:20:54 +0000 A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. [...] Security Artificial Intelligence https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html e445484a96ce82cbf9e8 Wed, 23 Sep 2026 16:06:41 +0000 Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at https://www.bleepingcomputer.com/news/security/infratrust-report-warns-network-management-systems-under-attack/ 2a39455f43d36a287fac Wed, 23 Sep 2026 14:35:26 +0000 Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. [...] Security https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html b7ac3967f542bafc9e7e Wed, 23 Sep 2026 14:17:58 +0000 A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is. https://www.bleepingcomputer.com/news/security/how-one-kubernetes-yaml-can-hand-over-a-gcp-organization/ 3f68816f889c2997ee5d Wed, 23 Sep 2026 14:01:11 +0000 A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into a path to organization-wide privilege escalation. [...] Security https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html af78a5f8984243363f2f Wed, 23 Sep 2026 13:52:46 +0000 Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below - @memtensor/memos-cloud-openclaw-plugin versions https://www.bleepingcomputer.com/news/security/arista-patches-actively-exploited-velocloud-orchestrator-zero-day/ 4b34085389c96c6dbd31 Wed, 23 Sep 2026 12:29:53 +0000 Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments. [...] Security https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html bf02dfa56f671080bd99 Wed, 23 Sep 2026 12:16:00 +0000 A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts. cPanel has released fixed versions for both, https://thehackernews.com/2026/09/545-hackers-tested-it-first-now-xranges.html 2a3444963f02d3d9e38d Wed, 23 Sep 2026 11:47:19 +0000 Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good. Point one at a realistic target and what comes back is a report the agent wrote about itself: confident prose, a list of findings, and no way to tell which of them happened. Someone with a security background then sits down and checks every claim against the target. Which findings are real, https://thehackernews.com/2026/09/anthropic-and-openai-models-still.html 4448f8b46b709f030b73 Wed, 23 Sep 2026 11:47:13 +0000 Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a "major step up from Opus 5," and "achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-windows-updates-break-always-on-vpn-connections/ 302a19fdac9c84e1a8fc Wed, 23 Sep 2026 11:18:13 +0000 Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems. [...] Microsoft https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html e61546700223b6fd32b1 Wed, 23 Sep 2026 11:12:18 +0000 A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst https://www.schneier.com/blog/archives/2026/09/research-on-models-engaging-in-genie-like-behavior.html e9ec11ad2bd1d535d8e0 Wed, 23 Sep 2026 11:03:36 +0000 New paper: “ Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training .” Abstract: We discover a novel and surprising phenomenon of unintentional misalignment in reasoning language models (RLMs), which we call self-jailbreaking. Specifically, after benign reasoning training on math or code domains, RLMs will use multiple strategies to circumvent their own safety guardrails. One strategy is to introduce benign assumptions about users and… Uncategorized academic papers AI lies https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html 75bfec002e41b43e4568 Wed, 23 Sep 2026 08:29:48 +0000 Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes. https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html 4823057a9e2827d6a3ac Wed, 23 Sep 2026 08:29:24 +0000 A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html 964bb0fad8314354edef Wed, 23 Sep 2026 07:04:40 +0000 A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html 94e7966263875b1b139d Wed, 23 Sep 2026 05:30:09 +0000 The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency. "We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark https://thehackernews.com/2026/09/check-point-warns-of-management-server.html 8ab93946919efed79ae3 Tue, 22 Sep 2026 18:29:39 +0000 Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html b84f83bcee9055557c7d Tue, 22 Sep 2026 18:03:10 +0000 WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders. On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.1.2, with fixes for every branch the project still supports, back to 4.7, and WordPress is telling site owners https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html 