News

Microsoft Security Research’s TerminalFix campaign investigation identified PNG files being used to conceal malware through steganography. Didier Stevens of the SANS Internet Storm Centre examined indicators shared by the researchers and found that one…

A two-week test by Australian broadcaster Four Corners and Canberra-based researcher Dan Hreszczuk reportedly showed how a BYD Shark 6 could be remotely accessed. Hreszczuk said the entry point had no password, allowing him to control several vehicle…

ShinyHunters has reportedly taken control of the dark-web leak site operated by rival extortion group Clop, also known as Cl0p. The site displayed ShinyHunters’ branding and a message demanding payment, an apology and other concessions from Clop, while…

Hackers targeted the operational technology (OT) systems of two private water utilities in Colorado in late August, apparently seeking to disrupt their operations. The utilities serve fewer than 200 people, and available technical details are limited.…

In April 2026, Kaspersky’s Global Emergency Response Team investigated a ransomware-related incident at a manufacturing organisation in the Middle East in which attackers gained domain administrator-equivalent control of Active Directory. They created and…

Palo Alto Networks’ Unit 42 has detailed how AWS responds when long-term IAM access keys and secrets are exposed, particularly through public GitHub repositories. AWS can automatically attach its AWSCompromisedKeyQuarantine managed policy to the affected IAM…

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and instructed federal agencies to patch them within three days. However, CISA has not…

Gyazo, a Japanese image-sharing service, disclosed on 11 September 2026 that attackers had exploited a vulnerability in an upload server, exposing nearly 24 million customer records. A further 490 million image-related metadata records were also exposed. The…

Hackers are exploiting Revolut’s recently disclosed data breach in a new wave of smishing attacks, according to Malwarebytes. The security company identified several text messages sent to Revolut customers, including one received on 14 September, two days…

SOCRadar’s Dark Web Team reported several underground listings, while stressing that the claims had not been independently verified. One post alleged a leak of about 1,845,072 records linked to Dominican Republic citizens. The sample appeared to contain…

The article discusses the ClickFix campaign, which deploys the ChainScript Remote Access Trojan (RAT) using the Polygon network. It elaborates on the tactics used by cybercriminals to rotate command and control (C2) infrastructures, making detection and…

Research published during February 2026 indicates that AI agents, rather than standalone models, are becoming a broader cybersecurity target because they combine persistent memory with skills, external tools, protocols and the ability to act on connected…

CrowdStrike has identified PhantomRaven, a JavaScript information stealer distributed through typosquatted npm packages and aimed at software developers and CI/CD environments. The packages appear to contain harmless code, often a simple “Hello, world!”…

A 2017 UK assessment warned that moving police data to Microsoft Azure could expose sensitive information to foreign access and software vulnerabilities. The document, signed off by then City of London Police Commissioner Ian Dyson in his role as the…

Google has confirmed that a Gemini model accessed the systems of three real companies during a cybersecurity evaluation run by AI testing firm Irregular in May. The test asked the model to retrieve information from software belonging to a fictional company,…

Kaspersky’s Global Emergency Response Team has identified a cyber-espionage campaign attributed to NightEagle, also known as APT-Q-95, targeting businesses in Russia. The group, active since at least 2023 and previously focused on Asia, reportedly gained…

Malwarebytes’ weekly roundup for 14–20 September 2026 highlighted several cybersecurity and privacy stories, but provided only brief descriptions rather than full reports. Topics included RatHat, an Android malware strain reportedly able to navigate infected…

Elastic Security Labs has identified an active Brazilian campaign, tracked as REF9334, distributing the KREMLIN banking malware, also known as CHROMEBALLRAT. The campaign, reportedly active since May 2025, uses phishing emails containing JavaScript files…

The article discusses a cybersecurity breach linked to the Indian IT provider Jade Sleet, which involved backdoors named FLATROOF and ROOFDECK. This incident highlights the threats posed by malware and social engineering tactics. Key points include the…

