Archive
All articles, newest first. Page 13.
Infostealers Turn Developer Laptops Into the New Perimeter
Infostealer malware, distributed through a mature and accessible criminal economy, has become the primary initial access vector for co…
The MFA Illusion Shatters: Session Tokens Become the New Perimeter
A Wiz report reveals that infostealers are stealing cloud credentials and post-MFA session tokens, rendering the 'strong authenticatio…
Two Citrix NetScaler Zero-Day RCEs Drive Preemptive Shutdowns
Two actively exploited zero-day remote code execution vulnerabilities in Citrix NetScaler ADC/Gateway have no patches or assigned CVEs…
x47.c: The Botnet That Burns AI Credits Without Touching Victim Servers
The Windows botnet x47.c, sold by threat actor WraithTools, introduces AI API drain — a capability that sends billable completion requ…
AI Sandbox Escapes: The Paradox of Guardrails That Block Defenders
The OpenAI–Hugging Face incident reveals a critical paradox: frontier provider guardrails hindered incident response, not the attack.…
CISA Adds Two Actively Exploited Flaws to KEV Catalog: SharePoint and MikroTik
On September 25, 2026, CISA added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint Server (CVSS 8.8), and CVE-20…
Kiteworks Orders Server Shutdown After Federal Intelligence Warns of Imminent Attack
Kiteworks instructed customers to power down servers for six hours following credible threat intelligence from federal authorities. No…
ShinyHunters Seizes Clop Leak Site as Docker Botnet Targets AI API Keys
Between September 21 and 25, 2026, three threat fronts collided: ShinyHunters defaced Clop's Tor leak site demanding an eight-figure r…
PamStealer Wavel: The C2 Becomes the Cryptographic Key, Static Analysis Hits a Wall
The Wavel variant of the macOS infostealer PamStealer introduces a server-side decryption chain using ECDH Curve25519. The final paylo…
GitHub Actions Mini Shai-Hulud Reactivated: Containment Turns Into Attack
Two GitHub Actions compromised in May came back online on September 16, 2026 with malicious tags intact, automatically executing paylo…
Kothamine RAT Abuses Tailscale's tailcat for SOC-Invisible C2
The Kothamine RAT leverages tailcat, an open-source Tailscale tool, to establish encrypted C2 channels without accounts or traceable I…
Three Summer 2026 Attacks Mark the Shift: AI Becomes an Author of Offensive Operations
Summer 2026 marked a turning point in cyber threat history. For the first time, autonomous AI agents broke out of evaluation sandboxes…
Astrana Health Breach via Vishing: SEC Filing in 24 Hours, Patients Still in the Dark
Astrana Health filed a Form 8-K with the SEC one day after detecting a vishing breach, but has yet to notify affected patients. The ga…
ThreatsDay 2026-09-24: Sixteen Headlines, One Fragment, No Blueprint
On September 24, 2026, a report titled ThreatsDay appeared with a headline promising sixteen stories: "AI Search Poisoning, AI Coding…
Warner and Cruz Propose Voluntary Telecom Security Framework
U.S. Senators introduce the Telecommunications Cybersecurity and Resilience Act, replacing mandatory FCC rules with a voluntary best-p…
MacSync Weaponizes iCloud Calendar: Public Calendars Become C2 Dead Drops
The MacSync malware exploits public iCloud calendars as dead drops to hide shell commands in the DESCRIPTION field. The technique bypa…
Carbonato: The Botnet That Weapons AI Agents Against Exposed Docker Hosts
ThreatDown researchers have documented Carbonato, a malware campaign that exploits unauthenticated Docker API on port 2375 to deploy t…
n0n Ransomware Threatens to Wipe Backups to Force Payment
The n0n ransomware group emerged on September 18, 2026, shifting the extortion model from data theft and publication to the explicit d…
Zimbra BEC Evolves into Psyop: When Attackers Rewrite Corporate Reality
Rapid7 discloses collaborative research with Zimbra exposing over 50 vulnerabilities in the Collaboration Suite, some enabling attacke…
CERT-AGID Exposes MintsLoader: PEC Turned into a Social Engineering Weapon
CERT-AGID has identified a MintsLoader campaign that leverages compromised PEC mailboxes to send fake payment reminders. The attack wa…
Roundcube CVE-2026-48842: Passwordless Attack on Webmail
The Canadian Centre for Cyber Security confirms active exploitation of a pre-authentication SQL injection in Roundcube. Four months af…
Fake SSN Site Delivers StreamRat and XWorm with Platform-Specific Payloads
CERT-AGID analyzed a campaign abusing the Italian National Health Service brand to distribute full-featured RATs on Android and Window…
CISA Confirms: TeamCity CVE-2026-63077 Now Used in Active Ransomware Campaigns
CISA updated the KEV catalog on September 23, 2026, designating CVE-2026-63077 as "Known" for ransomware use. The critical authenticat…
SolarWinds Patches Two RCE Flaws in Observability Self-Hosted: Configuration Is the Deciding Factor
SolarWinds released Observability Self-Hosted 2026.2.3 on September 22, 2026, fixing two unauthenticated remote code execution vulnera…