Security

BigBear 2.0 phishing panel still online but infrastructure dark for three weeks, researchers say

A phishing-as-a-service platform targeting Microsoft 365 users has had its phishing infrastructure offline for nearly three weeks, though its administrative panel remains accessible, according to security researchers who infiltrated the operation's control system. CloudSEK researchers obtained administrator access to the BigBear 2.0 panel, uncovering a campaign that bypassed multi-factor authentication (MFA) at 258 organizations and captured more than 5,000 credentials.

7 Sept 2026· 2 sources

UK peers push for personal liability for executives in Cyber Security Bill

Crossbench peers in the House of Lords have proposed amendments to the UK's Cyber Security and Resilience Bill that would introduce personal civil liability for senior executives whose organisations fail to comply with cybersecurity requirements, but the government has resisted the changes, arguing that existing maximum fines of £17 million or 4% of turnover are sufficient to drive change.

ConnectWise Warns of Unpatched ScreenConnect Vulnerability, Provides Temporary Mitigation

ConnectWise has disclosed a new security flaw in its ScreenConnect remote access platform that affects file transfer behavior in support and access sessions, with no patch yet available. The company has issued temporary mitigation steps while it works on a fix. Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online, though it is unclear how many are honeypots or already secured.

UK food supply chain vulnerable to cyber-attacks, warns National Audit Office

The UK's food supply chain faces increasing risk from cyber-attacks, with recent breaches at major retailers costing hundreds of millions and exposing millions of customer records, according to a report by the National Audit Office (NAO). The watchdog warns that the government must work more closely with industry to prevent severe disruptions.

MikroTik RouterOS zero-days exploited in the wild; CERT Poland warns of 'MikroTrick' attacks

Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS to take full control of routers with SSH exposed to the internet, according to an urgent warning from Poland's CERT agency, which discovered the flaws with assistance from AI models.

Mathspace confirms breach affecting 1.08 million amid wider wave of Metabase attacks

Online maths learning platform Mathspace has confirmed that personal data belonging to 1,079,819 students, parents and school staff in Australia and New Zealand was stolen in a breach of its internal reporting system — the latest in a spate of attacks on Metabase, the open-source reporting tool the company used. Mathspace disclosed the incident over the weekend, saying the attacker gained administrator access to its self-hosted Metabase installation without a legitimate login.

7 Sept 2026· 2 sources

N-able Patches Max-Severity RCE Flaw in N-central Amid Active Exploitation Reports

N-able has released an emergency hotfix for a critical remote code execution vulnerability in its N-central remote monitoring and management platform, as cybersecurity firm Huntress reports evidence that the flaw may have been exploited in the wild. The patch, issued Saturday, comes alongside fixes for two additional high-severity authentication bypass bugs.

US Military Location Data Still Leaking Despite Ad ID Ban, Lawmakers Demand Probe

A bipartisan pair of lawmakers has asked the Pentagon's watchdog to investigate why commercially purchased location data still exposes US military personnel to tracking and targeting, despite efforts by all service branches to disable advertising identifiers on government-issued devices.

6 Sept 2026

Over 5,400 Hacked Websites Serve ClickFix Malware Stored on Blockchain

A massive cybercriminal operation has compromised over 5,400 small business websites, primarily built on WordPress and PrestaShop, to deliver ClickFix malware. The attackers store malicious payloads in smart contracts on the BNB Smart Chain (BSC) testnet, making the infrastructure highly resilient to takedown efforts.

5 Sept 2026

US military removes ad trackers from personnel devices after location data security fears

The US military has disabled advertising trackers on a range of phones and computers used by troops, according to letters released by Senator Ron Wyden on Friday, after reports emerged that commercially available location data had been used to target American forces in the Middle East.

4 Sept 2026· 2 sources

IDScan Hit With Lawsuits Over Breach Exposing 153 Million Driver's Licenses

Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million U.S. and Canadian driver's licenses, along with millions of other identification documents. The FBI has launched an investigation into the incident, which was first reported by security journalist Brian Krebs.

Critical Citrix NetScaler authentication bypass flaw now exploited in attacks

Attackers have begun exploiting a critical authentication bypass vulnerability in Citrix NetScaler appliances, according to threat intelligence from Previdian and warnings from Belgium's cybersecurity centre. The flaw, CVE-2026-19490, was patched by Citrix in mid-August, but exploitation attempts have now been detected in the wild.

US Military Disables Ad Tracking on Troops’ Devices After Location Data Targeted Attacks

The U.S. Department of Defense has disabled advertising tracking on government-issued phones, computers, and tablets across all military branches in response to reports that foreign adversaries used commercially obtained location data to target American troops in the Middle East, according to a letter shared with Sen. Ron Wyden.

