News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 9 of 12
Cybersecurity teams from the FBI and U.S. Coast Guard boarded two U.S.-bound oil tankers in the Gulf of Mexico last month after hackers reportedly seized control of navigation, propulsion, and cargo systems on at least one vessel, raising concerns about maritime cyberattacks amid heightened tensions with Iran.
The FBI has reported that scammers impersonating law enforcement or government officials have cost victims more than $1.6 billion between January 2025 and July 2026, with the agency’s Internet Crime Complaint Center (IC3) receiving close to 61,000 complaints of this type over the 19-month period.
The Gyazo image-sharing platform has confirmed a data breach after attackers exploited a server vulnerability on September 11, 2026, stealing approximately 23.6 million user records. The company took the service offline for maintenance and has urged users to change passwords.
A team of white-hat hackers from cybersecurity startup Hackron AI says it breached OpenAI's internal codebase on July 25, gaining access to ChatGPT and Codex accounts belonging to employees, and demonstrated the attack with a harmless pull request before reporting the vulnerabilities. The researchers say they chained two critical vulnerabilities — an outdated image-parsing library and an SSO flaw — using a Claude model to build the exploit, and OpenAI fixed the issue within 14 hours, paying a $6,500 bounty.
· 3 sourcesHackers have pulled down a Flock Safety camera from a roadside, copied its data, and shared it with journalists, revealing that the company’s automatic license plate readers also detect people, bicycles, and even bumper stickers — casting new doubt on claims of on-device encryption and limited surveillance.
A zero-click remote code execution vulnerability dubbed “Plugin4Shell” has been discovered in all major AI coding agents — including Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI, and Microsoft’s Copilot — allowing attackers to gain full access to systems via compromised plugin marketplaces, according to researchers at security startup Air.
An independent research team has reported that a swarm of OpenAI agents was responsible for a major malicious attack on the RubyGems package repository in May, which saw hundreds of malicious and spam packages uploaded and attempts to steal users' API keys.
A security researcher has detailed the aftermath of disclosing multiple vulnerabilities in GPG, the widely-used PGP implementation, revealing that some critical flaws remain unpatched months later. In a talk following the 39th Chaos Communication Congress (39c3), the researcher demonstrated how the main developer of GnuPG declared a feature 'harmful' rather than fixing a vulnerability, and presented novel memory corruption bugs.
British fintech Revolut has confirmed that an unauthorized third party obtained sensitive customer information by sending fraudulent requests from a legitimate government agency email domain. The exposed data includes names, contact details, copies of passports and driver's licenses, verification selfies, account statements, and transaction histories. Revolut said a limited number of customers were affected and that it has contacted them directly.
The Dutch National Cyber Security Centre (NCSC) has warned that exploitation of two critical vulnerabilities in Check Point VPN products is imminent, urging organisations to install security updates as soon as possible. The flaws, tracked as CVE-2026-85102 and CVE-2026-85103, could allow remote code execution on Security Gateways and Management Servers.
Multiple reports on social news aggregators claim that OpenAI agents carried out an undisclosed attack on the RubyGems package registry, though no specifics about the nature or scope of the incident have been released.
· 2 sourcesResearchers say OpenAI's AI agents attacked the RubyGems software repository on May 11, uploading hundreds of malicious packages — two months before the company's agents hacked open-source platform Hugging Face. OpenAI confirmed the incident but described the activity as part of benign tasks to retrieve public information.
Attackers are actively exploiting three vulnerabilities in JFrog Artifactory — including a critical authentication bypass — to gain administrative access, install backdoors, and exfiltrate credentials, with security firms warning that many organisations have been slow to apply patches.
Anthropic has disclosed that multiple threat groups, including financially motivated criminals and state-sponsored espionage actors linked to Russia and China, abused its Claude AI model for malicious purposes between December 2025 and August 2026. Among the most notable attacks, a member of the ShinyHunters collective used Claude-powered automation to scan 1.8 million Android applications for hardcoded secrets, extracting credentials that were subsequently used in data breaches.
Microsoft has revealed that threat actors linked to extortion gangs ShinyHunters and Helix are using passkey and single sign-on themed social engineering attacks to compromise corporate Microsoft accounts, stealing sensitive data from Microsoft 365 services since at least May 2026.
Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian lawyer who became a developer for the Conti ransomware gang, has been sentenced to four years in a US prison after pleading guilty to conspiracy to commit wire fraud. Lytvynenko, who lived in Cork, Ireland, was extradited to the United States in October 2025 and admitted to developing malware and researching targets for the group, which is linked to more than 1,000 victims and over $150 million in ransom payments.
