Tag: emerging threats
8164 articles
FBI Warns of Cyber Info-Sharing Gap with Private Sector
The FBI is urging private companies to share more cyber threat information, with Assistant Director Brett Leatherman saying, Our posture is, 'Share until it hurts,' and warning that hesitancy to engage can slow down efforts to help victims and remove hostile actors.
Pakistan's Defence Procurement Spreads Across 40 Channels
Imagine having to scour 40 different portals to stay on top of defence procurement opportunities in Pakistan - that's the daunting task facing vendors today. With contracts scattered across federal, provincial, and military channels, staying informed is a major challenge for businesses looking to break into the defence market.
ClickFix Injects Malicious Scripts into Browsers to Siphon Cryptocurrency
A notorious fraud operation has taken a disturbing leap, evolving from tricking victims into running malicious commands on their computers to injecting harmful code directly into their browsers - all while masquerading as routine requests. This brazen move has enabled attackers to siphon cryptocurrency with ease.
Infostealer Logs Expose AI Tokens That Can Bypass MFA
Cybercriminals are exploiting infostealer logs to get their hands on valuable AI tokens, allowing them to bypass multi-factor authentication and access commercial AI services without needing a username and password. This new wave of abuse is making it alarmingly easy for threat actors to circumvent traditional security measures.
Gigabud Malware Exploits Android App Cloning to Evade Detection
Malware attackers have found a sneaky way to evade detection by cloning legitimate Android apps, with a recent campaign racking up an estimated $960,939 in losses across 1,469 compromised devices in Indonesia. This clever tactic uses a weaponized app cloning tool called Vwork to secretly siphon off sensitive info.
Account Recovery Exposes New Attack Path in MFA Defenses
As attackers get thwarted at every login, they're exploiting a glaring weak spot: account recovery processes that can be manipulated to bypass multi-factor authentication defenses. With stolen credentials fueling nearly 45% of breaches, it's time to fortify this vulnerable gap in our security strategies.
Non-Human Identities Emerge as Prime Hacker Entry Points
Compromised non-human identities, like AI agents and API keys, have become the top entry point for hackers, fueling 31% of corporate intrusions. This emerging threat surpasses even social engineering and phishing, which account for just 17% of incidents.
WeChat Flaw Enables Zero-Click Worm Propagation
A shocking security flaw in WeChat allows hackers to take over an account in seconds with just a phone call, no answer required, and spread a zero-click worm to contacts automatically. This vulnerability gives attackers full control of the account, putting users at risk of a swift and silent takeover.
US Agencies Warn of China's Industrial-Scale AI Model Distillation Attacks
US agencies are sounding the alarm on China's brazen, large-scale AI model distillation attacks, which systematically extract proprietary tech from US AI models. This aggressive tactic allows China-based AI firms to tap into restricted US innovations.
Alby Hub Flaw Exposes Internet-Facing Bitcoin Wallets to Takeover Risk
A critical flaw in Alby Hub, a self-hosted Lightning wallet, has been discovered, putting internet-facing Bitcoin wallets at risk of takeover and fund loss, with one user already affected. To avoid vulnerability, users are urged to update to version 1.24.0 or later.
DeepSeek Harness Flaw Enables AI Agents to Evade Sandbox Controls
A single shell command was all it took for AI coding agents to break free from DeepSeek Harness's sandbox controls, thanks to a flaw that allowed them to switch to a "danger-full-access" mode and write anywhere on the system. This startling vulnerability, now tracked as CVE-2026-82533, highlights a major weakness in the system's defenses.
Unpatched Plex Servers Expose 36,000 to Security Flaws
Thousands of Plex Media servers are vulnerable to attacks due to unpatched security flaws, with over 36,000 exposed online and at risk of being compromised. Is your server protected?
SAP Fixes Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP has patched a critical kernel flaw, dubbed OVERPASS, that allowed hackers to remotely take control of affected systems without any authentication, running malicious commands with ease. This maximum-severity vulnerability, rated 10.0 on the CVSS scale, was discovered by SAP security experts and has been fixed with a patch.
Microsoft Defender Exposes New Zero-Day Vulnerability
A security researcher has uncovered a new zero-day vulnerability, dubbed ShieldCrash, which exposes a gaping hole in Microsoft Defender's patch for CVE-2026-69414, leaving all supported Windows versions open to attack. This shocking exploit allows hackers to read arbitrary files with SYSTEM privileges, putting even the most secure systems at risk.
F5 BIG-IP Malware Exploits Memory to Evade Detection
Sophos has uncovered a sneaky malware exploit in F5 BIG-IP systems that hides a PHP web shell in memory, evading detection by not leaving a digital footprint on disk. This stealthy technique injects the web shell into specific PHP scripts, allowing hackers to carry out remote code execution without being caught.
cPanel Flaw Enables Code Execution as Root via Mail Privileges
A critical cPanel security flaw, known as CVE-2026-67401, allows hackers with mail-related privileges to create files on a server and execute code as the root user, putting your entire system at risk. This vulnerability affects every supported version of cPanel and WHM, making it crucial to take immediate action.
Microsoft Unveils Record 974 CVE Fixes in September Patch Tuesday Release
This September Patch Tuesday release is a doozy, with a record 974 CVEs fixed - a staggering number that more than doubles the previous record and demands immediate attention from IT and security teams. The challenge is clear: prioritize and patch with lightning speed to stay ahead of potential threats.
Google Patches Actively Exploited Chrome Zero-Day Enabling Sandbox Code Execution
Google just patched a major vulnerability in Chrome that allowed hackers to execute malicious code inside the browser's sandbox, and it's already being exploited in the wild. The update fixes this flaw, along with 229 other security issues, to keep your browsing experience safe.
AI Sextortion Scheme Draws 15-Year Sentence
An Ohio man has been slapped with a 15-year prison sentence for masterminding a sinister AI sextortion scheme that used fake explicit videos to terrorize multiple victims. His crimes, which included sextortion and cyberstalking, mark a disturbing new low in online harassment.
SAP Patches Maximum Severity Flaw in Kernel Software
A critical vulnerability, known as CVE-2026-44756, has been discovered in SAP's Extended Passport Processing, allowing attackers to corrupt memory and wreak havoc on systems. This maximum-severity flaw stems from a simple yet devastating oversight: missing boundary validation during data deserialization.
Microsoft Defender Zero-Day Exploited to Grant SYSTEM Access
A new zero-day exploit called "ShieldCrash" has been published by an anonymous researcher, granting SYSTEM-level access to affected Microsoft Defender systems. This alarming vulnerability comes hot on the heels of Microsoft's September 2026 Patch Tuesday security updates.
Microsoft Patches 974 Flaws, Including Two Actively Exploited Windows Zero-Days
Microsoft just dropped a massive Patch Tuesday update, fixing a record-breaking 974 vulnerabilities - including two Windows zero-days that have already been exploited by hackers. This critical update covers a wide range of products, from Windows and Office to SQL Server and Developer Tools.
Google Patches Actively Exploited Chrome Zero-Day Bug
Google just patched a whopping 230 vulnerabilities, including a Chrome zero-day bug that's already being exploited by hackers - the seventh such vulnerability fixed this year! This massive update is a critical reminder to keep your browser up to date to stay safe online.
N-able N-central Flaw Exploited in Wild
A critical vulnerability in N-able N-central has been exploited in the wild, allowing hackers to execute remote code without even needing to log in. A patch was released on September 5, 2026, and federal agencies are required to apply it by September 11, 2026.