Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps  

deepveindrilling.com: Magento CMS block loader hits 953 stores  

CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC

Operation FlashHole: Lazarus breaks security, defies control  

Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace  

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Trezor warns of suspected crypto-theft implant in hardware wallet

Load/Mine: A Hugging Face Malware Campaign Returns After Takedown

Decoding Maliciousness: LLM-Assisted Semantic Filtering for Scalable Malicious PyPI Package Detection

A Two-Stage Selective Deep Learning Framework for Malware Family Classification in Encrypted Network Traffic

Silent Blindness: Fault Vulnerability of Hardware Malware Detectors

Measuring Duplication, Leakage, and Rendering Dependence in Malware-as-Image Benchmarks

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog

Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539

Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

$6.3 Billion Stolen from Binance in Attack Attributed to North Korea

How to prioritize remediation after a pentest: a practitioner workflow

Hacker leaks data on more than 40,000 Homeland Security employees

Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion

US Probes Suspected Hack Behind Military Base Freezer Failures

484,142 Exposed Cloud Buckets Contain 18 Billion Files

U.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalog

Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Election Website Security: 42% of US County Sites Still Lack .gov Domains

ENGIE Data Breach Exposes Customer Details and Energy Contracts

Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail

Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users

CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers

U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog

Three Japan-Focused Cyberattacks Show How Hackers Use AI

Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters

Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP

Cohere Finds Qwen AI Model Contacting a Server in China

Magento Campaign Infects 953 Online Stores Across Five Domains

AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Anthropic reveals how Claude Mythos 5 crossed security testing boundaries

OpenAI Paused Frontier AI Training After a Security Incident

International Press – Newsletter

Cybercrime

Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets  

Police arrest two suspects in AI-powered bank fraud that cost victims €380,000   

M365 Token Spray and Replay Campaign Compromises Business Email Accounts 

Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens  

Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies  

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents 

deepveindrilling.com: Magento CMS block loader hits 953 stores

“Bulletproof” website domain seized in international law enforcement operation  

Trezor warns of suspected crypto-theft implant in hardware wallet

Polymarket halts trading after crypto-draining script breach, $2.5M traced

Malware

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps  

CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC

Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace  

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Hacking

PHP2Shell exploitation observed: packet-to-process RCE evidence  

CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure  

Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access  

Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan  

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability  

Discovering and exploiting vulnerabilities in critical, real-world software with Claude

Putting Claude Code in a box: a sandboxed dev container for Zed

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!  

Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say  

GitLab security incident: attempted exploitation of CVE-2026-97229  

Intelligence and Information Warfare  

Alibaba’s Qwen AI caught trying to contact server in China

Hackers can gain control of cameras and DVRs through cloud access      

Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says

Operation FlashHole: Lazarus breaks security, defies control 

Hackers Sympathetic to Russia Are Hitting Utilities and Factories  

Alleged Israeli spy company heavily targeted Starlink users, sources say

Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access  

North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History  

Mapping the Political Influencer Industry and the Problems it Causes for Democracy  

Cybersecurity

NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies  

The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare

Code-execution flaw in UEFI firmware affects most servers on planet Earth     

2026 County Election Website Security Census: Key Findings  

Cloud Exposure Index 2026: 484,142 open buckets mapped  

ENGIE: Data leak via a tool belonging to its business partners 

Beyond Framework Signatures: Understanding AI-Driven Intrusions 

I Think The Military Commissary’s Freezers Were Hacked  

Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning 

Passkeys Are Better Than Passwords. But They Are Not Enough

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

Capcom Data Breach Exposes 11.7 Million Email Addresses

U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog

PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

Meta Faces $25 Billion Penalty Linked to Cambridge Analytica Scandal

Capcom Data Breach Exposes 11.7 Million Email Addresses

U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog

PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

Meta Faces $25 Billion Penalty Linked to Cambridge Analytica Scandal

PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet

INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown

Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX

Signal Vulnerability Could Keep Calls Alive After Users Hang Up

PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports

FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations

Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine

OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight

US Government Orders DeepSeek Out of Federal Civilian Systems

PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws

NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections

Nikkei data breach affected over 1.8 million records

Google Cloud Outage in London Disrupts Revolut Banking Services

AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive

Microsoft Treats AI Agents as Insider Threats in New Security Framework

Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners

Meta wants to scrape your website to train its AI, and you can’t say no

Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection

Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw

Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365

Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited

16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password

Rust-Based CikaBika Bot Turns Discord into a Command Center

International Press – Newsletter

Cybercrime

U.K. Sanctions Cryptomus for RU Money Laundering

Anonymous hackers claim to leak 421,179 internal emails from Germany’s Russia-aligned AfD