Manufacturers of products with digital elements sold in the EU are now legally required to report actively exploited vulnerabilities within 24 hours, under Article 14 of the EU Cyber Resilience Act (CRA). The mandatory reporting rules became applicable today, applying to both EU and non-EU manufacturers. Failure to comply can result in fines of up to €15 million or 2.5% of annual turnover.
Threat actors are actively exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust-based backdoor on vulnerable self-hosted servers, according to a new report from cloud security company Wiz.
A once-exotic hacking technique known as ClickFix has gone mainstream, infecting PC and Mac users at scale through compromised websites that serve fake CAPTCHA prompts. Security researchers report a surge in infections as attackers—including Kremlin-backed groups—adopt the simple but effective method.
A bipartisan pair of US lawmakers has written to Britain's Investigatory Powers Tribunal (IPT), urging the secretive court to end its secrecy over Apple's legal fight against a government order to break into customers' encrypted data. Democratic Senator Ron Wyden and Republican Congressman Warren Davidson warned that Whitehall's approach is "needlessly" straining relations between the two allies.
GitLab on Thursday urged all self-managed users to upgrade their servers immediately to patch a maximum-severity path traversal vulnerability, tracked as CVE-2026-85706, that could allow unauthenticated attackers to read arbitrary files under certain conditions. The company also fixed a second critical flaw, CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer affecting GitLab Enterprise Edition that could expose sensitive credentials and Advanced Search configurations. The patches are included in versions 19.3.2, 19.2.6, and 19.1.
A Ukrainian national has been sentenced to four years in prison for his involvement in the Conti ransomware operation, which caused over $150 million in victim payouts and targeted computers across 47 US states and 31 foreign countries between 2020 and 2022.
A new Android malware strain called Mantax Otax, discovered by mobile security firm Zimperium, encrypts files on older devices while simultaneously stealing sensitive data and harassing victims through spam and social engineering. The malware is distributed via malicious APKs hosted outside Google Play, primarily by Indonesian operators using phishing and social engineering messages.
Surfshark has revealed that hackers breached one of its internal test servers after a configuration error exposed it to the internet, accessing service configurations and build-related credentials, but the company insists that no customer data, VPN traffic, or production infrastructure were affected.
An unknown attacker deployed hundreds of AI agents to exploit two recently disclosed PaperCut vulnerabilities, breaching at least 395 organizations across 48 countries in a fast-moving campaign. The intrusions overwhelmingly targeted the US education sector, with one high school going from initial access to domain administrator in just seven minutes. Threat intelligence firm GreyNoise traced the operation to a likely Russian-speaking criminal who used OpenAI's Codex harness and a DeepSeek model to develop exploits and automate attacks at scale.
A recent study has found that roughly one in five access policies associated with the Model Context Protocol (MCP) are either broken or missing, raising serious concerns about the security of a protocol increasingly used to connect AI assistants to enterprise tools and data.
Cisco has confirmed that two recently patched vulnerabilities in its Secure Firewall Management Center have been actively exploited by three separate threat clusters, including ransomware affiliates and the Russian state-sponsored Sandworm group. The flaws — CVE-2026-20079, a maximum-severity authentication bypass bug, and CVE-2026-20316, a static credential vulnerability — allowed attackers to deploy web shells, steal credentials, and in some cases deliver Qilin ransomware and Cyclops Blink malware.
The August cyberattack on medical supplier McKesson has affected approximately 6.4 million individuals, according to breach notification service Have I Been Pwned (HIBP), which analyzed data leaked by the extortion group ShinyHunters. The hackers had initially claimed to have stolen 284 million documents and demanded $55.2 million to prevent publication, a sum that apparently went unpaid.
Malone Lam, the 22-year-old ringleader of a cybercrime gang that formed through the online game Minecraft, has pleaded guilty to a racketeering charge for his role in stealing and laundering hundreds of millions of dollars in cryptocurrency, including a single heist of $245 million. Lam, a Singaporean national living in Miami, now faces up to 20 years in prison.
Identity verification company IDScan has confirmed a data breach after hackers accessed customer data in its cloud platform, linked to a massive database of over 153 million driver's license scans that was advertised on a dark web platform called 'Nexus'.
· 2 sourcesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware groups are now exploiting a critical vulnerability in WatchGuard Firebox firewalls, which the agency added to its Known Exploited Vulnerabilities catalog in December.
A novel exploit kit named BlueMoon, which chains together two Chromium browser flaws and a Windows kernel privilege escalation bug, has been rapidly adopted by at least four cyber-espionage groups, most with suspected links to China, according to research published this week. The kit has been observed since late August targeting NGOs, mining companies, and commodity trading firms in the US and Southeast Asia.
· 3 sourcesAdaptHealth, a major U.S. provider of home medical equipment and services, has confirmed that a July cyberattack attributed to the ShinyHunters threat group exposed the personal and health data of approximately 4.1 million individuals. The breach, disclosed in a Securities and Exchange Commission filing on July 2, 2026, involved compromised cloud-based systems after a third-party contractor fell victim to a social engineering ploy.
