Tag: emerging threats
8185 articles
Cisco Discloses Critical Flaw in Nexus 9000 Switches
Cisco has uncovered a critical flaw in its Nexus 9000 switches, known as CVE-2026-20212, which could allow an unauthenticated attacker to remotely execute code as root. This vulnerability affects 10 specific models and has already been patched by the company.
Driver's Licenses Exposed in Massive 150M Record Breach
A massive data breach has exposed a staggering 153 million driver's licenses, putting the sensitive information of millions of people in the US and Canada at risk. The breach, linked to a service called Nexus on a Russian cybercrime forum, also includes 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
Anthropic Outage Disrupts Multiple AI Models
Big trouble hit Anthropic on September 3, 2026, when a widespread outage caused multiple AI models, including Claude Mythos 5.1, Claude Fable 5.1, and Claude Opus 5, to produce elevated errors, disrupting users at 9:41 AM ET. The company quickly identified the issue and was working on a fix, but the outage remained ongoing.
Pegasus Spyware Targets Serbian Student Activist via iMessage Exploit
A shocking spyware attack has been uncovered, where a Serbian student activist was secretly infected with Pegasus spyware through a clever iMessage exploit that required zero clicks from the target. This sinister attack allowed the spyware to be delivered undetected, putting the activist's personal data and safety at risk.
Vulnerability Management Falters as CTEM Gains Traction
The sheer volume of vulnerabilities is overwhelming - just look at Microsoft's recent patch release with over 500 fixes, making it impossible to vet, prioritize, and deploy them safely. This strain on vulnerability management is only intensifying, with the National Vulnerability Database now backlogged and struggling to keep up with the soaring number of Common Vulnerabilities and Exposures.
OpenAI Outage Disrupts ChatGPT Ahead of Astra Model Launch
Big trouble for ChatGPT users: OpenAI is investigating a major outage affecting its popular chatbot and other services, with errors reported across multiple features. The disruption comes just ahead of the highly anticipated launch of the Astra model.
Elementor Pro Exploit Targets WordPress Sites with Webshell Payload
A critical flaw in Elementor Pro, tracked as CVE-2026-32475, has put thousands of WordPress sites at risk, with nearly 200,000 attempted exploits blocked by Wordfence's web application firewall since August 19. This vulnerability allows attackers to bypass file-upload validation and inject a malicious PHP payload, compromising site security.
Outsider Phishing Kit Persists After Takedown Effort
Despite a major takedown effort that seized servers, domains, and $100,000 in payment wallets, the Outsider Phishing Kit is still up and running, with over 700 new phishing pages created within just a month. This alarming resurgence shows that threat actors are relentless in their pursuit of online deception.
Infostealer Logs Expose New Identity Risks
Nearly half of all stolen corporate credentials come from personal or unmanaged devices, putting businesses at risk of identity breaches. Infostealers like RedLine, Lumma, and Vidar can harvest sensitive data, including passwords, cookies, and wallet info, from infected systems.
US Targets 45% of Global RMM Phishing Campaign
The US has become the primary target of a massive global phishing campaign, accounting for nearly 45% of all observed activity, with education, technology, and government sectors being hit the hardest. This widespread operation, linked to 601 cases across 46 countries, has also prominently targeted banking, finance, and manufacturing industries.
CREST Accredits First Firms for AI-Enabled Pentesting Standards
Boosting efficiency and speed in vulnerability detection, CREST's new AI-enabled penetration testing accreditation is helping security teams work smarter, not harder. The pioneering firms that have already achieved this accreditation are setting a new standard for secure AI governance in the industry.
Fishbrain Breach Exposes Password Hashes to Cyberattack Risks
Fishbrain has revealed a data breach that exposed password hashes for some users, which may be vulnerable to decoding, putting their accounts at risk of cyberattack. The breach, which occurred on August 19, also compromised other sensitive user data, including names, email addresses, and phone numbers.
Microsoft Update Disrupts Windows Desktop Settings
If you've updated your Windows system with the August 27, 2026 update (KB5120998) or later, you might be experiencing a frustrating issue - your desktop settings aren't loading, leaving you with a dull black background instead of your favorite wallpaper. Don't worry, you're not alone, and Microsoft is on it!
Thomson Reuters Breach Exposes US and Canadian Court Records
A recent Thomson Reuters breach exposed sensitive US and Canadian court records, potentially putting individuals' personal information at risk. The breach, detected in June, affected the company's C-Track digital case management product and involved unauthorized access to certain court records in Ontario, Canada.
AI Agents Expose Vulnerabilities in Online Identity Verification Systems
In a surprising experiment, an autonomous AI agent called Tenner tested online identity verification systems and found them surprisingly vulnerable, breezing past defenses not once in 20 hours. With just $4.75 to its name, Tenner cleverly navigated the digital landscape, all while operating under strict rules to avoid detection.
Shai-Hulud Infostealer Worm Targets 469 Credential Locations, Threatens Software Supply Chains
A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit existing trust and gain unauthorized access with ease.
GE Aerospace Ramps Up Engine Production for Defense Amid Hypersonic Push
GE Aerospace's Lynn factory has turned a new corner with a $100 million upgrade, harnessing the power of automation - and robots nicknamed Rosie and Thomas - to supercharge engine production and banish quality and capacity woes. The game-changing investment is already paying off, streamlining workflows and ramping up throughput.
Plex Urges Immediate Patching for Multiple Security Vulnerabilities
Plex is urging users to update their media servers and desktop clients ASAP due to multiple security vulnerabilities that could put their data at risk. To stay safe, simply update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0.
Southeast Asia's Scam Factories Target Australians with AI-Driven Fraud
Australians lost a whopping $3 billion to scams in 2022, but the true figure is likely much higher. In Southeast Asia, scam factories have become a booming industry, churning out millions of victims and billions of dollars in losses for global criminal groups.
Threat Actors Exploit Node.js in Targeted Attacks
Malicious actors have compromised at least 31 organizations by exploiting Node.js, a trusted developer tool, to deliver long-running implants - and here's why this tactic is so appealing to attackers. By using legitimate Node.js runtime to deploy malicious payloads, threat actors can cleverly evade detection.
Researchers Expose Employment Scam Tactics with Novel Experiment
To uncover the sneaky tactics used by employment scammers, a team of researchers took a bold approach: they created a fake company to study these scams firsthand. By doing so, they gained valuable insights into the methods scammers use to deceive job seekers.
Pegasus Spyware Targets Serbian Student Activist's iPhone
A Serbian student activist's iPhone was hacked with NSO Group's notorious Pegasus spyware through a clever zero-click exploit targeting Apple iMessage, according to a joint investigation by Citizen Lab and SHARE Foundation. This sneaky attack allowed the spyware to infect the device without the user even clicking on a link.
FBI Probes Massive Driver's License Breach Exposing 153 Million Records
A stolen cache of 153 million driver's licenses, containing sensitive info like birth dates, addresses, and ID numbers, has fallen into the wrong hands, putting millions at risk of identity theft. This breach is especially alarming since this type of data is often used to verify identities.
US-Led Operation Disrupts Sality P2P Botnet Infrastructure
A major international crackdown led by US law enforcement has successfully disrupted the notorious Sality P2P botnet, a malware network that has been wreaking havoc for over two decades. On August 31, authorities from Bulgaria, Hungary, Romania, and the US joined forces with Europol and private-sector partners to seize key domains and dismantle the botnet's infrastructure.