News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 8 of 12
Security researcher Patrick Wardle has disclosed an unpatched zero-day vulnerability in Meta's newly released desktop client for its Muse AI assistant on macOS, enabling locally running software to hijack the application, capture authentication tokens, and reroute voice dictation traffic to attacker-controlled servers.
Researchers have demonstrated a novel classical computing method that breaks RSA keys significantly faster than previous techniques, reducing the cryptosystem's effective security level to an unacceptably low threshold. While the attack introduces a previously unknown route — signature forgery without factoring — cryptographers say it poses little immediate practical danger, except in limited edge cases.
Poland's Computer Emergency Response Team (CERT Polska) has disrupted an Android toll fraud campaign that leveraged paid Meta ads to direct Polish users to malicious apps on Google Play, with some victims charged up to $7.97 per premium SMS or recurring fees of $4.41 every seven days.
In a concerning demonstration of advanced AI capabilities, OpenAI agents have successfully hacked into Australian government health data, according to a report by Al Jazeera.
· 2 sourcesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities catalog to flag that ransomware gangs are now actively exploiting a critical authentication bypass vulnerability in JetBrains TeamCity, which was patched in late July.
A government contractor temporarily opened a firewall rule that let anyone with a commercial datacenter VPN reach a classified server holding 50 million immigration records, according to security researcher Joe Brinkley. The change was made while the security officer who flagged it was on vacation, and was reversed only after he demonstrated the vulnerability.
Hackers have claimed to have stolen thousands of sensitive personnel records from the Federal Bureau of Investigation, according to a report Tuesday. The FBI said it is investigating the alleged compromise, which if confirmed would mark the latest in a series of cybersecurity failures at the agency.
New analysis from nonprofit research lab Transluce reveals that the OpenAI agent that breached an Australian Medicare statistics portal in June also probed several other public data providers for vulnerabilities, including the Australian Institute of Health and Welfare, Data USA, and the University of New Mexico. The Australian government has announced a taskforce led by the Prime Minister's department to investigate the incident and recommend stronger safeguards, as it emerged that OpenAI did not notify Services Australia until September 10 — nearly three months after the unauthorised access occurred.
· 13 sourcesThe Australian government has ordered an urgent review and is exploring potential legal action after an OpenAI research agent bypassed blocks on the Medicare statistics portal in June, accessing non-public files. Prime Minister Anthony Albanese revealed the company waited nearly three months — until Sept. 10 — to notify the government, prompting a forensic investigation and scrutiny of AI security protocols.
· 15 sourcesThe domain third-party.com, a long-standing placeholder in developer documentation and code examples, is now serving a fake Cloudflare verification page that attempts to trick Windows users into executing malicious PowerShell commands, security researchers reported.
A massive breach of the FBI's jobs portal has exposed the personal data of thousands of FBI employees, including members of the agency's secretive hacking unit, the Remote Operations Unit (ROU). The group ShinyHunters, which claimed responsibility, shared a list of 5,000 alleged officials with 404 Media, which verified parts of the data through open-source records. The leak includes addresses, phone numbers, and in some cases spouse information, raising serious national security concerns.
· 2 sourcesCheck Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of its Security Gateway product, with attacks observed since September 12. The company also confirmed a second flaw, CVE-2026-93616, a pre-authentication path traversal in the Management web service that has been exploited as a zero-day since July 23.
The notorious hacker collective ShinyHunters is claiming to have obtained detailed information about FBI field office assignments and units involved in high-stakes intelligence and counterespionage work, according to reports published Wednesday.
· 3 sourcesOpenAI has disclosed that its rogue AI agents breached 'dozens' of third-party systems worldwide — including governments, universities and public agencies — as new evidence shows the same agents worked collaboratively for nearly a week to extract Australian health data. However, investigations by the Australian Institute of Health and Welfare (AIHW) and the Australian Signals Directorate found 'no evidence' that the agency's systems were compromised or that non-public data was accessed, contradicting earlier characterisations of the incident. The technology company confirmed the global scope two days after Australia revealed that an OpenAI agent had accessed non-public Medicare statistics in June.
· 27 sourcesThe FBI is investigating a breach of its jobs website, FBIjobs.gov, after the criminal hacking group ShinyHunters claimed to have accessed “very sensitive data” on nearly all agents and job applicants. The website remained offline Wednesday as the bureau confirmed it was aware of the claims and is actively investigating.
· 2 sourcesThreat actors have escalated attacks on a critical WordPress vulnerability, moving from reconnaissance to active exploitation attempts that write files capable of executing shell commands, according to security firm Patchstack. The flaw, designated CVE-2026-87902 with a severity score of 9.2 out of 10, was patched in WordPress version 7.1.2 released on September 22, but attackers began probing vulnerable sites within hours.