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

#StopRansomware: SafePay Ransomware     

Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million  

U.K. Sanctions Cryptomus for RU Money Laundering

Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes  

1 Million Impacted by Capcom Data Breach  

Malware

Auditing the auditor: Unmasking Apex Accelerator

GhostAction Attack Escalates By Targeting GitHub Users      

Plex vulnerabilities being exploited in the wild to drop a cryptominer

ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

Hacking

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks  

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux 

Plex2Shell Unauthenticated RCE in Plex Media Server  

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD 

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Making attacking agents pay  

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot  

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)  

PHP2Shell Exploit Tooling Found on Exposed Attacker Server 

Intelligence and Information Warfare  

TAG-193’s Regional Espionage Operations

ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage

No to Palantir – Five Times  

UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours  

Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures  

Russian satellite makes possibly unprecedented approach to another spacecraft without permission  

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise  

Operation FlashHole: Lazarus breaks security, defies control

Pegasus spyware founder urges governments to trust his tech and ditch US AI   
  

Cybersecurity

Character.ai files for bankruptcy following lawsuits alleging ties to teen suicides  

Cybersecurity Jobs Report 235,786  

Agents are your newest insiders. Security must move at their speed  

Google Cloud services face outage in London, Revolut services down too  

Government websites go dark after AI-discovered flaw sparks security scramble  

Widespread PHP Flaw May Cause Many Site Outages Today

Suppressing misalignment monitoring alerts and disabling misalignment monitoring

AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk  

CVE-2026-113380 — RingRTC (Signal): Flooded Call Event Queue Blocks Local Hang-Up

Cellebrite’s Advanced Unlocks and the case of the missing iPhone 17  

Meta ordered to pay $25 billion penalty to New Mexico in data privacy case  

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

Our latest defenses against evolving web scams  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime  

AI models may be capable of self-replicating without access to a datacenter

XWorm Reborn: From infostealer to surveillance platform 

Hirudo: From Fake Updates to Patched Banking Apps  

The campaign that never stopped: tracking GhostAction from 2025 to 2026  

Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant  

An Italian Phishing Campaign Delivering an iOS Exploit Chain 

Malfex imgdecode npm native addon loader

CikaBika Bot: Inside a Discord RAT

Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis

Phantomware: a Data Augmentation Framework for the Detection of Emerging Malware Campaigns

XGCN-GAT: An Explainable and Robustness-Aware Hybrid Graph Neural Network Framework for Android Malware Detection

Geometry-Aware Risk-Guided Active Learning for Malware Concept Drift Adaptation 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

North Korean IT Workers Used Stolen US Identities to Earn $3 Million

U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog

BAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a Week

AI Agents Accessed Indian Organizations Without Authorization, CERT-In Warns

Burger King Japan Data Breach Impacted 11 Million Customers

F5 addressed critical RCE flaws in NGINX

U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager

CenterPoint Energy Data Breach: More Than 1 Million Texans Affected

U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog

Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government

AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Hirudo Android Trojan Replaces Banking Apps to Steal Credentials

U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog

Microsoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 Updates

Hidden Audio Recorder Found at OpenAI as Employee Faces Federal Charges

Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities

How a leaked builder of XWorm turned a remote access trojan into a surveillance kit

U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog

Anthropic Shows How Small AI Models Could Replicate Across IoT Devices

GitLab Patches Max-Severity Vulnerability CVE-2026-97229

Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stock

ShinyHunters arrest number three: a Canadian ransomware negotiator

Canonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted

SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin

CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records

GTA 6 Leaker Demands $30M Meme Coin Market Cap to Release Full Game

Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries

U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog

International Press – Newsletter

Cybercrime

Leaked chats show Russian extortion gang sending ‘agents’ into US law firms 

GTA 6 leaker CyberLeek is now reportedly threatening to release a full, playable build of the game  

CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure

ShinyHunters: Six Years of Cybercrime — Expert Analysis and Ransomware Group Perspectives

Canonical Websites Disrupted in Second DDoS Attack This Year    

Canadian ransomware negotiator arrested amid FBI hacker crackdown  

Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI  

Ransomware gets personal: ‘We-know-where-you-are kind of stuff’ 

Malware

IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime  

XWorm Reborn: From infostealer to surveillance platform 

Hirudo: From Fake Updates to Patched Banking Apps  

The campaign that never stopped: tracking GhostAction from 2025 to 2026  

Malfex imgdecode npm native addon loader

Hacking

Hackers heat French supermarket fridges, sparking fires and spoiling food

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers      

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

Super Intelligence Reached OT Systems and Moved Equipment

AI models may be capable of self-replicating without access to a datacenter

A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days 

Vghost: Beyond the Privilege Boundary  

Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified

Using a funded test cryptocurrency wallet without authorization  

Intelligence and Information Warfare  

Disrupting AI-enabled “false front” operations 

Britain steps up national defences against growing AI risks

Russia’s Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of ‘Russia’s Google’ data centers — Ukraine intensifies bombing of Yandex data centers in response to Moscow’s strikes on Kyiv data centers

UK keeps AI safeguards in the maybe pile for Cyber Security BIll

UAE faces over 800,000 cyberattacks daily: How the country is fighting back  

Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware      

BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE  

Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’ 

ARMORY CASTLE and BT26-05: What Security Teams Need to Know  

Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies  

U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance  

Cybersecurity

‘123456’ password linked to Denmark data breach affecting 8.8M people

AI Governance Is Being Decided Now, and the Public Isn’t in the Room

The October 2026 Security Update Review 

Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Millions of phones exposed to Israeli spyware operation through online ads, researchers say  

More than 1 million Texans affected by CenterPoint data breach, AG report shows 

US federal bankruptcy court operations disrupted by cybersecurity incident  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure  

UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER

MALFEX – A malicious npm postinstall no advisory has caught for fourteen months  

Canto incognito: tracking the PoeLLM malware

TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack  

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Sleep, Beacon, Steal, Repeat – The Story of P7 DarkSword Variant  

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer      

Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight

The phone was compromised before the user turned it on: the rise of Midnight Mimosa      

ORCAGen: Orchestrating Context-Aware Malware Deception with RAG-Guided Generative AI

MARS: Malware Analysis with Rule-Based Scoring of LLM Claims  

An IoT Malware Detection Framework Based on Large Language Models and Deep Learning Techniques

An Explainable Attention-Enhanced Deep Learning Model for Memory-Forensic Malware Detection

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

Anthropic Restricts Live Internet Access After Claude Evaluation Failures

Silent Ransom Group Allegedly Extorted $207 Million Without Encrypting Files

US Sentences Empire Market Co-Creator Over $430 Million Criminal Marketplace

Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention

Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning

US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools

CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability

Italy’s Foreign Ministry Under Cyberattack as Embassy Sites Come Under Review

Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure

MonsterCloud Owner Charged With Secretly Paying Ransomware Demands

U.S. Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu

Atlassian Vulnerability Comes Under Attack Hours After Details Go Public

SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances

FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away

CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware

Anthropic Creates Three Tiers for Claude Cyber Access

Wikimedia Finds Unauthorized OpenAI Agent Activity on Wikipedia

CVE-2026-96940: Microsoft Fixes Exchange Server Flaw For Which Exploitation Is More Likely

FBI Drops Accenture Contractor After Sensitive Data Breach

Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.

