Intelligence Feed

1mo ago · hacker-news

A critical vulnerability, CVE-2026-89026, in the Issabel Framework is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary operating system commands. The flaw stems from a hard-coded JSON Web Token (JWT) signing key used across all installations, enabling attackers to forge valid bearer tokens. These tokens can be used to call the '/pbxapi/manager/originate' endpoint with the System application parameter, resulting in command execution as the Asterisk user. A patch was released on August 1, 2026, which replaces the hard-coded key with one stored in a configuration file.

1mo ago · bleeping-computer

A banking malware operation active since mid-2025, dubbed KREMLIN, has been force-installing malicious Chrome and Edge extensions to steal credentials, session tokens, and other sensitive data. The malware bypasses Chromium's integrity checks by copying extensions into browser profile directories and modifying Secure Preferences using extracted encryption keys and regenerated HMACs. The infection begins via malicious JavaScript files disguised as financial documents, establishes persistence through scheduled tasks, downloads Node.js, and retrieves payloads from Ethereum smart contracts or images hosted on the Internet Archive.

1mo ago · bleeping-computer

Iranian state-linked hackers are deploying a Windows malware named CHOSEN BRICK to conduct cyber espionage against dissidents, activists, and journalists globally. The malware is distributed via social engineering lures on messaging platforms like WhatsApp and Telegram, using disguised malicious files that mimic legitimate applications. Once installed, CHOSEN BRICK collects system information, steals communications from email and messaging apps, captures screenshots, records audio, and can download additional payloads or wipe the system. Data is exfiltrated through Telegram or cloud services, with newer variants using SOCKS5 proxies for stealth.

1mo ago · hacker-news

A high-severity vulnerability, CVE-2026-87886, in the Acronis Backup plugin for cPanel & WHM and Plesk has been exploited in limited, targeted attacks. The flaw allows local privilege escalation due to insecure file permissions, enabling low-privileged attackers to escalate privileges and execute arbitrary code on affected Linux systems. Acronis has released patches, urging all users to update immediately, though details about the attackers or their objectives remain unknown.

1mo ago · hacker-news

Google has patched a high-severity privilege escalation vulnerability in the Pixel Cellular Modem, tracked as CVE-2026-58704, which has shown signs of limited, targeted exploitation in the wild. The flaw stems from a logic error that allows remote, proximal escalation of privilege without user interaction, enabling zero-click attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by September 19, 2026. No specific threat actor or campaign has been attributed, and technical details about the exploitation remain limited.

1mo ago · hacker-news

A vulnerability in Parallels Desktop for Mac, tracked as CVE-2026-90894 and dubbed ParaShells, allows non-admin local users to gain root privileges by exploiting a world-writable socket and command injection in the prl_disp_service. The flaw affects versions prior to 27.0.0 and is actively exploitable on Apple silicon Macs; however, Intel Macs cannot install the fixed version (27.0.0 or later) due to dropped hardware support. JFrog, which discovered the issue, demonstrated a working exploit involving tar command injection via a maliciously crafted directory path, enabling privilege escalation to root without network access.

1mo ago · hacker-news

An attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider and used it to recommend a poisoned PyPI package, which was accepted by a developer. This allowed the attacker to install an infostealer, steal GitHub OAuth tokens, and deploy the self-spreading Shai-Hulud worm across approximately 100 internal code repositories. The attacker also poisoned a package in the company's official namespace, leading to a second infection when another employee pulled the compromised version.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a critical-severity vulnerability in ConnectWise ScreenConnect, tracked as CVE-2026-84869. The flaw, which stems from improper privilege management and missing authorization, allows attackers with basic privileges to transfer or execute files during active remote sessions without requiring user interaction. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate it within three days. Over 1,000 unpatched instances remain exposed globally, primarily in North America and Europe, posing significant risks to federal and enterprise networks.

1mo ago · securelist

NightEagle (APT-Q-95), an advanced persistent threat group active since at least 2023, has expanded its targeting to include Russian organizations. The group initially gains access using compromised credentials and leverages Cloudflare WARP tunnels and European VPS infrastructure. They deploy a .NET-based backdoor called GhostContainer on Microsoft Exchange servers, exploiting CVE-2020-0688 and utilizing cryptographic key extraction from ASP.NET configurations. The backdoor enables command-and-control communication and traffic redirection via proxying. Attackers use legitimate tools such as Microsoft dev tunnels, rdp2tcp, and Impacket utilities for lateral movement and persistence, including exploitation of CVE-2019-0708 (BlueKeep) and DCSync attacks in Active Directory.

1mo ago · hacker-news

A critical vulnerability, CVE-2026-5430, in WSO2 API Manager and related products is under active exploitation, allowing attackers to bypass JWT authentication by using forged tokens signed with unsupported algorithms. This flaw enables unauthorized access, including compromise of administrative accounts and full account takeover. Exploitation attempts have been observed in the wild, with honeypots detecting forged JWT tokens granting administrator privileges as of September 13, 2026. The vulnerability affects multiple versions of WSO2 products, and immediate patching is advised.