329147ed8e239250f210 Tue, 22 Sep 2026 17:58:15 +0000 Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731." https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html 529ef66015253f417cbd Tue, 22 Sep 2026 17:03:31 +0000 Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html de161616d309dbfa7a52 Tue, 22 Sep 2026 16:41:12 +0000 A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is https://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.html 9afcf8f08cd576cf93a6 Tue, 22 Sep 2026 16:14:04 +0000 A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in https://thehackernews.com/2026/09/ai-agents-are-rewriting-rules-of.html 3c6900176cb632abb0b6 Tue, 22 Sep 2026 12:30:00 +0000 Security teams have spent decades asking whether an identity has too much access. AI agents raise a harder question: how can we determine which paths an autonomous system can discover, given the access it already has? A person may try several ways to complete a task. A deterministic application follows the flow its developer wrote. But an AI agent is relentless in its pursuit of done. In May https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html 7bbdb8f91552aa4dfe55 Tue, 22 Sep 2026 12:29:00 +0000 Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are https://thehackernews.com/2026/09/dora-year-two-can-your-soc-actually-see.html b19344643d481b00b06f Tue, 22 Sep 2026 11:45:00 +0000 When the Digital Operational Resilience Act (DORA) became enforceable across the European Union in January 2025, it triggered an administrative sprint. Financial entities spent the first year establishing risk governance, assessing third-party service providers, updating contract clauses, and documenting incident escalation workflows. Now in its second year, the harder part of DORA is https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html 92d41b697f335f81858f Tue, 22 Sep 2026 11:38:40 +0000 A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine. https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html e3d3a9c21492c1c5e667 Tue, 22 Sep 2026 11:17:41 +0000 A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition. Patches have been https://www.schneier.com/blog/archives/2026/09/gpt-6-astra-breaks-an-old-enigma-message.html 625181eff9b16c54c4bb Tue, 22 Sep 2026 11:02:45 +0000 This is pretty amazing: However, the most astonishing thing about this break is that the GPT­6 Astra did it entirely on its own. Carter Leffer only directed GPT­6 Astra to see if it could break any of the unbroken Enigma messages published on the Crypto Cellar Research web page. After analysing the unbroken messages on the website, it decided that the most promising message was Nr. 172, MVUEH and it also quickly suspected that the plaintext of Nr. 173, SIPVX, might be related to the plaintext… Uncategorized AI cryptanalysis Enigma history of cryptography https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html 63e72863f923671d257f Tue, 22 Sep 2026 09:38:18 +0000 A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. " https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html 09a12d2635d448492840 Tue, 22 Sep 2026 07:52:03 +0000 The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html 7bf4d01a51f4a4e1b3a7 Tue, 22 Sep 2026 06:33:57 +0000 Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. The flaw is in https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html 4ceed1ebe277afbf4d11 Tue, 22 Sep 2026 06:03:14 +0000 A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There is https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html c0faf96ba5b9d0106df5 Tue, 22 Sep 2026 05:31:59 +0000 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html b3f849f7d47f55c68abd Mon, 21 Sep 2026 17:31:01 +0000 A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers https://thehackernews.com/2026/09/contagious-interview-campaign.html 7a35fd84ee32e3b23102 Mon, 21 Sep 2026 17:19:00 +0000 The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency, https://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.html bc30fcacae562b31c815 Mon, 21 Sep 2026 16:57:31 +0000 Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Google's lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months. The DPC has not said publicly which https://www.schneier.com/blog/archives/2026/09/reverse-engineering-flock-cameras.html de4e9d8a5c8732d7c694 Mon, 21 Sep 2026 14:37:45 +0000 Hackers captured a Flock camera and got a look (alternate link ) at the software: While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than… Uncategorized