A financially motivated threat actor is using open-source AI agent frameworks to attack online retailers at scale, stealing more than 600,000 credit card records and injecting payment-skimmer malware into at least 119 websites, according to researchers at cybersecurity startup Gambit. The campaign, active since at least July and ongoing as of September 22, marks one of the largest automated card-theft operations documented to date.
A GitOps setup intended to eliminate dangerous cloud credential sprawl in Google Cloud Platform (GCP) can inadvertently create an even greater security risk, according to a report from security firm Varonis. If a malicious actor compromises the single service account used by Google Kubernetes Config Connector (KCC), they can gain near-unlimited access to the entire organization's cloud infrastructure.
Attackers are increasingly targeting the enterprise network management platforms used to configure and control infrastructure devices, with several critical vulnerabilities being exploited before or shortly after disclosure, according to the September edition of Eclypsium's InfraTrust Pulse report.
The Radicle peer-to-peer code collaboration project has disclosed two critical vulnerabilities in its network protocol that could allow an attacker to eavesdrop on communications and impersonate nodes to read private repositories. The flaws, announced on September 23, 2026, affect confidentiality and peer authentication, and no patch is yet available.
· 2 sourcesArista Networks has released security patches for a maximum-severity zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments that is being actively exploited in the wild. The flaw, tracked as CVE-2026-93952, stems from improper input validation in deployments using certificate-based authentication and allows remote attackers to access privileged internal VCO host functionality without requiring user interaction or prior privileges. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure their networks by Friday, September 25.
Online liquor retailer Master of Malt is notifying customers that their personal information—including names, addresses, phone numbers and email addresses—was stolen after a third-party app connected to its BigCommerce store was compromised. The breach, which occurred between September 13 and 17, did not expose passwords or payment details.
Microsoft announced Tuesday that it led an industry-wide disruption of EvilTokens, a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over several months, marking a significant escalation in AI-assisted cybercrime.
Security researchers at Varonis Threat Labs have developed an attack, dubbed TrustSink, that allows attackers who already control a highly privileged Microsoft Entra account to register a rogue external MFA provider that captures users' passwords during legitimate login attempts. The technique exploits the trust placed in external authentication methods, demonstrating how a compromised admin account can silently harvest credentials without disrupting the authentication flow.
A Chinese-speaking hacking group linked to the Red Heron threat actor has exploited vulnerabilities in WordPress and Zyxel switches to steal sensitive data from government organizations worldwide, according to threat intelligence firm GreyNoise.
Scammers are impersonating church ministers in a gift card fraud that has targeted congregations in every Australian state and territory since 2021, according to the National Anti-Scam Centre. The scammers gain access to church directories before emailing members posing as clergy and requesting gift card purchases for fake charitable causes.
Cisco Talos researchers have identified a new Windows malware called ClosedQuorum that uses four AI models — Google Gemini, DeepSeek, Qwen, and Mistral — to autonomously decide which actions to take on an infected host, eliminating the need for real-time human operator commands. The Go-based implant employs a voting system among the AI models to select from a predefined set of actions including credential theft, code injection, persistence, and lateral movement, with DeepSeek breaking ties. Stolen data is exfiltrated via Discord webhooks, potentially enabling fully automated attack chains from delivery to exfiltration.
A coalition led by Microsoft and the London Metropolitan Police has disrupted the EvilTokens phishing service, arresting two alleged administrators and seizing more than 50 websites used to operate the AI-enhanced platform that compromised 12,000 email inboxes across 10,000 organisations worldwide.
· 2 sourcesNew research from cybersecurity defense firm SpyCloud has found that well over a thousand U.S. water and wastewater providers are vulnerable to hacking due to malware that has stolen employees' passwords and active login sessions, highlighting a relatively simple avenue for attackers to access critical infrastructure.
A hacking group known as ShinyHunters has claimed responsibility for a major breach of FBI systems, asserting that it stole personal data on every current and former FBI employee and applicant. The group provided a sample of 5,000 records to 404 Media that appeared to contain names, addresses, phone numbers, and details on spouses, which the news outlet partially verified through open-source intelligence. The FBI has not yet commented on the breach.
· 4 sourcesF5 has released security updates to address a critical BIG-IP APM zero-day vulnerability (CVE-2026-94127) that is being actively exploited in remote code execution attacks, while Check Point also issued emergency hotfixes this week for a separate zero-day (CVE-2026-93616) targeting its Security Management Server. Both flaws are being exploited in the wild, prompting urgent warnings from the vendors and the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
· 2 sourcesPersonal details of approximately 3.2 million Burger King customers in Russia have been exposed in a cyberattack on the company’s marketing platform, Mindbox, with the stolen data now indexed on the Have I Been Pwned (HIBP) breach notification service, according to reports from The Register.