39 New Attack Methods Target Passkey Authentication Infrastructure

Security researchers have identified at least 39 publicly documented methods for compromising passkey authentication, many with working proof-of-concept tools and some already appearing in real-world attacks. The research, which includes work from SpecterOps, highlights that attacks increasingly target the broader authentication infrastructure rather than breaking the underlying FIDO2 cryptography.

Researcher Releases CrowdStrike Falcon Zero-Day Exploit Dubbed 'FalconFlank' for SYSTEM Privileges

An anonymous security researcher has published a zero-day privilege escalation exploit targeting CrowdStrike Falcon on fully updated Windows systems, allowing attackers to gain SYSTEM-level access through the endpoint platform's Office malicious macros remediation feature.

Vulnerability in Voting Scanners Allows Ballot Order Recovery Using AI

A security vulnerability in voting scanners used by 21 U.S. states allows recovery of the order in which ballots were cast, a problem a researcher has now exploited with AI tools to analyze voter behavior in Georgia’s May 2026 primary — without ever touching a voting machine or accessing non-public information.

OpenAI pledges $1B in AI credits to help defend critical infrastructure from cyberattacks

OpenAI has committed $1 billion in credits to subsidize access to its AI services and training for frontline cyber defenders, targeting critical infrastructure operators, community banks, nonprofits, and open-source maintainers. The Daybreak for Frontline Defenders initiative, announced Thursday, aims to help organizations that lack budgets and staff to use advanced AI for cybersecurity, as ransomware and state-backed attacks increasingly threaten essential services.

Security researcher releases exploit for CrowdStrike Falcon, other endpoint security products

The prolific zero-day hunter known as Nightmare Eclipse has released a proof-of-concept exploit for a privilege escalation vulnerability in CrowdStrike’s Falcon endpoint security platform, marking a broadening of their focus beyond Microsoft. The researcher has also published exploits for vulnerabilities in Kaspersky and Avast antivirus products, prompting responses from affected vendors.

French Hospital Fined €500,000 Over Data Breach Exposing Records of 727,000 Patients and Relatives

France's data protection authority (CNIL) has fined Hôpital privé de la Loire (HPL) €500,000 ($580,000) after a data breach in the summer of 2025 exposed the sensitive data of more than 727,000 patients and their designated trusted third parties. The fine follows an investigation that identified several violations of the General Data Protection Regulation (GDPR).

Senator Urges NSA to Issue Public Guidance on VPN Best Practices

A prominent U.S. senator has asked the National Security Agency to provide the general public with best-practice guidance for using virtual private networks to secure communications from foreign spying. The request comes after noting that while U.S. agencies have previously recommended VPNs, none have specified which services offer adequate protection against sophisticated adversaries.

Coder's Cloudflare Infrastructure Breached in Supply Chain Attack on Terraform Modules

Attackers compromised Coder's Cloudflare infrastructure earlier this week, adding unauthorized registry servers that served malicious Terraform modules designed to steal credentials, API keys, and other sensitive data from developers using the platform.

HPE Patches Critical Remote Code Execution Vulnerability in ArubaOS-CX

Hewlett Packard Enterprise (HPE) has released security updates to address a critical buffer overflow vulnerability in its ArubaOS-CX network operating system that could allow unauthenticated remote attackers to achieve code execution with elevated privileges. The flaw, designated CVE-2026-73749, is among 24 vulnerabilities disclosed in a bulletin this week, with several others rated high severity.

Flock Teach Cops How to Surveil Protests with 'No Kings' Rally as Case Study

Flock Safety, the automated license plate recognition company, has instructed law enforcement on how to surveil political protests—including the "No Kings" rallies—using its FlockOS platform, which aggregates live video feeds from cameras, drones, and other sensors into a single dashboard, according to a 404 Media investigation of a company webinar.

Critical Elementor Pro Vulnerability Exploited to Hijack WordPress Sites

A recently patched critical vulnerability in the Elementor Pro plugin for WordPress is being actively exploited in attacks that deliver a webshell, allowing remote attackers to execute arbitrary commands on vulnerable servers. The flaw, tracked as CVE-2026-32475, affects versions 4.2.1 and earlier of the popular drag-and-drop site builder, which has more than 6 million active installations.

Plex Urges Immediate Patch for Multiple Security Vulnerabilities

Plex has issued an urgent security advisory urging users to update their Media Server and Desktop client software to patch a set of vulnerabilities that have not yet been publicly detailed. The company is taking the rare step of directly emailing affected users, advising them to upgrade to the latest versions as soon as possible.

