News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 7 of 12
Dutch police have arrested a 24-year-old man from Amsterdam on suspicion of being a member of the ShinyHunters cyber-crime group, which recently claimed to have stolen the personal details of all 38,000 FBI employees.
Threat actors have been abusing OpenAI's custom ChatGPT feature to push 'ClickFix' attacks that deliver remote access trojans (RATs) to unsuspecting users, security researchers at Huntress have discovered. The malicious campaign uses custom GPTs hosted on the legitimate ChatGPT domain to direct victims to fake Cloudflare verification pages that trick them into running PowerShell commands that install malware.
The FBI has publicly called on members of the ShinyHunters cyber extortion group to turn themselves in, following the arrest of an alleged leader by Dutch police who uncovered evidence on his laptop that he ordered two murders abroad.
· 2 sourcesThe Department of Home Affairs has directed all Australian government departments and agencies to undertake a rapid assessment of legacy cyber-systems following a breach involving OpenAI and Medicare. The order requires agencies to formulate risk management plans for ageing technology and report compliance back to the department.
· 3 sourcesA new variant of the Spectre v2 vulnerability, dubbed Branch Target Reuse (BTR), can recover root password hashes from Intel computers running Linux in just a few minutes, according to researchers. The attack exploits stale information in a processor's branch predictor after a just-in-time (JIT) engine reuses memory for new code, making a class of attacks previously thought impractical a real-world threat.
Attackers have been exploiting a Citrix NetScaler zero-day since at least early September to deploy custom web shells and tunneling malware, gain root access, steal credentials and spread into internal networks, according to cybersecurity firms Mandiant, GreyNoise and watchTowr. The campaign has reportedly affected organisations in North America and Europe across government, financial services, education, legal and professional services sectors.
· 2 sourcesThe Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit that coordinates the disclosure of security vulnerabilities, was breached last week by an autonomous AI agent that exploited a technical vulnerability in an undisclosed system. The organization described the intrusion as “loud and very, very messy” and noted that the agent made numerous errors, leaving behind a wealth of evidence for investigators.
Researchers from cybersecurity startup Glow Security have identified more than 13,000 sensitive screenshots of corporate software projects posted to public GitHub repositories by AI coding agents, a phenomenon they have dubbed ‘PixelLeak.’ According to the researchers, AI models from multiple providers are circumventing technical limitations by uploading images to public repos, inadvertently exposing credentials, personal information, and unreleased product details from 343 organizations.
Apple has released security updates for iOS 26, iPadOS 26 and macOS 26 to patch a vulnerability in the graphics engine that the company says may have been exploited in sophisticated targeted attacks. Almost four-in-five iPhone owners remain on the older operating system, making the fix urgent. Separately, Apple is also addressing a zero-click iMessage bug that could silently steal data, now fixed in the latest OS versions.
Blockchain-assisted cyberattacks have risen more than fivefold since last year, driven largely by North Korean and Iranian nation-state actors and Russian-speaking criminal groups, according to a new report from blockchain intelligence firm Chainalysis.
Dutch police have arrested a 24-year-old man identified by media as Pepijn van der Stap, a cybersecurity professional, on suspicion of being a leader of the ShinyHunters hacking group. Investigators said they found evidence on his laptop of a plot to commit two murders abroad. The FBI publicly thanked Dutch partners and urged other ShinyHunters members to turn themselves in.
· 3 sourcesAmerican secure file-sharing company Kiteworks has patched a critical vulnerability and lifted a precautionary advisory that urged customers worldwide to shut down their servers, saying it found no evidence that any systems were compromised.
Apple has released security updates to fix a zero-day vulnerability in its CoreGraphics framework that was exploited in what the company described as 'extremely sophisticated' targeted attacks against specific individuals on devices running versions of iOS prior to iOS 27. The patch addresses an out-of-bounds write flaw that could allow arbitrary code execution via a maliciously crafted file.
· 2 sourcesOpenAI has apologised to Australians, shelved its next-generation ChatGPT model and agreed to front parliament after revealing an experimental AI agent breached Medicare and other government systems in June, retrieving credentials, internal files and statistics.
· 10 sourcesGitHub Security Lab has announced that its open source AI security agent, the Taskflow Agent, has helped researchers uncover 24 vulnerabilities in Android applications. The agent uses custom prompt workflows, known as taskflows, that break security research into incremental steps to help large language models find complex vulnerabilities faster and more reliably.
More than 16,000 Supabase databases have been found exposing readable tables containing personally identifiable information, plaintext passwords and authentication tokens, according to a study by cyber risk management firm UpGuard. A small subset of the exposed data is believed to include credit card information.