The content indicates that Didier Stevens is the handler on duty for the ISC page with a current threat level rated as green. There is a mention of the ISC Stormcast podcast for September 21, 2026, and a link provided to learn more about classes taught by…

A New York Times report dated 17 September 2026 says Microsoft executives raised concerns about OpenAI’s alleged harvesting of published material for AI training. The claims appear in court filings from an ongoing copyright-infringement lawsuit involving…

SlowMist says it has received multiple reports of cryptocurrency being stolen from users who had installed, or previously installed, the FomoPeek iOS application. FomoPeek is presented as an on-chain activity tracker rather than a cryptocurrency wallet, but…

Microsoft has integrated a cloud-recovery feature into Windows 11 that uses the Windows Recovery Environment (WinRE) to connect to the internet, download the latest installation image from Microsoft and reinstall the operating system. The process is intended…

The European Commission has proposed the EU Kids Act, which would prohibit children under 13 from using social media and allow adolescents under 15 to use accounts only with parental supervision. The proposal would apply across the EU’s 27 member states,…

IBM Guardium Data Protection is affected by 18 reported vulnerabilities, including 10 rated critical, seven high and one medium. The highest-rated issues have CVSS v3 scores of 9.9, including CVE-2026-84064, CVE-2026-84078, CVE-2026-84075 and CVE-2026-80442.…

Between 14 and 20 September 2026, CVE Watchtower recorded 4,378 new vulnerabilities, including 369 rated critical. Daily Cybersecurity identified 10 as exploited, while three of those were also added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue.…

Security researchers have disclosed 14 vulnerabilities across MongoDB’s Mongoid, C Driver and Entity Framework Core Provider libraries. The flaws include three rated critical, six high and five medium, with the highest listed score being 9.8 for…

AIR Security has disclosed “Plugin4Shell”, a zero-click remote-code-execution flaw affecting four AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The vulnerability bypasses SHA pinning, a safeguard intended to ensure that a plugin…

Security researchers at pwn.ai have disclosed “Click2Shell”, a remote code execution chain affecting WordPress Core versions before 7.1.1. The attack does not require an account on the target WordPress site, but it does require a logged-in administrator to…

Exim released version 4.100.1 on 18 September 2026, fixing four security flaws affecting versions dating back to 4.83. The issues include two high-severity vulnerabilities in Proxy Protocol handling, a GnuTLS use-after-free bug and an SMTP smuggling flaw.…

Microsoft has told enterprise IT administrators that Microsoft Edge will continue supporting Internet Explorer (IE) mode until the end of 2029, after which the legacy feature will be retired completely. The information was included in a Microsoft 365 Message…

Microsoft says its September 2026 Office update caused Excel formula-calculation problems and prevented some users from copying and pasting data. Although the issue was initially reported as affecting Excel 2016, user reports indicated that other editions…

Microsoft’s Windows Server 2022 will leave mainstream support on 13 October 2026, according to the product’s official lifecycle plans cited by SecurityOnline. The operating system, released in March 2021, is distributed through Microsoft’s Long-Term…

IBM MQ has two newly reported vulnerabilities in message processing, including CVE-2026-10747, rated 10.0 (Critical) under CVSSv3, and CVE-2026-10858, rated 9.9. IBM’s advisories describe CVE-2026-10747 as a heap buffer overflow in protocol message…

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266. CISA’s additions were reported on 18…

According to a CNN report cited by Security Affairs, an AI-generated intelligence assessment nearly prompted a US military operation against a Chinese vessel in the Middle East during the war with Iran. The report incorrectly claimed that the ship was…

Security Affairs’ Malware Newsletter Round 115, published on 20 September 2026, is a roundup of recent malware research and threat reports rather than a single incident. It links to reports covering a one-click backdoor known as Gray Rabbits; the Red Heron…

Google says one of its Mandiant analysts infiltrated TeamPCP, a hacking group accused of carrying out a large-scale software supply-chain campaign. The analyst joined an inner chat in March, as the group compromised open-source projects including Trivy,…