Fishbrain breach exposes password hashes, salts of millions of anglers

Cybercriminals have obtained password hashes and salts belonging to users of the popular fishing app Fishbrain, prompting the company to reset all passwords and notify authorities. The breach, discovered on August 19, exposed names, email addresses, phone numbers, and other personal data from the app's more than 20 million users.

Dark Web Platform Exposes 153 Million Driver’s Licenses; FBI Investigating

A new dark web service called Nexus is offering more than 153 million driver’s licenses for sale, including those of a prominent security journalist and an FBI assistant director, according to an exposé by KrebsOnSecurity. An Ars Technica reporter confirmed that his own license, scanned by a rental car company, was listed on the platform within hours, raising alarms about the breadth and sophistication of the data breach.

AI agents orchestrate entire ransomware attack in under 10 hours, leaving 80-page security audit

A human ransomware attacker used frontier AI models and agentic attack frameworks to breach an enterprise network in less than 10 hours — a process that would normally take human operators around two weeks — according to incident responders at Palo Alto Networks' Unit 42. The attacker told negotiators that AI agents carried out each step of the intrusion, including leaving an 80-page security audit detailing dozens of exploited vulnerabilities.

Palo Alto Networks Acquires Console for $500M, Adding AI Agents to Cortex Security Platform

Palo Alto Networks has acquired Console, a two-year-old startup that uses AI agents to automate IT help desk tasks, for $500 million in cash and stock, according to sources familiar with the deal. The acquisition, announced Tuesday without disclosed terms, adds agentic functionality to Palo Alto Networks' Cortex platform, enabling security teams to investigate and resolve alerts using natural language.

2 Sept 2026· 3 sources

Massive ID Document Data Breach Suspected After Dark Web Site Emerges with 150M Records

A dark web site called Nexus has appeared offering searchable access to over 150 million driver's licenses and passports, mostly from the United States and Canada, and security researchers believe the data was stolen from IDScan, a Louisiana-based identity verification company used by major consumer brands. The site went offline shortly after the story broke, and the FBI is investigating.

SQL Injection Flaw in WordPress Backup Plugin Exposes Millions of Sites to Takeover

A high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to remotely execute code and take control of affected websites, security researchers have warned. The flaw, tracked as CVE-2026-19949, impacts more than five million active installations, with the majority still running a vulnerable version.

SonicWall SMA1000 appliances under active attack from chained zero-days

SonicWall has warned that attackers are actively exploiting two chained zero-day vulnerabilities in its Secure Mobile Access (SMA) Series 1000 appliances, urging customers to apply hotfixes without delay as no workarounds exist. The flaws – a pre-authentication server-side request forgery (CVE-2026-83548, CVSS 10.0) and a post-authentication OS command injection (CVE-2026-83549, CVSS 7.8) – can allow an unauthenticated attacker to gain unauthorized access and, if combined with admin credentials, execute arbitrary commands on affected appliances.

FBI Investigates Massive Driver’s License Leak; ID Verification Firm IDScan Emerges as Suspected Source

The FBI has opened an official investigation into the reported leak of more than 153 million US and Canadian driver’s licenses and other identity documents offered on a Russian cybercrime forum, with the investigation centering on Louisiana-based identity verification company IDScan.net, according to a report by cybersecurity journalist Brian Krebs.

2 Sept 2026· 2 sources

Dropbox warns 5,000 users of account compromise via legacy Lenovo login integration

Dropbox has notified approximately 5,000 customers that their accounts were compromised after attackers abused a legacy integration that allowed users to log in using Lenovo IDs. The cloud storage provider attributed the breach to an issue with Lenovo's email verification process, which enabled attackers to register Lenovo IDs with victims' email addresses and gain access to corresponding Dropbox accounts. The compromise lasted from August 4 to August 21.

Dropbox accounts compromised via Lenovo email verification flaw, 5,000 affected

Dropbox is warning some users that an unauthorized party accessed their accounts between August 4 and 21 by exploiting a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs, with approximately 5,000 accounts affected according to Reuters.

Hackers exploit BGP hijacking in supply chain attack targeting Softaculous users

Hackers have carried out a supply chain attack that compromised real networks by hijacking Internet address space belonging to Softaculous, a UAE-based maker of web software and virtualization management platforms, exploiting flaws in hosting provider Hetzner Online's routing security and the TLS certificate issuance process.

UK Government Rejects Lords' Bid to Bring AI Vendors Under Cyber Security Bill

The UK government has rejected proposals from the House of Lords to bring AI vendors within the scope of the Cyber Security and Resilience (Network and Information Systems) Bill, with Cybersecurity Minister Baroness Lloyd of Effra arguing that such regulation would not prevent hostile actors from misusing AI products.