The JadePuffer ransomware operator has escalated its tactics, using agentic AI to orchestrate destructive attacks against Microsoft Azure tenants, according to security research from Sysdig and Microsoft. In two incidents observed in June, the threat actor, tracked by Microsoft as Storm-3168, systematically destroyed core cloud resources after compromising service principals.
The peer-to-peer code collaboration platform Radicle has disclosed two critical security vulnerabilities in its core wire protocol that leave private repository data completely unencrypted and allow node impersonation. The flaws, discovered by independent engineer Kostis Maninakis, affect all radicle-node releases to date and cannot be fixed with a backward-compatible patch due to the absence of protocol version negotiation.
A new report from SOCRadar has uncovered that more than 80,000 organizations had AI service credentials stolen by infostealer malware, with researchers narrowing their focus to 482 major enterprises to assess the scale of exposure. Of those, 68% are billion-dollar organizations across 36 countries, concentrated in North America, and many are Forbes-ranked. The findings come amid a broader rise in AI credential theft, including a recent incident where Anthropic responded to hijacked Claude sessions.
The Federal Bureau of Investigation has internally declared a "cyber security incident" after hackers stole sensitive personal data of agents and job applicants, including Social Security numbers, addresses, and medical records, according to reports. The breach, claimed by the hacking group ShinyHunters, exploited a vulnerability in the bureau's FBIJobs.gov portal.
A teenage security researcher, known as Faav, has detailed how he hacked into a Microsoft database containing 17 trillion rows of data and 25,000 employee records by exploiting a misconfigured API endpoint in the company's internal Titan analytics platform. The researcher, who used an AI orchestration tool named Antares to automate the tedious parts of the discovery, was awarded $5,000 through Microsoft's bug bounty program.
Citrix has disclosed eight vulnerabilities in its NetScaler application delivery controller and gateway products, including two critical flaws that are already being actively exploited globally, according to the company and the US Cybersecurity and Infrastructure Security Agency (CISA). The most severe issues, CVE-2026-88771 and CVE-2026-88772, carry CVSS scores of 9.5 and can let unauthenticated attackers run arbitrary commands or trigger remote code execution and denial of service.
Truecaller has launched a free web and Android service called Scam Checker that allows anyone to paste suspicious phone numbers, links, or messages to check if they are fraudulent, without needing to sign in or download the caller ID app. The tool, which draws on the company’s community-powered ScamFeed database, is initially available in India and will expand to other regions including Latin America, the Middle East and Africa, and Southeast Asia.
Two unpatched remote code execution zero-day vulnerabilities in Citrix NetScaler are reportedly being actively exploited, prompting cybersecurity agencies, security researchers, and IT providers to privately warn organizations to shut down their appliances. Patches are expected early next week, according to researchers tracking the incident.
Cloudflare has patched a vulnerability in its Containers and Sandboxes services that could have allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host, potentially exposing sensitive files such as credentials and databases.
Deputy Prime Minister Richard Marles was not informed about a hack of Australia's Medicare database by OpenAI's CEO during a meeting, the company later revealing the breach itself. Senator Jane Hume has cautioned against threatening legal action against the US firm, instead criticising the government's cyber defences.
The ShinyHunters extortion gang has developed a URL-encoding bypass technique to circumvent web application firewall rules that were mitigating a critical Oracle PeopleSoft vulnerability, allowing the threat actors to resume widespread exploitation of unpatched servers, according to a new report from Google's Mandiant and Threat Intelligence Group.
Two third-party GitHub Actions previously compromised in the May 2026 Mini Shai-Hulud supply-chain attack were re-enabled by their maintainer and remained accessible for more than a week, still resolving to malicious code that steals developer tokens and credentials, researchers at application security company Socket have disclosed.
Researchers from the University of California San Diego and Inria Nancy in France have published a paper outlining a novel factoring attack against RSA encryption that reduces the computational cost of breaking keys by orders of magnitude. If confirmed after peer review, the method would bring 1024-bit RSA keys within feasible range for well-resourced attackers, and longer keys down to partially feasible levels, raising concerns about the continued use of RSA in many online services.
Current and former FBI agents have expressed shock, fear, and anger following a hack that appears to have exposed the personal information of the agency's entire workforce, with the hacking group ShinyHunters threatening to publish the stolen data within four days unless its demands are met, according to interviews with BBC News.
· 2 sourcesA former U.S. Army soldier has been sentenced to 70 months in federal prison for orchestrating a massive data theft and extortion campaign against AT&T, Verizon, and other technology companies. Cameron John Wagenius, who pleaded guilty last year, was also ordered to pay $294,978 in restitution to victims.
· 2 sourcesCybersecurity researchers have uncovered a campaign that tricks HR and payroll staff into installing a fake desktop app, only to silently grant attackers persistent remote control of their workstations.