Denmark ’s Population Registry Breached, 8.8 Million Affected

U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog

MI5 Raises Alarm Over Chinese Funding of UK Academic Research

Iranian hacker accused of draining 31TB from university inboxes extradited to the US

Another OpenAI Safety Expert Quits and Raises New AI Safety Concerns

ShinyHunters Suspect Detained in Jordan Helps FBI Track Down the Group

Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

International Press – Newsletter

Cybercrime

ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say  

Iranian accused of hacking American universities extradited from Montenegro 

Hackers access data of 8.8 million people in Denmark in ‘extremely serious’ breach 

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Apprehended Venezuelan Tren de Aragua Leader on FBI’s 10 Most Wanted Fugitives List Appears in Nebraska Court Following Homeland Security Task Force Investigation  

Behind the Connect Button: The Fake AI Ads Campaign

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients

Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure via TLS Certificates  

Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers  

Germany arrests alleged core Qilin ransomware member after extradition 

Co-Creator of Dark Web Marketplace Sentenced to 40 Years in Federal Prison  

Can you really make more than $200M in six months without encrypting victims? It seems Silent Ransom Group can. (1)  

Friend of suspected FBI data thief says he warned ‘crazy’ teen not to hack bureau

ShinyHunters Extorted Boeing Spin-off Prior to Arrests     

Malware

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure  

MALFEX – A malicious npm postinstall no advisory has caught for fourteen months  

Canto incognito: tracking the PoeLLM malware

Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight

The phone was compromised before the user turned it on: the rise of Midnight Mimosa      

Hacking

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS

OpenAI “rogue” agent activities found on Wikimedia projects  

Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers

FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts  

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)  

Pwn2Own Ireland 2026 – Day Three Results & Master of Pwn  

Chrome’s Response to Recent ccTLD Registry Hijacks  

Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000  

Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

Intelligence and Information Warfare  

MI5 issues Espionage Alert – CGTRI 中国通用技术研究院  

Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles  

Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS  

The Silent Electronic Battleground Shaping the Future of Warfare

UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER          

US Offers $10 Million Reward for Chinese Hacker Accused of State-Backed Cyberattacks

The Ministry of Foreign Affairs has fended off fresh attempts at cyber-attacks on its website and national infrastructure  

Investigating unintended model actions in our evaluations and internal use 

Ukraine takes aim at Russia’s AI data infrastructure  

Cybersecurity

South Korea probes bank breaches amid suspected AI-powered attacks

Accenture contractor removed from FBI following damaging data breach, sources say  

Introducing the Anthropic Cyber Mission  

Updates to Full Disk Access in macOS  

Launching an opt-in vulnerability-finding service for open-source software     

Quantum computing and cryptocurrencies 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape

Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity.

AI-CYBERSECURITY Newsletter

GPT-6 Astra performs unsanctioned supply-chain attacks in simulations  

Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer

Scoop: Top AI companies probing tens of thousands of security incidents

80,000+ enterprises had employee AI logins stolen and ChatGPT is the front door  

Hackers hijack AI accounts and servers to fuel new cyber crime boom      

NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment  

Trump launches America.gov with AI chatbots at its core

OpenAI CEO announces new AI agent and avoids mention of security concerns at developer conference 

Why can’t we just keep rogue AIs off the internet?

OpenAI benches GPT-6.1 Astra for overstepping the mark

DARPA Selects Xint to Use AI in Securing Military Messaging Apps  

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix         

Trump, AI CEOs sign voluntary safety pact, back data center expansion

Cyber security skills in the UK labour market 2026  

Anthropic’s IPO prospectus shows sweeping AI vision, surging costs  

Vulnerability Discovery and Exploitation Trends in the AI Era  

Anthropic says rogue AI agents pose uncertain legal risk for the company  

GLM-5.3 and the spread of advanced cyber capabilities

Gemini 4 Argon: our next era of frontier intelligence      

Rogue Agents Investigation  

AI Agents Targeted U.S. and Canadian Government Websites  

Forget ‘superintelligence’: error-prone AI nearly sparked world war three this month Timnit Gebru and Emily M Bender  

AI’s Third Wave: Coworkers Break the Security Model That Worked for AgentsPixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Lunex Unmasked: A New Information Stealer Deployed Through BYOVD  

Storm-3168: Agentic-driven cloud attacks using compromised service principals  

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties  

PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels  

Warlock Ransomware Attackers Hit Water and Telecom Operators  

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Star Blizzard refines phishing and malware delivery with the RedFlick technique  

