Tag: emerging threats
8170 articles
Magento Zero-Day Exploited to Install Linux Backdoor
A newly discovered zero-day vulnerability, dubbed "StyleSmuggler," is being exploited in the wild to install a stealthy Linux backdoor on over 160,000 Magento and Adobe Commerce sites, including 14,000 of the top 1 million sites. This alarming attack has already hit a target running the latest security updates, leaving many sites vulnerable.
Google Discloses Chrome 0-Day Under Active Exploitation
Google just revealed a high-severity Chrome zero-day vulnerability, CVE-2026-85046, that's being actively exploited by hackers, allowing them to execute malicious code inside the browser's sandbox. This type confusion bug in Chrome's V8 engine was reported by researcher Salvatore Gulizia on August 4, 2026.
Microsoft 365 Targets in Fake IT Call Data Theft, Extortion Scheme
Beware of fake IT calls that can trick you into giving away your Microsoft 365 login credentials - scammers are using a clever vishing scheme to steal account details and hold them for ransom. It starts with a convincing phone call from someone claiming to be from IT, directing you to a fake authentication page.
Pakistan's HIT Unveils Advanced Drone Production Facility
Pakistan's Heavy Industries Taxila (HIT) has just unveiled a cutting-edge drone production facility, marking a major milestone in the country's military tech advancements. The state-of-the-art Unmanned Aerial Systems Factory is set to churn out a range of innovative drones, from surveillance models to loitering munitions.
Vehicles Cloaked to Evade Flock Camera Surveillance
A recent test has raised eyebrows, showing that a specially designed camouflage can evade detection by Flock cameras and Axon body cameras, sparking questions about the effectiveness of other surveillance technologies. Will upgrades to these systems be enough to catch visually altered vehicles, or will new methods be needed to stay one step ahead?
Phishing Service BigBear Exposes 258 Firms to MFA Bypass
BigBear 2.0, a sneaky phishing-as-a-service operation, has compromised 258 companies by bypassing multi-factor authentication (MFA) for Microsoft 365 users worldwide, swiping 5,137 credential records in the process. This cunning attack used an adversary-in-the-middle approach to intercept passwords, MFA tokens, and session cookies, allowing hackers to hijack authenticated sessions with ease.
Russians Target Signal Users with Phishing Attacks
Stay vigilant, especially on holidays like Labor Day - even company staff aren't immune to unexpected messages, as Nightwing's CEO recently proved when a message meant for employees somehow made its way to The Register. This incident serves as a reminder to always be cautious when receiving unsolicited messages.
NCSC Warns of Shadow AI Security Risks
Employees are increasingly turning to AI tools outside of company-approved systems, a phenomenon known as "shadow AI," which poses significant security risks. A staggering 71% of UK employees have already admitted to using unauthorized AI tools at work.
Telerik UI Flaw Exposes Unauthenticated RCE Risk
A newly discovered flaw in Telerik UI for ASP.NET AJAX can be exploited to achieve unauthenticated remote code execution, thanks to a publicly released proof-of-concept that combines an AES-CBC padding oracle with a type-resolution bug in the RadAsyncUpload control. When certain preconditions are met, this vulnerability can be easily leveraged for devastating effect.
Rogue ScreenConnect Clients Propagate VBScript Worm
A sneaky VBScript worm is spreading rapidly through new ScreenConnect connections, launching a four-stage attack chain that wreaks havoc on unsuspecting hosts. This malicious chain was triggered by three distinct initial access routes, including tech-support scams, phishing, and fake refund forms.
Cloud Security Risks Diverge Sharply Across Providers
The cloud security landscape is far from equal, with a staggering 76% of AWS accounts showing exposed services, compared to just 8% on Google Cloud - a massive gap that highlights the limitations of one-size-fits-all cloud security checklists. This stark disparity underscores the need for a tailored approach to cloud security, one that takes into account the unique risks of each provider.