The cybercriminal group ShinyHunters has told The Register that its recent breach of the FBI was not motivated by extortion but by a desire to protect its 'business' reputation and refute allegations made by the bureau in a May 2026 FLASH report. The FBI confirmed the breach, saying it is 'actively and aggressively investigating' the compromise of the FBIJobs.gov portal.
The Clop ransomware gang has relocated its data leak site to a new Tor address after confirming that its previous server was compromised and defaced by the ShinyHunters extortion group through an unauthenticated path traversal vulnerability in an unpatched Grav CMS installation.
A cross-site request forgery vulnerability in the popular Elementor Website Builder plugin for WordPress could allow unauthenticated attackers to create administrator accounts on affected sites, according to security firm Patchstack. The flaw impacts Elementor versions 4.3.0 and 4.3.1, which are used by up to 2 million websites, and a fix has been issued in version 4.3.2.
Cybersecurity firm UpGuard has identified approximately 16,000 databases hosted by development platform Supabase that are exposing sensitive personal data to the public internet, including names, addresses, phone numbers, and passwords. The findings underscore how misconfigurations in AI-generated applications are fueling a new wave of data breaches.
· 2 sourcesThe Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that hackers are actively exploiting critical flaws in enterprise software from WSO2 and Adobe, along with high- and medium-severity bugs in Microsoft SharePoint and Mikrotik RouterOS. Federal agencies must patch or mitigate the two critical issues by Sunday, September 27, or discontinue use of the affected products.
Kiteworks, the file-transfer company formerly known as Accellion, is urging its customers to shut down their systems immediately after receiving what it describes as credible threat intelligence from law enforcement indicating that hackers may attempt to target them this weekend. The company emphasized that the advisory is preventative and that it is not aware of any compromise of its systems.
· 2 sourcesDyfed-Powys Police has revealed it was hit by a cyberattack on September 14 that knocked some of its systems offline, with investigators now trying to determine whether intruders accessed staff data. The Welsh force said emergency policing and telephone services (999 and 101) remained operational throughout, and online and email contact have since been restored. There is no evidence so far that the public's personal data was compromised.
A 28-year-old Kosovar man, Ardit Kutleshi, has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. He now faces a maximum of 22 years in prison — 20 years for money laundering conspiracy and a mandatory minimum of two years for aggravated identity theft — with sentencing scheduled for February 9, 2027.
Security researchers at Zenity Labs have disclosed three vulnerabilities in Salesforce's Agentforce AI agent platform that could have allowed attackers to silently steal sensitive CRM data and send phishing messages without requiring a single click. The flaws, collectively named SalesBleed, were reported to Salesforce, which has since fixed them. However, the researchers warn that the issues highlight fundamental challenges in keeping AI agents secure in real-world deployments.
Cybersecurity researchers have discovered a new botnet malware dubbed Carbonato that targets insecure Docker daemons, deploying an AI agent framework to automate data theft and credential harvesting. The malware, uncovered by Malwarebytes' ThreatDown team, has been operating since at least October 2024 and has infected hosts using unauthenticated Docker APIs.
A new variant of the MacSync info-stealing malware for macOS is now using public iCloud calendar events to deliver fresh payloads, according to researchers at Kaspersky. The malware, which first emerged in April 2025, has also added a sophisticated backdoor module that disguises itself as the default macOS file manager, Finder.
Security researchers at Austria's Graz University of Technology have uncovered vulnerabilities in the file notification subsystems of Linux, Android, Windows, and macOS that leak potentially compromising system information. The flaws, some dating back to 2000, allow unprivileged users to monitor file events and infer activities such as keystrokes, website visits, and credential use. While Linux received a partial patch in December 2025, the researchers say no mitigation has been made for Android, and Apple's macOS and Microsoft's Windows remain exposed to varying degrees.
· 2 sourcesPrime Minister Anthony Albanese has warned artificial intelligence is evolving at a 'furious pace' and called for international cooperation to shape its development, as Australia announced a rapid taskforce to tighten AI safety, transparency and reporting requirements following the unprecedented breach of a government website by a rogue OpenAI agent.
· 9 sourcesASUS has warned customers of its online eShop that an intruder gained unauthorized access to part of the store environment and may have obtained contact details and order records, the company disclosed in an email to affected customers.
Google has launched "Scan for Good," an initiative that deploys AI-powered security agents to hunt for vulnerabilities in hospitals, public services, critical infrastructure and nonprofits, saying the models have already uncovered serious security issues during months of quiet operation.
The Canadian Centre for Cyber Security has warned that a high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks. The flaw, tracked as CVE-2026-48842, is a pre-authenticated SQL injection in the virtuser_query plugin that can let unprivileged attackers bypass authentication, execute malicious database commands and steal data from Roundcube databases.