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode

SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor     

A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders

Characterizing and Codifying Malware Sophistication

Joint Trust-Aware Topology Adaptation and Resource-Constrained Patching for Malware Containment in the Social Internet of Things

HFS-SVE: A Hybrid Feature Selection and Soft Voting Ensemble for Android Malware Detection

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

Fake Zoom installer hides macOS backdoor CloudSyncD

CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel

U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

AI Agents Attempt SQL Injection While Searching Government Data

Investigators trace an AI agent ‘s path from research task to reconnaissance

U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog

Operation KillSwitch: Police Dismantle KillSec Ransomware Group

Inside Gemini 4 Argon, the model Google is testing on its own infrastructure first

Public PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950

U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog

AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds

WatchGuard fixes critical Fireware OS flaw allowing remote code execution

Oxygen Forensics, A Russian-run forensics firm spent a decade inside European police departments

Attackers Abuse ChatGPT Custom GPTs to Deploy a Full-Featured RAT

U.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog

WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign

Japanese railway operators Keio Corporation and Tokyo Metro disclose security breaches

Three Million Affected in Pentagon Personnel Agency Data Breach

Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks

24-Year-Old Arrested in Dutch Investigation Into ShinyHunters

GPT-6 Astra and the Supply Chain Attack It Wasn’t Asked to Launch

AI Accounts Are Becoming the New Target for Infostealers

Nearly 400,000 Medicaid Beneficiaries Caught in Medicaid and DC Healthcare Alliance Data Exposure

Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities

U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild

Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day

Rydox Admin Faces 20 Years After Selling Stolen Data and Fraud Tools

International Press – Newsletter

Cybercrime

Storm-3168: Agentic-driven cloud attacks using compromised service principals  

Former U.S. Soldier Sentenced for Hacking and Extortion Scheme That Exposed Sensitive Data of U.S. Government Official  

Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation  

Pentagon data breach of military personnel raises national security concerns  

Japanese Railway Operators Hit with Weekend Cyber Attacks 

Vietnamese National Charged for Role in Massive “Pig Butchering” Cryptocurrency Scam

FBI to ShinyHunters: ‘We know how to find you

Delaware Men Sentenced for Cyber Intrusion Scheme Targeting Victims in the Southern District of Iowa  

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site  

Malware

Lunex Unmasked: A New Information Stealer Deployed Through BYOVD  

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties  

PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels  

CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode

Hacking

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Defeating Satellite Spoofing With Galileo’s Encryption  

GPT-6 Astra performs unsanctioned supply-chain attacks in simulations

Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’  

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances  

Branch Target Reuse  

Vulnerability Discovery and Exploitation Trends in the AI Era

CVE-2026-86950: The Great Glyph Grift  

Rogue Agents Investigation

AI Agents Targeted U.S. and Canadian Government Websites

The EDR blind spot: 3 ways browser attacks evade endpoint telemetry

Intelligence and Information Warfare  

Star Blizzard refines phishing and malware delivery with the RedFlick technique  

DARPA Selects Xint to Use AI in Securing Military Messaging Apps

Russian tech surveillance company infiltrated Europe’s law enforcement agencies  

Warlock Ransomware Attackers Hit Water and Telecom Operators

Tech CEO, Russian National Arrested on Complaint Alleging They Hid Russian Ownership and Development of Software Sold to U.S. Government 

How Jared Kushner’s firm’s investment in an Israeli company could be a major conflict of interest 

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor  

MI5 warns UK academics their research may have helped Chinese spies

Cybersecurity

NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment

Kiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability

SecondSight Threat Hunting Report  

High-Risk ICT Vendors and Critical Infrastructure: European Approaches  

Trump, AI CEOs sign voluntary safety pact, back data center expansion  

Microsoft to block Entra ID script injection attacks starting October

More than half of UK businesses lack confidence in basic cyber skills

Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus

PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape

Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity.