AI cameras cars reverse engineering https://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.html 6dc0fd0aea5f691dc232 Mon, 21 Sep 2026 14:24:13 +0000 A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more findings, more automation, and not https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html 5a05ba1abbce87eebee3 Mon, 21 Sep 2026 14:15:40 +0000 Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html 53399ff6478c9eb36908 Mon, 21 Sep 2026 08:39:38 +0000 Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG) https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html d1dcc2bf07b665d7b890 Mon, 21 Sep 2026 06:06:44 +0000 The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple https://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.html b117932a335f465cd78e Sat, 19 Sep 2026 18:36:53 +0000 Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help forum and moved through a weakness in OpenAI's own login system. This was security research, https://thehackernews.com/2026/09/can-you-prove-new-cve-is-exploitable.html f26c4c2fb293d7a5300e Sat, 19 Sep 2026 13:28:48 +0000 A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The dangerous gap is no longer just technical. It is https://thehackernews.com/2026/09/identity-visibility-in-2026-foundation.html 2c08df2beb4c16e7e48f Sat, 19 Sep 2026 13:28:41 +0000 Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon's annual Data Breach Investigations Report. This article explains what identity visibility means in IAM, why cloud and multicloud environments complicate it, which capabilities matter in https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html 4e5687e6713d6ec51c9f Sat, 19 Sep 2026 09:31:17 +0000 SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior. "SolarWinds https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html 36a1d68990c919349bd3 Sat, 19 Sep 2026 08:18:54 +0000 A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote https://thehackernews.com/2026/09/google-gemini-broke-into-real-company.html dd9a4a839927a7ffd39f Sat, 19 Sep 2026 07:51:34 +0000 Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The development was first reported by The Wall Street Journal. The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular. The evaluation partner was also involved in similar hacks disclosed https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-on-squid-egg-sacs.html 22747b02e9527913f745 Fri, 18 Sep 2026 21:06:00 +0000 Short essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. Uncategorized squid https://www.schneier.com/blog/archives/2026/09/are-ais-still-struggling-with-captchas.html feaf471b74244aa2ace0 Fri, 18 Sep 2026 11:05:52 +0000 Anthropic’s recent security-incident document contains a bit about how CAPTCHAs are still frustrating Claude. In the transcript, the Claude model that is so powerful that Anthropic is gatekeeping access to it appeared to slam its virtual head against the wall solving a simple image identification test. In a test where the agent was asked to identify a shape that didn’t match the others displayed, it couldn’t even decide which image to select. Instead, it repeatedly went over the same images and… Uncategorized AI captchas games https://www.schneier.com/blog/archives/2026/09/how-candidates-could-use-ai-for-good.html 6632fd936f50aa3e5a9a Thu, 17 Sep 2026 11:06:31 +0000 This essay was written with Nathan E. Sanders, and originally appeared in The Guardian . There are plenty of signs that AI will make all of our experiences of the US midterm elections worse. Voters have anxiety about AI’s impacts on the country. Politicos are using AI deepfakes to spread lies. The White House is posting slopaganda . Meanwhile, candidates are missing a real opportunity to use AI to make campaigning better. The technology can help candidates listen more deeply to voters’… Uncategorized AI democracy LLM https://krebsonsecurity.com/2026/09/data-broker-radaris-loses-domains-in-privacy-fight/ 9391ba4081e96e6ea053 Wed, 16 Sep 2026 18:14:22 +0000 The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face of repeated stonewalling and prevarication by attorneys for Radaris, the judge… A Little Sunshine Ne'er-Do-Well News Andtop Company Atlas Data Privacy Bitseller Expert Limited Dmitry Lubarsky Gary Norden Igor Lubarsky Justin Sherman Lifetime Value Company Matt Adkisson NumberGuru OneRep PEM Law PeopleLooker PeopleSmart Radaris Radaris.com Raj Parikh Val Gurvits Victor Worms https://www.schneier.com/blog/archives/2026/09/fake-captcha-scams.html 