1mo ago · hacker-news

Threat actors are actively exploiting a critical vulnerability, CVE-2026-27540, in the WooCommerce Wholesale Lead Capture WordPress plugin to upload arbitrary PHP files, including web shells such as 'shell.php', enabling remote code execution. The flaw stems from missing file type validation in the 'wwlc_file_upload_handler' AJAX action, affecting all versions up to and including 2.0.3.1. Attack attempts have been observed from multiple IP addresses, with over 100,000 exploit attempts blocked by Wordfence since June 2026.

1mo ago · bleeping-computer

Google has released the September 2026 security update for Pixel devices, addressing 110 vulnerabilities, including a zero-day flaw (CVE-2026-58704) under limited, targeted exploitation. The vulnerability resides in the Cellular Modem subcomponent and stems from a logic error leading to improper authorization, allowing adjacent network attackers with basic privileges to escalate privileges remotely without user interaction. The update is critical for all supported Pixel devices to mitigate potential exploitation.

1mo ago · bleeping-computer

A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and distributed malicious updates (versions 2.35 and 2.36), which backdoored approximately 1,500 sites. The backdoor created a hidden user account and installed a web shell via a malicious file named wp-user-consent.php. The attacker had likely gained root-level access to the server, prompting the developer to take the site offline and issue cleanup guidance. Customers are advised to check for specific indicators of compromise and restore from clean backups.

1mo ago · bleeping-computer

Acronis has disclosed a high-severity local privilege escalation vulnerability, CVE-2026-87886, in its backup plugins for cPanel & WHM and Plesk, which is being actively exploited in limited, targeted attacks. The vulnerability allows low-privileged attackers to escalate privileges on affected Linux servers, potentially enabling unauthorized access to sensitive data and system disruption. Exploitation has been detected in the wild, though no specific indicators of compromise have been identified. Acronis recommends immediate updates to patched versions to mitigate the risk.

1mo ago · hacker-news

KREMLIN is a Brazilian banking malware operation active since May 2025 that targets Chromium-based browsers to steal credentials, session tokens, and sensitive data. It uses multi-stage JavaScript loaders, C++ installers, and malicious browser extensions, evading sandbox detection by checking hardware properties and process names. The malware leverages Ethereum smart contracts as dead drop resolvers to dynamically update C2 infrastructure and employs DLL sideloading via a legitimate SentinelOne binary. It installs a malicious extension named 'AVSync System Inc.' that exfiltrates browser data through WebSocket and HTTP-based polling mechanisms.

1mo ago · bleeping-computer

Hackers are actively exploiting a critical unauthenticated arbitrary file-upload vulnerability, CVE-2026-27540, in the WooCommerce Wholesale Lead Capture plugin for WordPress. The flaw allows attackers to upload PHP webshells by manipulating the wwlc_file_upload_handler AJAX action and bypassing file extension checks via a user-controlled parameter. Exploitation attempts have been observed in multiple waves, with over 100,000 attacks blocked by Wordfence. The uploaded webshell, named shell.php, enables host reconnaissance and facilitates deployment of additional malicious payloads.

1mo ago · bleeping-computer

CenterPoint Energy confirmed a data breach in which an unauthorized actor exfiltrated personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed responsibility, stating they extracted 7.49 million records containing names, phone numbers, addresses, account numbers, billing amounts, and partial Social Security numbers by exploiting inadequate security controls on the company's public API, including lack of rate limiting and WAF protection. The company has launched an investigation, engaged third-party experts, and reported the incident to authorities, while confirming that utility services were unaffected.

1mo ago · hacker-news

A mass-scanning campaign has been exploiting CVE-2026-39364, a high-severity vulnerability in Vite, to extract sensitive data from internet-exposed development servers. The flaw allows unauthenticated attackers to bypass file access restrictions by manipulating query parameters, enabling them to retrieve cloud credentials, environment configurations, and infrastructure state files from AWS and Azure environments. Attackers use spoofed User-Agent headers and forged X-Forwarded-For headers to evade detection, with significant malicious traffic originating from Google Cloud Platform IP ranges in the U.S., Belgium, the Netherlands, Singapore, and Taiwan.

1mo ago · hacker-news

A skilled human threat actor exploited CVE-2026-39987, a pre-authenticated remote code execution vulnerability in Marimo, to gain initial access and pivot to an SSH bastion host within eight seconds. The attacker used a custom, hand-rolled Python toolkit to extract AWS credentials from the compromised instance, retrieve a private SSH key from AWS Secrets Manager, and establish SSH access to a bastion host. Over a nine-hour session, the operator executed more than 850 interactive commands without using known offensive tools, demonstrating high tradecraft and evasion capabilities. The activity highlights the speed and precision achievable by skilled human attackers, even without AI assistance.

