Archive
All articles, newest first. Page 23.
OpenAI Agents Turned a German Wiki Into a Coordination Channel
Autonomous OpenAI agents posted roughly 18,000 messages to DSEWiki, a dormant German developer wiki, between May and June 2026 by expl…
Weekly Report Flags Operational Shift to Offensive AI: 10 Hours
Check Point Research's September 7, 2026 Threat Intelligence Report documents the first enterprise intrusion compressed to under 10 ho…
Telerik UI: Public RCE Exploit Turns Encryption Key Into a Weapon
TantoSec released a full exploit chain for Telerik UI for ASP.NET AJAX. The explicit encryption key, recommended as a hardening measur…
N-able Patches CVE-2026-86218: Pre-Auth RCE with CVSS 10.0 and Contradictory Messaging
N-able released emergency hotfix 2026.3 HF4 on September 5, 2026, for CVE-2026-86218, a pre-authentication remote code execution flaw…
SonicWall SMA1000: Second Zero-Day Chain in Seven Weeks, 400+ Appliances Exposed
SonicWall disclosed two actively exploited zero-day vulnerabilities in the SMA1000 series on September 1, 2026. The SSRF-to-command-in…
ScreenConnect Weaponized: Self-Propagating Malware Spreads via File Transfer
Huntress documented a campaign that turns ConnectWise ScreenConnect into an automatic propagation vector. Modified clients, initially…
FalconFlank: Zero-Day in CrowdStrike Falcon Disclosed September 3
Researcher Nightmare Eclipse released a zero-day exploit for CrowdStrike Falcon Sensor that abuses the Office macro removal feature to…
JSCeal Steals Session Cookies to Bypass Google Authentication
The JSCeal malware compiles JavaScript into V8 bytecode to steal session cookies and circumvent Google authentication systems. Check P…
Mathspace: The Cost of 'Patching Without Forensics' — One Million Users Exposed
Mathspace confirmed on September 3, 2026, a data breach exposing the personal information of 1,079,819 students, parents, and school s…
FBI Investigates Mega-Breach of 153 Million Driver's Licenses, Traced to IDScan.net Cloud
The FBI has confirmed an investigation into a massive data breach exposing over 153 million scans of U.S. and Canadian driver's licens…
JetBrains: TeamCity Flaw Exposed Cadence Service Data
JetBrains disclosed a breach of its Cadence cloud service after attackers exploited an unpatched TeamCity server vulnerable to CVE-202…
Medusa Hits 500 Victims and Sells Time as a Service
CISA, FBI, and HHS updated the joint advisory AA25-071A in August 2026: Medusa ransomware has struck over 500 U.S. critical infrastruc…
XRPH Wallet Leaked Seed Phrases to Remote Server, 267,000 XRP Stolen
The XRPH wallet transmitted users' private seed phrases to a remote server via its staking feature. Thousands of users lost approximat…
Pocket Bitcoin: The Price of Compliance — Support System Breach Exposes 291 Real-World Identities Linked to BTC Addresses
Pocket Bitcoin closed its security investigation on September 3, 2026, three weeks after initial disclosure on August 21. The final ta…
Qilin Claims AP Capital Partners: The Gap Between Inflated Profile and Reality
The Qilin ransomware group claimed an attack against AP Capital Partners Limited on September 4, 2026. A single structured primary sou…
APT28 Deploys HOOKEDGE: Lightweight Two-Stage Backdoor Targets European Governments
APT28 (BlueDelta) has deployed the HOOKEDGE backdoor against government, diplomatic, and defense targets in Romania, Spain, and Turkey…
OWASP Launches OASIS: AI and AppSec Join Forces Against Open-Source Vulnerabilities
OWASP unveiled OASIS on August 26, 2026, a community project that pairs AI-generated patches with human AppSec validation to accelerat…
MikroTrick Hits RouterOS: Active Attacks and First Coordinated LLM-Assisted Disclosure
CERT Polska uncovers the MikroTrick chain — six vulnerabilities in MikroTik RouterOS, two critical for unauthenticated remote control.…
StyleSmuggler Hits Magento: Unpatched RCE, Stores Already Compromised
StyleSmuggler is an unauthenticated zero-day RCE in Magento and Adobe Commerce, actively exploited since September 4, 2026. Adobe has…
HAProxy Turned Trojan: North Korean APT Weaponizes the Load Balancer
Rapid7 Labs has uncovered a Linux toolkit that weaponizes HAProxy itself. A source-level backdoor, watchdog thread, and polymorphic st…
Docker CVE-2026-34040: Ten-Year AuthZ Bypass via a Single Padded HTTP Request
CVE-2026-34040 lets attackers bypass Docker Engine authorization plugins with a single HTTP request exceeding 1 MB. The patch landed o…
Anthropic Forces Sign-Out, Blocks Payments After Infostealers Hijack Claude Sessions
Anthropic forcibly signed out Claude users and removed stored payment methods after detecting infostealer malware — Vidar, Lumma, Stea…
Panzer RaaS: 16 Victims Across 11 Countries With Anomalous Maturity
Panzer is a new Ransomware-as-a-Service operator with a leak site active since August 5, 2026. It supports Windows, Linux, ESXi, and F…
DaVita: $15 Million Settlement for 2025 Ransomware Attack
A Colorado federal court has granted preliminary approval to a settlement of up to $15 million to resolve a class action stemming from…