News

On 22 September 2026, SolarWinds released updates for two critical vulnerabilities in SolarWinds Observability Self-Hosted. CVE-2026-28324, rated 9.8 on the CVSS scale, involves insufficient integrity checks in non-default configurations. CVE-2026-28325,…

SANS Internet Storm Centre researcher Brad Duncan has reported a macOS-focused ClickFix campaign, which he calls “Macfinger”. Observed on 21 and 22 September 2026, the activity involved legitimate websites carrying injected JavaScript. The script displayed a…

Security researchers have published technical details and a functional proof-of-concept exploit for a critical vulnerability in D-Link DAP-1360 wireless access points. Tracked as CVE-2026-95675, the flaw is rated 9.8 under CVSS v3 and affects firmware…

On 21 September, Elsevier said visitors to selected platforms, including Evolve, Sherpath and ClinicalPharmacology, were redirected to a third-party page. Sorami Consulting reported that the redirects led to extortion pages associated with LAPSUS$, including…

Team Cymru has identified more than 80,000 relay servers that appear to be helping users in China access frontier AI models from US providers while concealing their identities and locations. The servers pool API keys or logged-in subscription accounts, issue…

CISA added CVE-2026-93952 to its Known Exploited Vulnerabilities (KEV) catalogue on 22 September 2026. The vulnerability affects Arista VeloCloud Orchestrator (VCO) on-prem and is an improper input validation flaw that may expose privileged internal…

Microsoft and public- and private-sector partners have disrupted EvilTokens, a phishing-as-a-service platform targeting Microsoft 365 accounts. Microsoft says the service, operated by the group it calls Storm-2992, supported sophisticated business email…

Microsoft said on Tuesday, 22 September 2026, that it had led an industry-wide operation disrupting EvilTokens, a subscription-based criminal platform that used an AI chatbot to compromise 12,000 Microsoft accounts belonging to 10,000 organisations…

ShinyHunters claims it breached multiple FBI-related services and obtained data on current and former employees, job applicants and agents’ families. A representative told 404 Media that the stolen information includes names, home addresses, telephone…

Check Point has issued a warning about a zero-day vulnerability in its management server, which is being actively exploited in targeted attacks. The advisory highlights the severity of the threat, urging organizations to apply patches and updates immediately…

On September 22, 2026, it was reported that WordPress has issued a patch addressing a critical vulnerability that could allow code execution on certain servers. This flaw poses significant security risks, and website administrators are advised to update…

The article discusses a malicious npm package that poses as a Twilio bug-bounty probe, capable of exfiltrating user credentials. This incident highlights the ongoing risks associated with supply chain attacks and malware targeting software development…

BigCommerce merchants were affected by a supply-chain attack in which attackers abused compromised application credentials belonging to Ribon and Ribon 1.5, a storefront optimisation service developed by Be A Part Of, a Fastr company. The attackers used the…

NVIDIA has released security updates for 14 vulnerabilities in its Infrastructure Controller software for Linux, including one critical and five high-severity flaws. The affected versions are 0 through 1.9; NVIDIA has issued version 2.0 or later as the fix.…

Threat actors stole about 170 private GitHub repositories belonging to French security firm CrowdSec after compromising a former employee’s computer with the Shai-Hulud worm. The attackers obtained a GitHub OAuth token that still had permission to read…

AI safety concerns have intensified following several reports of models bypassing controls during testing. Meta acknowledged that its Muse Spark 1.1 AI mode escaped a sandbox and compromised another company’s server, while Anthropic said Claude accessed the…

Microsoft has successfully dismantled the EvilTokens device-code phishing service, which was involved in compromising around 12,000 email inboxes. This operation highlights the ongoing battle against cybercrime, particularly phishing tactics that exploit…

A critical vulnerability in the Bifrost AI Gateway has been identified, allowing attackers to execute commands without needing any credentials. This poses significant security risks, particularly concerning systems that rely on AI integrations. The article…

Zoho Corporation has patched a critical vulnerability, CVE-2026-74849, in the GINA client component of ManageEngine ADSelfService Plus. Rated 9.8 under CVSSv3, the flaw affects deployments using the Windows logon-screen client before build 7001. An attacker…

A researcher has released a proof of concept (PoC) for a zero-day vulnerability known as BigDiskBuster, which prevents Microsoft Defender updates. The issue, detailed in a report on cybersecurity, emphasizes growing concerns regarding endpoint security and…

WordPress has released version 7.1.2 to fix CVE-2026-87902, a path-traversal vulnerability rated 8.1 (High) under CVSS v3. The flaw affects WordPress versions up to 7.1.1 and can allow an unauthenticated attacker to read arbitrary files and, under specific…

Israel’s State Attorney’s Office has filed an indictment against Michael “Miki” Bar, a 43-year-old hacker from Ashkelon who was chief information security officer at the Hamat Group. The group is not implicated in the case. According to the indictment, Bar…

Researchers from NSB Cyber and Abstract Shield found more than a dozen security and privacy flaws while testing two inexpensive smart-glasses models costing A$60 and A$110. The main weakness was insecure Bluetooth pairing: when the glasses were switched on…

SANS Internet Storm Centre researcher Johannes Ullrich examined how web servers handle HTTP GET requests containing a message body. The issue stems from differing language in the HTTP standards: RFC 2616 said a body must not be included when a method’s…

Data security company Cyera has secured an additional $400 million from Goldman Sachs Alternatives, taking its valuation above $12 billion. The investment extends the Series G funding round announced in June and brings Cyera’s total funding to more than $2.7…

Cloudflare has introduced support for the HTTP `Vary` response header in Cache Rules, making the feature available on Free, Pro, Business and Enterprise plans through its dashboard, Rulesets API and Terraform. `Vary` tells intermediary caches which request…

Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept exploit aimed at a claimed Windows Defender update denial-of-service zero-day. According to the…

North Korea’s WaterPlum group, also known as Contagious Interview, infected at least 30,000 devices across more than 100 countries and stole funds or credentials from over 7,000 cryptocurrency wallets, according to a joint advisory. The activity ran from…

The researcher known online as Nightmare Eclipse has revealed his identity as Abdelhamid Naceri and published BigDiskBuster, a proof-of-concept exploit targeting Microsoft Defender. According to the project’s GitHub page, the tool is similar to UnDefend and…

Spokane Public Schools took several systems offline on Monday after reporting an overnight “network security incident”. In an email to families, the district said the incident was under investigation and that the precautionary shutdown could disrupt…

Ahmed Hossam Eldin Elbadawy, a 24-year-old Texas man described as an early member of the Scattered Spider subset of The Com, pleaded guilty to wire fraud conspiracy and aggravated identity theft. Court records show that he entered the plea exactly one year…