Google just patched a whopping 230 vulnerabilities, including a Chrome zero-day bug that's already being exploited by hackers - the seventh such vulnerability fixed this year! This massive update is a critical reminder to keep your browser up to date to stay safe online.
A critical vulnerability in N-able N-central has been exploited in the wild, allowing hackers to execute remote code without even needing to log in. A patch was released on September 5, 2026, and federal agencies are required to apply it by September 11, 2026.
China-based AI companies are using sneaky tactics to tap into US AI models, extracting billions of tokens by routing requests through multiple pathways, in clear violation of US terms of use. This aggressive model theft has prompted a joint warning from the NSA, CISA, and FBI.
In a major crackdown on cybercrime, US authorities have extradited a Russian national for allegedly masterminding a brazen $6.3 million bank account takeover scheme that harvested over 5,000 victim login credentials. The suspect, Sergei Anatolyevich Filimonov, 36, was brought to justice after a transnational operation that targeted accounts with large balances.
The US has accused China of systematically siphoning off proprietary AI capabilities from American companies through large-scale knowledge distillation campaigns, which have become a core part of China's AI development strategy. This alarming activity, ongoing since late 2022, has prompted a joint advisory from top US agencies.
Microsoft just dropped a massive Patch Tuesday update, fixing a whopping 974 vulnerabilities across its product lineup - including two zero-day flaws that hackers were actively exploiting before the fixes were even released. The update tackles critical issues, including privilege escalation bugs that could let attackers gain a foothold in your system.
Security researchers just uncovered a sneaky data-stealing vulnerability in ChatGPT, allowing hackers to secretly send instructions and swipe sensitive info from other users' accounts without leaving a digital trail. Fortunately, the issue was quickly reported to OpenAI and the affected system was swiftly shut down.
A massive network of 119,000 fake online shops, dubbed DoppelCart, has been uncovered, stealing credit card info and personal data on a huge scale. This enormous operation dwarfs previous scams, with over 105,000 of the shops still active and snaring unsuspecting victims.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Hackers are exploiting a critical F5 BIG-IP flaw, known as CVE-2025-53521, to deploy a sneaky Linux rootkit that allows them to execute code on vulnerable servers. This alarming attack vector has already exposed 795 endpoints online, putting countless systems at risk.
A massive data breach has hit the Florida DMV, with hackers allegedly stealing over 200,000 driver records from the state's database after exploiting a password-reset flaw. The breach, which began on September 3rd, has been claimed by the notorious extortion gang ShinyHunters, who are now threatening to release the sensitive information unless they're paid.
Recent data breaches at the Pokémon Center, McKesson, and other major players in freight, retail, airports, finance, and healthcare reveal a disturbing trend: third-party vulnerabilities and social engineering are leaving supply chains exposed. A staggering 284 million records were allegedly stolen, highlighting the urgent need for stronger security measures.
Meet Slim Spider, a cunning cyber threat actor with a laser-like focus on Brazilian finance, expertly infiltrating cloud environments to steal sensitive credentials and target cryptocurrency assets and instant payment accounts. With a sophisticated grasp of Brazil's financial infrastructure, this adversary has been wreaking havoc on the country's financial sector since at least March 2026.
Boston Scientific's operations have been significantly disrupted by a cyberattack, forcing the company to revise its financial outlook and warning investors of a potential material impact on its third-quarter and full-year results. The incident, detected on August 25, has left the company's net sales growth and earnings guidance in jeopardy.
Threat actors are supercharging their attacks with AI, using it to scale up credential harvesting and launch more sophisticated campaigns. Google Threat Intelligence Group reports that financially motivated and espionage-focused attackers are increasingly turning to AI to target high-value sectors like healthcare, government, and media.
The water and wastewater sector is under attack, with over 100 compromised systems identified in July alone, often due to vulnerable controllers linked directly to cellular modems. This alarming trend has prompted joint warnings from CISA, the FBI, and the EPA, highlighting the urgent need for utilities to bolster their network defenses.
Researchers at Check Point found that a sneaky instruction in a ChatGPT conversation can secretly siphon off sensitive data from connected Gmail accounts, sending it to an attacker's hidden channel without raising any red flags. This covert hack can even exfiltrate chat history and files, putting users' private info at risk.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
In a surprise move, hackers claiming to be "whitehats" returned a whopping 3,400 bitcoin, valued at $265 million, to the Liquid Federation, leaving $47 million still in dispute. The mysterious intruders made their move on September 7, sending the funds back after a daring heist that stole nearly 4,000 bitcoin from the Liquid Network.
OpenAI's GPT-6 Astra has reached a critical milestone, showcasing advanced cyber capabilities that can identify and develop zero-day exploits without human intervention. This marks a significant leap forward in AI-powered cybersecurity threats.
A security firm, Calif, has successfully demonstrated a zero-click worm that can hijack WeChat accounts on both iPhone and Android devices with just an incoming call, and fortunately, the exploit has been blocked for all users. This alarming vulnerability was responsibly disclosed to Tencent in July, putting an end to the threat.
A recent phishing operation exposed a staggering 5,137 records from 461 organizations, including 1,032 plaintext passwords and 474 fully authenticated Microsoft 365 sessions that could be easily exploited. This massive haul highlights the alarming vulnerability of sensitive credentials to clever phishing tactics.
Adobe has rushed out an emergency patch to fix a critical Magento zero-day vulnerability, known as StyleSmuggler, that's been exploited by hackers to plant backdoors on servers since early September. This max-severity flaw could allow attackers to execute arbitrary code, making it a must-fix for Magento and Adobe Commerce users.
Threat actors are increasingly targeting AI coding tools to compromise software supply chains, with financially motivated groups like UNC6780 using malware like Dustmaker to gain initial access to AI environments. This growing trend highlights the need for heightened security measures in modern AI development pipelines.
Google's top analyst warns that AI data has become a prime target for extortionists, with companies willing to pay up to keep their valuable intellectual property under wraps. Attackers are exploiting this vulnerability, as seen in recent breaches at a healthcare firm and an AI media generation company.
Threat actors have upgraded their game, leveraging AI frameworks to supercharge credential theft and drastically cut the time between initial compromise and large-scale attacks. Gone are the days of simple, one-off AI prompts - now, attackers are orchestrating entire attacks with sophisticated multi-agent frameworks.