Cyber Security News

Hackers turned a Microsoft SQL Server into a channel for running commands and moving collected files in an intrusion linked to a Viva Aerobus environment. Their own publicly accessible server then exposed attack tools and stolen material to unrelated internet users. The activity, observed between September 25 and 29, 2026, involved credential harvesting, source code […]

The post Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel appeared first on Cyber Security News.

Hackers are turning trusted software updates into a route for stealing developer and cloud credentials. Recent supply chain incidents show how a single altered package, build action, or publishing token can place malware inside routine development workflows. The risk is not limited to one product or programming community. After obtaining a maintainer token or access […]

The post Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials appeared first on Cyber Security News.

Red Hat has fixed a high-impact vulnerability in Red Hat Satellite that could allow a low-privileged authenticated user to access sensitive host information, including root passwords. Under unsafe configurations, the flaw could also escalate to arbitrary command execution as the Foreman service account. Tracked as CVE-2026-96659, the issue affects the Foreman component used by Red […]

The post Critical Red Hat Satellite Flaw Could Enable Root Password Theft and Code Execution Attacks appeared first on Cyber Security News.

Multiple security flaws in cPanel & WHM could let attackers run malicious scripts in an administrator’s browser session or execute arbitrary commands as root. The vulnerabilities were disclosed on September 29, 2026, and affect all supported cPanel & WHM versions before the vendor’s patched releases. Administrators should update immediately, as a successful attack against the […]

The post Multiple Cpanel/WHM Vulnerabilities Allow Arbitrary Command Execution On Server appeared first on Cyber Security News.

OpenClaw has launched OpenClaw Enterprise (OCE), a free, open-source platform that helps organizations run persistent AI agents with stronger security and central oversight. Announced on September 29, 2026, the project targets businesses that want agents to handle ongoing work without giving them unchecked access to sensitive systems. The platform remains under development ahead of its […]

The post OpenClaw Launches Free Open-source Enterprise Agent Platform for AI Agents appeared first on Cyber Security News.

Exposed WordPress backups have become a valuable source of cloud and email credentials for attackers using a toolkit called TIKTOUK. Rather than relying on one technique, its components search websites for sensitive files, recover stored passwords, and collect secrets from JavaScript delivered to visitors. The operation was already active at scale when researchers first observed […]

The post Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials appeared first on Cyber Security News.

Two critical Zammad zero-day flaws, reportedly exploited against the Dutch Institute for Vulnerability Disclosure (DIVD), could allow session hijacking, remote command execution as the Zammad service user, and potential root privilege escalation. The vulnerabilities are tracked as CVE-2026-102489 and CVE-2026-102490. DIVD published the findings under case DIVD-2026-00015 after investigating a separate breach case involving its […]

The post Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access appeared first on Cyber Security News.

Security researcher Timo Longin, working with the SEC Consult Vulnerability Lab, disclosed two email spoofing flaws in Apple’s iCloud mail infrastructure that could have let someone with a free iCloud account send messages that appeared to come from any @icloud.com address. The crafted messages could pass SPF, DKIM, and DMARC checks, the core controls used […]

The post Free iCloud Account Could Let Attackers Spoof Any @icloud.com Address and Pass Email Security Checks appeared first on Cyber Security News.

Sony has moved to protect PlayStation 5 consoles with its latest system software update, as the newly released Relapse jailbreak draws attention to a broad set of older PS5 firmware versions. The update matters for console owners because the public Relapse exploit supports PS5 and PS5 Pro systems running firmware versions 7.00 through 13.60, allowing […]

The post Sony Rolls Out PS5 Security Update Following the Release of Relapse Jailbreak appeared first on Cyber Security News.

A flaw in a custom session-cookie system allowed an unauthenticated attacker to pose as employees and administrators in a yard management platform. The issue did not break Microsoft Entra ID itself. Instead, it let a weak application-side session layer accept a forged identity after the normal sign-in controls had been bypassed. The affected platform used […]

The post Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users appeared first on Cyber Security News.