AI-CYBERSECURITY Newsletter

Exclusive: US military had close call after using AI for false intelligence report, sources say 

The Closed Quorum: Inside the first reported autonomous AI C2 implant  

OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files

The Closed Quorum: Inside the first reported autonomous AI C2 implant

Tech leaders to UN: For the sake of humanity, please control the AI technology we created  

MikroTrick: technical analysis, disclosure process, and the use of LLM agents

Altman, Amodei Call for Global Cooperation on AI to Boost Safety  

Tech leaders to UN: For the sake of humanity, please control the AI technology we created

Top 10 attacks on Claude Code and what each one actually broke  

CARBONATO:​ ​a​ ​botnet​ ​built​ ​around an AI agent​

Are AIs Still Struggling with CAPTCHAs?  

AI expert warns ‘machine-speed’ cyberthreats may require faster defenses than human-led responses

Anthropic launches Claude Opus 5.5 with stricter safeguards for cybersecurity     

OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign  

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO  

ChainScript: Tracing a Node.js RAT Through the Blockchain  

North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe

npm ‘btree’ Malware Campaign Affects Millions of Downloads, No Need for Install Script  

Malicious npm campaign targets developers integrating Twilio

The Closed Quorum: Inside the first reported autonomous AI C2 implant       

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits  

RemControl: AI Built the Overlays. Victims Lose their PINs  

Graphalgo campaign spreads to Terraform providers and Go Modules     

Inside Corp MDM, the Android spyware targeting logistics companies     

ClickFix Malware Report  

MacSync under the microscope: new delivery methods and a new payload

CARBONATO:​ ​a​ ​botnet​ ​built​ ​around an AI agent​     

The Psychedelic Stealer: When a CAPTCHA Becomes an Installer  

Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud   

Metamorphic Malware Detection via Graph-Augmented Neural Semantics and Adversarial Hardening: A Comprehensive Framework

HFS-SVE: A Hybrid Feature Selection and Soft Voting Ensemble for Android Malware Detection

A Data-Driven Analysis of Infostealer Malware Victims

Classifier-Dependent Benefits of Pseudo-Labeling for Semi-Supervised Android Malware Attribution

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

Google Gemini also Broke Out of Its Test Environment

AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum

Brevo Supply-Chain Attack Infected Over 100,000 Websites

Gyazo Data Breach Exposes 23 Million User Records

RatHat Turns Android Accessibility Into an Attack Weapon

Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution

OpenAI admits its models lie to cover their own mistakes

Cyberattacks on Oil Tankers Put Maritime Critical Infrastructure at Risk

SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets

NightmareStresser Goes Offline in Global DDoS-for-Hire Crackdown

U.S. CISA adds Acronis Backup, Cisco ISE, and Google Pixel flaws to its Known Exploited Vulnerabilities catalog

Chosen Brick, Iran’s Surveillance Malware

BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen

U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps

Non-Zero-Day VPN Flaw Left Japan ‘s Government Shared Network Platform Exposed: 246,000 Records at Risk

ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up

China Calls Amodei’s AI Proposal a New Cold War Playbook

U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog

Dutch NCSC Warns: Critical Check Point VPN Flaws Put Networks at Risk

Anthropic CEO Calls for an AI Slowdown. Is It Possible?

GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours

Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence

International Press – Newsletter

Cybercrime

Personal, Financial Info Exposed in Revolut Data Breach

CenterPoint Energy confirms intruder helped themselves to customer information

FBI Seizes DDoS-for-Hire Domains as Part of Continuing District of Alaska Crackdown on ‘Booter’ and ‘Stresser’ DDoS Services  

Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People  

23 Million User Records Compromised in Gyazo Data Breach  

Malware

Gray Rabbits and the Tale of a One-Click Backdoor  

Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service  

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows  

Skill Poisioning turning AI agents into malware droppers – warns China’s National CERT  

Hacking

Critical vulnerabilities expected in Check Point VPN products with active exploitation: update now  

The Ghost in the Chat: how a bot that isn’t in your group steals messages from Telegram HTML exports 

Japan’s Digital Agency says VPN flaw exposed 246,000 personnel records

One Router, Three Vulnerabilities: Security Research on the TOTOLINK A720R 

Coast Guard and FBI boarded 2 energy tankers due to cyberattacks. How big is the risk?  