444eac8f92204f6b3f60 Wed, 16 Sep 2026 11:25:26 +0000 New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program. Uncategorized captchas scams https://www.schneier.com/blog/archives/2026/09/25-years-of-mass-surveillance-is-enough.html 7f5c07ec9f3bbb91422d Tue, 15 Sep 2026 11:01:41 +0000 This essay was written with Cindy Cohn, and originally appeared in Lawfare . One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the internet backbone or mass collection of telephone or internet metadata. The legal and technical architecture of modern mass surveillance, initially framed as a necessary defense… Uncategorized privacy surveillance https://www.schneier.com/blog/archives/2026/09/on-the-nsas-supercomputer-from-the-1960s.html f852ff89f116646c48d8 Tue, 15 Sep 2026 10:16:24 +0000 Really interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA. Uncategorized history of computing history of cryptography IBM intelligence NSA https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/ f50c5a6002155cfff308 Tue, 08 Sep 2026 21:44:22 +0000 Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month. Latest Warnings Security Tools Time to Patch CVE-2026-69730 CVE-2026-69829 CVE-2026-81963 CVE-2026-85880 Fortra Microsoft Patch Tuesday September 2026 Satnam Narang Tenable Tyler Reguly https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ 3bcd1878e2f285789a87 Tue, 01 Sep 2026 22:40:28 +0000 A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI)… A Little Sunshine Data Breaches The Coming Storm Web Fraud 2.0 Cybera DecryptAds exploit Hertz idscan.net Jillian Kossman Larry Baldwin Nexus Planet13 Zach Edwards https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/ 73e80e597a1078089ea4 Thu, 27 Aug 2026 11:04:15 +0000 Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of… Breadcrumbs Ne'er-Do-Well News Ransomware Aikido Security BulkDMT Charlie Eriksen Constella Intelligence cybercats domaintools Ellis Epieos Express Flashpoint GitHub Intel 471 OPSEC Express pcpcats Persy_PCP Ruben Thomson ruben@securecomputing.au rubenthomson.com sheepstealing@gmail.com shitstickpp@gmail.com SpyCloud surfinup8@gmail.com TeamPCP Tensor Industries yolosolo17@gmail.com https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/ 11fa1b71ca22e60db39d Fri, 14 Aug 2026 11:24:35 +0000 It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities… A Little Sunshine Security Tools Web Fraud 2.0 AdBlock AdBlock Plus Alfa Bank Between Digital BitSight DecryptAds Fengwo Group Infoblox opera Pi-hole Raspberry Pi uBlock Origin Zach Edwards https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/ 3c7ea3016c92b7895458 Tue, 11 Aug 2026 21:28:35 +0000 Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today. Latest Warnings Security Tools Time to Patch 1Password afd.sys Automox CVE-2026-62832 CVE-2026-68820 CVE-2026-72971 Ed Skoudis Landon Miles Microsoft Patch Tuesday August 2026 Nightmare Eclipse SANS Technology Institute https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/ c51b1f4c80ab53f5cb88 Thu, 06 Aug 2026 17:00:56 +0000 A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers. Breadcrumbs Ne'er-Do-Well News Ransomware Cameron John Wagenius Connor Riley Moucka IntelSecrets IRDev John Erin Binns Judische Snowflake Waifu https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/ 5e463a5e34e75e3b3e51 Thu, 30 Jul 2026 16:49:00 +0000 Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks. A Little Sunshine Internet of Things (IoT) Latest Warnings Web Fraud 2.0 AI digital humans BitSight Bitsight TRACE Blockly Fengwo Group H96 Huawei Pedro Falé residential proxy Samsung Vivo Xiaomi Zhejiang Fengwo IoT Technology Ltd https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/ d24ca5492336d299b99a Wed, 22 Jul 2026 01:10:38 +0000 The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG's webOS store allow unknown third-parties to route their Internet traffic through a user's TV. A Little Sunshine Internet of Things (IoT) The Coming Storm Bright Data John Taylor LG Electronics USA residential proxies Samsung Spur Tizen Trevor Sutter webOS https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/ df567a66968888f1fb74 Tue, 14 Jul 2026 19:22:42 +0000 Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence. Security Tools The Coming Storm Time to Patch Action1 Active Directory Federation Services Chris Goettl CVE-2026-48561 CVE-2026-50661 CVE-2026-56155 CVE-2026-56164 Ivanti Jack Bicer Microsoft Corp. Patch Tuesday July 2026 Pavan Davuluri Satnam Narang Tenable Windows BitLocker