The Federal Trade Commission has opened an investigation into OpenAI, Anthropic and other artificial intelligence companies over potential risks their products pose to customers. An agency spokesperson confirmed the probe to CNBC on September 30, bringing fresh attention to how advanced AI systems are tested, controlled and released. The spokesperson declined to identify the other […]

The post FTC Investigating OpenAI, Anthropic and Other AI Models Over Potential Risks to Customers appeared first on Cyber Security News.

Hackers have built a Windows backdoor that uses Microsoft 365 for all its native command and control communications. Named Antino, the malware turns Outlook messages and OneDrive files into channels for issuing instructions, moving stolen data, and maintaining access to compromised computers. The wider campaign began in September 2025 and targeted government, defense, diplomatic, academic, […]

The post Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365 appeared first on Cyber Security News.

Authorities have identified a 16-year-old as the suspected main operator of the KillSec ransomware group after an international law-enforcement operation disrupted the group’s infrastructure and led to three arrests. The coordinated action, involving authorities from nine countries and supported by Eurojust and Europol, targeted a group linked to almost 1,000 ransomware incidents worldwide. Eurojust said […]

The post 16-year-old Alleged KillSec Ransomware Group Leader Arrested, Servers Dismantled appeared first on Cyber Security News.

A fake Zoom installer is tricking Mac users into handing over their login passwords and launching CloudSyncD, a newly identified backdoor. The malware hides inside an application that looks familiar, using installation instructions and counterfeit prompts to turn routine setup into a privileged infection. The first sample appeared on September 15, 2026, while still under […]

The post Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor appeared first on Cyber Security News.

A China-aligned hacking group tracked as TA419 has impersonated a senior Anthropic employee and well-known policy figures to target US artificial intelligence experts. Proofpoint linked the activity to credential-phishing campaigns aimed at researchers at think tanks, universities, and law firms, with lures designed to steal access to their cloud accounts. The targeting likely supports Chinese […]

The post Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts appeared first on Cyber Security News.

A China-nexus threat actor is continuing to exploit Microsoft SharePoint Server vulnerabilities to deploy Warlock ransomware, with recent attacks striking essential-service and public-sector organizations across Portuguese- and Spanish-speaking countries. Symantec tracks the operator as Longlegs, while Microsoft uses Storm-2603; earlier activity has also been linked to CL-CRI-1040, CamoFei, and ChamelGang. During the past two months, […]

The post Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators appeared first on Cyber Security News.

A WordPress backdoor is bringing deleted malware back within seconds, turning routine cleanup into a cycle of reinfection. Called SC, the infection spreads its working parts across website files, the database, and server memory, allowing surviving components to restore those removed. The investigation does not establish the original entry point or the number of affected […]

The post WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor appeared first on Cyber Security News.

Microsoft has enabled Windows settings backup by default for eligible devices running Windows 11, version 26H2, turning an opt-in function into a baseline resilience capability. The change, generally available from September 29, applies only when administrators have left the backup policy in the Not Configured state; existing explicit enable or disable decisions remain authoritative. The […]

The post Microsoft Enables Windows 11 Backup Setting by Default for Organizations appeared first on Cyber Security News.

Hackers are abusing Microsoft Defender Antivirus exclusions to keep malicious files outside routine security scans. Rather than switching protection off completely, attackers can leave antivirus running while creating gaps around malware staging folders and selected file types. This is an established evasion technique, not a new malware family. It requires administrator privileges or higher, making […]

The post Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans appeared first on Cyber Security News.

A critical vulnerability in Next.js could allow remote code execution in applications that use the Node.js implementation of ImageResponse from the next/og package. The issue, tracked as GHSA-vcvr-r3jv-pc5j, affects Next.js versions 16.2.0 through 16.3.5 and has been fixed in version 16.3.6. The flaw exists when an application passes attacker-controlled input into SVG content, SVG attributes, […]

The post Node.js ImageResponse Implementation Vulnerability Enables Remote Code Execution appeared first on Cyber Security News.