N-able Patches Remote Code Execution Flaw in N-central Platform
A critical vulnerability, CVE-2026-86218, was discovered in N-able's N-central platform, allowing unauthenticated attackers to execute code on the server - and a patch is now available in N-central 2026.3 Hotfix 4. Update now to prevent potential remote code execution attacks!
Hackers Drain $320M in Bitcoin from Liquid Network in Alleged White-Hat Heist
In a shocking twist, hackers made off with around $320 million in Bitcoin from the Liquid Network, but claim they're "white-hats" with good intentions. Roughly 4,000 BTC was drained from the federation wallet in a mysterious heist that's left the project reeling.
Mathspace Breach Exposes Data of 1 Million People
A massive data breach at Mathspace has compromised the personal information of over 1 million students, school staff, and parents or guardians across Australia, New Zealand, the US, and the UK. The breach exposed sensitive data, leaving thousands of people vulnerable to potential identity theft and security risks.
Trezor Breach Expands to 81,000 Customers After Data Leak
Trezor warned that nearly 81,000 customers are at risk of phishing scams after a data breach exposed sensitive information that could be used for fake emails, calls, or letters. If you're one of them, be on high alert for suspicious contact attempts!
Rhysida Ransomware Gang Publishes Stolen Berlin Government Data
The Rhysida ransomware gang has published stolen data from Berlin's government on the dark web after the city refused to pay a €2m ransom, defying the hackers' ultimatum. Berlin's government had stood firm, prioritizing the safety of its staff and citizens over giving in to blackmail.
North Korea's Lazarus Fractures into Six Cyber Clusters
Meet the six distinct cyber clusters that now make up North Korea's notorious Lazarus group, each with its own unique tactics and targets. A single cryptocurrency theft of $62.5m highlights the alarming intersection of crime, statecraft, and corporate infiltration.
NRW FoI blunder exposes 2,000 staff diversity records
Natural Resources Wales has apologized for a significant data blunder that exposed diversity records of around 2,000 staff members, sparking concern and uncertainty for those affected. The organisation confirmed that a spreadsheet containing sensitive staff diversity data was inadvertently disclosed on a website.
Hackers Exploit MikroTik Router Flaws to Hijack Devices
Hackers are actively exploiting vulnerabilities in MikroTik RouterOS, using a two-step attack dubbed "MikroTrick" to hijack devices, warns Poland's Computer Emergency Response Team. The team has confirmed that the critical severity flaws, tracked as CVE-2026-67276 and CVE-2026-86060, are being used in real-world attacks.
N-able Rushes Fourth Hotfix for Unauthenticated RCE Flaw in N-central
N-able has urgently released a fourth hotfix in just five weeks to tackle a critical, unauthenticated remote code execution flaw in its N-central software, affecting all on-premises builds prior to version 2026.3.1.14. All users of these outdated versions must apply the latest fix to safeguard against this maximum-severity vulnerability.
OpenAI's ChatGPT Integrates with Personal Apps to Mimic User Writing Style
Get ready to have ChatGPT write in your own voice! This new Writing Style feature uses examples from connected apps like Slack and Google Drive to help the AI mimic your unique writing style.
UK Food Supply Chain Faces Rising Cyberattack Threats
The UK food supply chain is under growing threat from cyberattacks, with the National Audit Office warning that the sector's drive for efficiency has also increased its vulnerability to disruption. Cyber threats are rising in likelihood and severity, and experts are urging the government to strengthen emergency preparedness plans.
ConnectWise Discloses New ScreenConnect Flaw, Offers Mitigations
ConnectWise has uncovered a new vulnerability in its ScreenConnect platform that affects file transfer behavior in Remote Access Support and Access sessions, and is providing temporary mitigations until a patch is released later this week. To protect your systems, apply these manual workarounds now.
Tech Giants Forge AI Security Alliance
Major tech players have joined forces to create an AI Security Alliance, aiming to develop and share cutting-edge defenses to protect software and AI agents from emerging threats. By working together, they promise to make crucial cybersecurity tools more accessible as AI continues to advance.