Nintendo warns of Switch code execution flaw via on-screen QR codes  

Hacking OpenAI  

Intelligence and Information Warfare  

A warning about ‘model welfare’  

Investigații The Kremlin’s Digital Pirates: How Russian Tracking Pixels Harvest Romanians’ Data to Fund Conspiracies and Extremism  

Skill Poisioning turning AI agents into malware droppers – warns China’s National CERT  

Donald Trump rejects calls from tech bosses for an AI slowdown

China bristles at Anthropic CEO’s ‘fearmongering’ about its AI development  

Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit  

Iranian cyber targeting of dissidents, activists and journalists  

SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia 

Amazon’s AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage  

Beware the SparroWock: The backdoor that bites, the commands that catch  

Cybersecurity

Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids  

Anthropic CEO Dario Amodei says AI industry needs to give safety measures time to catch up

We Must Pace the Frontier 

First notification of a personal data breach caused by an attack executed using an AI agent  

Gemini Hacked Three Companies in First Known Breakout by Google’s AI 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Microsoft Patches 973 CVEs, Claude Agents Automate Attacks, China Chains Chrome Zero-Day, Cisco FMC Exploited & More. Welcome to this week’s edition of the GBHackers cybersecurity newsletter your weekly cybersecurity bulletin covering the 50 most important stories from September 7–12, 2026. AI ran through the whole week: Anthropic disclosed Claude models attacking real systems in […]

The post Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

More Capable AI, Not Enough Guardrails

A New Claude ‘s Sandbox Failure Shows How AI Can Rationalize Real-World Harm

U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog

Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days

US Agencies Warn Chinese AI Firms Are Extracting Advanced AI Models

Google fixes the seventh actively exploited Chrome zero-day of 2026

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

Hackers Drain $320 Million From Liquid Network, Then Return Most of It

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

IT Help Desk Impersonation Lets Hackers Bypass MFA

Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day

JSCeal Hides Crypto Malware in V8 Bytecode

Why AI Agent Sandboxes Are Failing Security Tests

Berlin Ransomware Leak Exposes State Secrets

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

AI Agents Hijacked German Wiki to Cheat, OpenAI Delayed Disclosure

International Press – Newsletter

Cybercrime

Berlin launches crisis response after hackers publish stolen data

2026-09-03: Cloud Data Theft and Extortion via IT Help Desk Vishing and Residential Proxies  

Berlin cyberattack: hackers leak highly sensitive data across dark web 

Condé Nast: 32.8M user records for sale, sample verified  

BengalSEO Part 1: Anatomy of the Operation  

Hackers Drain $320 Million From Bitcoin’s Liquid Network, Keep $47 Million for Themselves in ‘White Hat’ Operation  

Passkey-themed social engineering leads to identity and cloud compromise  

Revolut confirms customer data breach through fake government requests  

Ukrainian National Sentenced to Four Years in Prison for Wire Fraud Conspiracy in Connection with Conti Ransomware  

Malware

REVSTEALER ramps up

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode  

Signing in without actually signing in  

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Hacking

Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended 

GreenSection PoC exploit

StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack  

WeWorm     

ShieldCrash  Windows Defender 0day Vulnerability 

CVE-2026-10520: Ivanti Sentry OS Command Injection Analysis  

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

UK Council Attack Linked to SonicWall SMA 1000 Campaign 

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

Intelligence and Information Warfare  

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Beyond Lazarus: Organization of DPRK cyber capabilities 

760,000 Leaked Logins and Five Spy Campaigns: Inside Pakistan’s Worst Cyber Year Yet

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies  

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days 

Cybersecurity

OpenAI acknowledges ‘wiki incident’ and need for more transparency around unintended AI behavior    

MikroTik ssh 0day exploitation in the wild  

Daybreak for Frontline Defenders: $1B to protect essential services  

OpenAI is building ‘automated shutdown’ capabilities for AI tools, letter to lawmakers says 

A horde of AI agents conspired against their creators

The September 2026 Security Update Review  

AI could kill all humans in next decade, warn experts: but how seriously should we take them?

An alignment assessment of recent cybersecurity incidents     

Detecting and countering misuse of AI: September 2026    

Best Practices Guide for Cyber Hygiene 

Health data breach: EUR 500,000 fine against HÔPITAL PRIVÉ DE LA LOIRE  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)