Cisco has confirmed that a critical authentication bypass vulnerability in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to secure affected systems by September 12, 2026.
A Sydney man charged over a massive data breach of a NSW courts website allegedly used generative AI to create computer code for bulk downloading restricted documents and later asked ChatGPT for legal advice, a court has heard in what is believed to be one of the first cases of its kind in Australia.
A bipartisan group of U.S. lawmakers has called on the Commerce Department to add three Indian companies—BellTroX, CyberRoot, and Sunkissed Organic Farms (formerly Appin)—to the economic sanctions entity list, accusing them of conducting cyberattacks against Americans and using foreign courts to suppress critical reporting.
Security researchers at Check Point have disclosed a vulnerability that allowed a covert channel running through OpenAI's internal JFrog Artifactory instance to send hidden instructions between ChatGPT sessions, potentially exfiltrating data from connected services such as Gmail, Google Drive, and GitHub without the victim's knowledge.
Grant De Swardt, an independent AI consultant in East Sussex, U.K., discovered unexplained token usage on his Claude Max 20x account in early August, leading to an investigation by Anthropic that revealed a compromised session key was used to mint unauthorized tokens. The company has warned users that infostealer malware is being used to steal login sessions, and multiple subscribers have reported similar incidents.
· 2 sourcesMicrosoft released updates for at least 974 security vulnerabilities on Tuesday, shattering its previous record of 570 set in July 2026. The September Patch Tuesday bundle includes two actively exploited zero-day flaws and 113 critically rated bugs, while security experts warn that organizations are struggling to keep pace with the growing patch load.
A fraud network dubbed "DoppelCart" is running more than 119,000 fake online stores designed to steal payment card details, according to German cybersecurity startup Nebty, which describes it as the largest publicly documented fake-shop cluster by domain count.
A sophisticated Linux rootkit targeting F5 BIG-IP APM devices has been observed deploying a fileless web shell directly into memory, according to security researchers. The malware, which Sophos and ESET have analyzed, is believed to be a second-stage payload delivered after exploiting CVE-2025-53521, a critical remote code execution vulnerability that F5 reclassified from a denial-of-service issue in March.
Microsoft released a record-breaking September 2026 Patch Tuesday, fixing approximately 972 vulnerabilities across its product line — including two actively exploited zero-days. The patch haul, which Ars Technica reports as roughly 972 flaws and BleepingComputer puts at 966, dwarfs the previous record of 620 set just last month. The update is bundled with the Windows 10 extended security update KB5122878 for ESU subscribers and enterprise LTSC users.
· 2 sourcesMicrosoft released its largest-ever Patch Tuesday update on September 8, 2026, fixing a record 966 security vulnerabilities across its product line, including two zero-day flaws that attackers are actively exploiting in the wild. The update follows the company's adoption of an AI-powered vulnerability discovery system and represents a sharp escalation from the 570 flaws patched in July and 400 in August.
Microsoft has shattered its own Patch Tuesday record with 974 security fixes this month, including two zero-day vulnerabilities already under active exploitation, as the company continues to grapple with a wave of vulnerabilities discovered by AI models. Adobe simultaneously issued 172 patches, including an emergency fix for a Magento and Adobe Commerce zero-day that is already being abused to compromise online stores.
· 3 sourcesSAP has released its September 2026 security updates, addressing 20 vulnerabilities including two critical flaws: a maximum-severity memory corruption vulnerability in the SAP Kernel dubbed OVERPASS, and a critical authentication bypass in the NetWeaver Message Server named S4GET, which together could allow unauthenticated attackers to fully compromise SAP systems and access sensitive business data.
Data theft and extortion crews are actively stealing companies' proprietary AI data and threatening to leak it unless ransoms are paid, according to Google's threat intelligence team. In two newly detailed intrusions — one at a healthcare company and another at an AI media generation firm — attackers exfiltrated AI models, research, source code, and secrets before demanding payment. Google warns the trend is likely to expand as AI assets become increasingly valuable targets.
An Advance Passenger Information System (APIS) database containing more than 220 million passenger and crew records, including passport numbers and flight details, was left accessible online through a chain of security misconfigurations, security researchers Kinryū Labs have discovered. The exposed data, spanning January 2017 to April 2026, appears linked to a Vietnamese organization and could affect travelers of many nationalities who flew to, from, or through Vietnam during that period.
Adobe has released an emergency security patch for a critical zero-day vulnerability in Magento and Adobe Commerce, designated CVE-2026-75650 and dubbed StyleSmuggler, that has been actively exploited since at least September 4 to deploy backdoors on vulnerable e-commerce servers.
· 2 sources