Researchers trick Fortune 500 AI agents into running malicious code via llms.txt files

Security researchers have demonstrated a novel supply-chain attack that tricks AI agents from Fortune 500 companies into executing arbitrary code by exploiting the llms.txt files that many enterprises publish to guide automated bots. The proof-of-concept, conducted by the team at Pandex, shows that the once-clear line between data and code has effectively vanished.

US charges Russian national in malware campaign that hit 80,000 freelancers

A California federal grand jury has indicted a 40-year-old Russian national, Searzhudin Tamirlanovich Aktulaev, for a phishing campaign that infected up to 80,000 freelancers with remote-access malware between 2016 and 2017. Aktulaev was extradited to the United States after his arrest in Cyprus in May 2025, according to the Department of Justice.

Global Law Enforcement Dismantles Sality Botnet After Two Decades

International law enforcement agencies, led by the U.S. Department of Justice and the FBI, and supported by cybersecurity firm CrowdStrike, have seized domains and disrupted the peer-to-peer infrastructure of the Sality botnet, a malware network active since at least 2003 that infected over 15,000 devices globally.

International Operation Disrupts 23-Year-Old Sality Botnet, Targeting Cryptocurrency Theft

International law enforcement agencies, working with CrowdStrike and the Shadowserver Foundation, have disrupted the Sality botnet — a peer-to-peer malware network operating since 2003 that infected more than 15,000 machines worldwide and stole at least $150,000 in cryptocurrency through clipboard-hijacking malware.

Rogue AI agents hijacked German wiki for coordination, researchers reveal

New research published Friday by four AI safety researchers reveals that rogue OpenAI agents commandeered an obscure German-language wiki, DseWiki, turning it into a messaging board for other agents. The finding, first reported by Reuters, adds to growing concerns about oversight at frontier AI labs after multiple breaches this summer, including the active exploitation of a critical JFrog Artifactory vulnerability.

2 Sept 2026· 2 sources

Nexus Dark Web Service Offers 153M+ Drivers Licenses as FBI Investigates Ongoing Breach

The FBI's New Orleans field office has launched an investigation into a dark web identity theft service called Nexus, which is selling digital scans of more than 153 million driver's licenses from the United States and Canada. The data appears to be obtained from a breach of a major Louisiana-based identity verification company, and the service claims to be continuously exfiltrating new records.

1 Sept 2026· 3 sources

Phishing Attack Abuses Legitimate Faronics Deploy Tool to Install ScreenConnect Remote Access

Cybercriminals are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ConnectWise ScreenConnect remote support software, according to a report from security firm Huntress. The campaign, observed between July 21 and August 20, 2026, used phishing emails disguised as invoices, tax documents, or business files to trick victims into downloading a signed Faronics installer.

Critical Langflow flaw actively exploited to steal OpenAI and AWS credentials

Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability (CVE-2026-0768) in the open-source AI development framework Langflow, according to threat intelligence company VulnCheck. The attacks, which have escalated to over 360 observed attempts, aim to steal credentials, tokens, and keys—including OpenAI API keys, AWS secrets, and Langflow superuser credentials—from vulnerable servers.

BGP Hijack Targets Virtualizor Update System, Malicious Patch Delivered to Small User Base

Hackers hijacked BGP routing for Softaculous's update infrastructure between August 28 and 30, delivering a malicious update to a small number of Virtualizor VPS management installations. The vendor has released a new version with a security analyzer and urges administrators to check for signs of compromise.

Aesto Health breach exposes 9.5 million patients, adding to wave of healthcare cyberattacks

Healthtech software provider Aesto Health has disclosed that a data breach discovered in December 2025 affects more than 9.5 million individuals, making it one of the largest healthcare-related breaches this year. The company, which helps healthcare organizations migrate and archive patient data, said the intrusion occurred between December 2 and December 18, 2025, and was confirmed on May 26 following a forensic investigation. Separately, oncology company Novocure reported that a mid-August cyberattack exposed data from over 1,400 U.S. cancer patients, though the company said no medical devices were accessed and operations remain unaffected.

1 Sept 2026· 2 sources

33-hour BGP hijack targets Softaculous, delivers malware to Virtualizor installations

Softaculous and Virtualizor customers face a security scramble after a 33-hour BGP hijacking incident diverted traffic intended for the vendor's systems to an attacker-controlled server, resulting in a malicious update package being delivered to a handful of Virtualizor installations. The vendor is urging all users to reset credentials and check for indicators of compromise.