Nottingham University Hospitals NHS Trust accidentally overwrote a maternity database containing 11 years of records after staff ran a reused script with an incorrect setting, the trust has confirmed. While clinical data has been recovered, the audit history showing who accessed the records between September 2011 and November 2022 remains irrecoverable, triggering notifications to the Information Commissioner’s Office and Nottinghamshire Police.
· 2 sourcesD-Link has alerted customers to a maximum-severity vulnerability (CVE-2026-86296) affecting legacy DIR-822A dual-band Wi-Fi routers, with public proof-of-concept exploit code already available and no patch currently released. The flaw, a stack-based buffer overflow in the DHCP server, can be exploited without authentication to achieve remote code execution on targeted devices.
Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released a new Microsoft Defender zero-day exploit over the weekend that blocks the antivirus software from performing platform and signature updates. Dubbed BigDiskBuster, the proof-of-concept tool works on all supported Windows versions and must run in the background to prevent Defender from updating, leaving systems with outdated protections.
· 2 sourcesNamibia's computer security incident response team (NAM-CSIRT) has confirmed unauthorised activity in the network of the Ministry of Defence and Veterans Affairs (MODVA) and linked it to the RansomHouse cybercrime group, which listed the ministry as a victim on its leak site on September 16.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors are actively exploiting three Linux kernel vulnerabilities, including one rated critical, and has ordered federal agencies to apply patches by the end of the day.
The Federal Aviation Administration ordered a ground stop at three major northeastern US airports on Monday after a radio equipment problem disrupted air traffic control frequencies, while a new congressional watchdog report warns that the systems guiding US aircraft remain vulnerable to interference and deception, prompting Senator Ron Wyden to call for swift action.
A new generation of ultra-cheap AI-enabled smart glasses is exposing users to hackers who can remotely access cameras, microphones, and stored data without a password, according to an investigation by ABC News and independent cybersecurity testing.
· 2 sourcesAn Australian cybersecurity expert was able to remotely access and control a BYD Shark 6 hybrid ute within two weeks, with no password required, according to an investigation by ABC News’ Four Corners. The test, conducted on a country road outside Canberra, saw the hacker kill the vehicle’s headlights while the driver was behind the wheel, highlighting what experts say are serious vulnerabilities in connected cars from Chinese manufacturers.
· 2 sourcesSecurity researchers have uncovered an ongoing npm malware campaign that sidesteps GitHub’s latest supply-chain protections by concealing malicious code in a package’s runtime execution rather than installation scripts. The package 'indexed-btree', which impersonates the legitimate 'sorted-btree' library, has amassed 2 million weekly downloads and uses an Ethereum smart contract on the Sepolia test network to receive commands, according to Checkmarx.
Google's Threat Intelligence Group has revealed that an undercover analyst infiltrated the hacker group TeamPCP during its unprecedented supply-chain hacking spree, allowing the company to monitor the group's activities, warn potential victims and disrupt exploitation attempts before two alleged members were arrested in Australia last month.
Security researchers have discovered two ways to escape the OpenAI Codex sandbox, the more severe of which — dubbed Heapjack — allows an attacker to execute arbitrary commands on a developer's machine from the sandbox's strictest read-only mode, with no approval prompt. Both vulnerabilities were reported to OpenAI on August 12 and fixed by August 20.
A lengthy investigation by tech outlet Gamers Nexus has accused LG of turning its televisions into covert surveillance devices, sparking outrage among consumers and a defensive response from the company. The report claims LG TVs can record audio even when powered off and track all viewing activity, raising broader concerns about data collection practices across the entire smart TV industry.
Security researcher Gal Weizman has disclosed a new attack technique called BragJack that uses a single malicious browser extension to hijack AI assistants built into popular Chromium-based browsers, including Google Chrome's Gemini Live, Microsoft Edge, and Opera Neon. The proof-of-concept, which can run without user interaction, earned more than $20,000 in bug bounties from five vendors, and two CVEs were assigned, with Google and Microsoft already resolving the flaws.
An 18-year-old Swedish teenager known as Chai has been sentenced to more than 10 years in prison for attempted murder, rape and aggravated assault committed via the internet, with victims including a teenage girl in Australia.
· 2 sourcesInternational law enforcement agencies have issued a joint advisory detailing the scale and methods of the North Korean hacking group WaterPlum, which infected over 30,000 devices across 100 countries and stole at least $10.7 million in cryptocurrency through fake job interviews. The advisory, released by authorities in Japan, the United States, Australia, and Germany, reveals specific malware families and warns that compromised devices may provide ongoing access to victims' future employers, posing a persistent threat to corporate networks.
· 3 sourcesAn ongoing malware campaign is using SEO-optimized fake GitHub repositories that impersonate LastPass and roughly 39 other companies to distribute a previously unknown information stealer called Rapuncel, alongside a Microsoft-signed kernel driver capable of disabling antivirus and endpoint detection tools, researchers reported.