1mo ago · hacker-news

BambooToken is a multi-platform malware family active since at least February 2023, targeting organizations in Asia and South America. It uses the MQTT protocol for command-and-control (C2) communications, leveraging DLL sideloading of Tendyron's OnKeyToken software to execute on Windows and Linux systems. The malware collects extensive host information, including antivirus details via WMI, and communicates with C2 servers hosted behind Cloudflare, indicating large-scale data collection operations. Recent activity was observed as of July 2026, with infrastructure linked to IP addresses in Singapore, Cambodia, and Vietnam.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the critical VMware vCenter vulnerability CVE-2026-59310, a directory traversal flaw allowing unauthenticated remote code execution, is now actively exploited by ransomware gangs. The vulnerability was patched by Broadcom in July 2026, but attackers have been observed exploiting unpatched systems to deploy reverse SSH tools for persistence and remote access. CISA added the flaw to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate within three days. The broader threat landscape shows a pattern of ransomware groups targeting VMware infrastructure due to its strategic access to enterprise networks and data.

1mo ago · bleeping-computer

BambooToken is a previously unknown malware framework active since at least 2023 that uses the MQTT protocol for command-and-control communications on both Windows and Linux systems. It has been observed compromising enterprise servers in Asia and South America, including those supporting mobile apps, legal and financial services, and software development. The malware is capable of keylogging, clipboard theft, audio and webcam capture, and file manipulation, with a Linux variant (version 2.1) observed in December 2025. While no specific threat actor is attributed, targeting patterns suggest alignment with China-aligned operations.

2mo ago · step-security

Over a 12-month period from August 2025 to August 2026, 56 distinct open source supply chain attacks were observed, with a significant increase in frequency starting in March 2026. These attacks primarily involved malicious compromises of trusted packages across npm, PyPI, RubyGems, Composer, and crates.io, as well as GitHub Actions and IDE extensions, designed to steal CI/CD credentials. A key trend is the rise of self-propagating worms such as Shai-Hulud, CanisterWorm, Miasma, and ChainDrop, which leverage stolen tokens to infect downstream packages at scale. The Team PCP campaign in March 2026 exemplifies the severity, compromising widely used components like Trivy Action, KICS Action, telnyx, and LiteLLM to harvest credentials across major CI/CD platforms.

1mo ago · hacker-news

Multiple threat actors are exploiting a new vulnerability chain involving flaws in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) to deploy an undocumented exploit kit called BlueMoon. The campaigns, primarily attributed to China-aligned groups, have targeted fewer than 20 organizations globally. Separately, a zero-click worm dubbed WeWorm exploits a vulnerability in WeChat (patched in August 2026) to hijack accounts and spread via incoming calls on Android and iOS without user interaction, requiring only that the attacker be on the victim's friends list. Additionally, hackers are deploying a fileless Linux rootkit on compromised F5 BIG-IP APM devices, leveraging CVE-2025-53521 to inject a web shell into memory via PHP eval() calls, tracked by ESET as PoisonedRefresh.

1mo ago · hacker-news

A Chinese threat actor tracked as UTA0560 conducted a spear-phishing campaign targeting NGOs by exploiting a zero-day chain in Google Chrome and Microsoft Windows. The attack abused CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to bypass sandbox protections and execute arbitrary code, ultimately deploying a JavaScript-based backdoor named GRIMWEDGE. This backdoor enables host reconnaissance, command execution, file operations, and payload delivery through a C2 server. A second China-linked group, JungleBamboo (APT31), used the same exploit chain to deploy the SUPERSTOMP loader and the LONGTALE credential-stealing Chrome extension.

1mo ago · hacker-news

A critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76461, is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending a specially crafted email containing malicious SQL statements. The flaw exists in the email parsing logic and affects multiple versions of Cisco AsyncOS Software for Secure Email Gateway. Cisco has released patches for affected versions and recommends immediate updates, as no workarounds are available. The U.S. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 17, 2026.

1mo ago · hacker-news

A critical vulnerability in LiteSpeed Web Server Enterprise, affecting versions prior to 6.3.7, could allow a low-privileged hosting account user to escalate privileges and gain root access on shared servers. This flaw bypasses isolation mechanisms such as CageFS, potentially enabling attackers to access or modify other hosted websites and server configurations. Although cPanel and LiteSpeed have issued an advisory and released version 6.3.7 to address the issue, neither has disclosed technical details, a CVE identifier, or indicators of compromise. The vulnerability has not been publicly exploited as of the report date, but it marks the first such flaw in the web server itself, following two previously exploited flaws in LiteSpeed's cPanel plugin.

1mo ago · bleeping-computer

Cisco has patched a critical zero-day vulnerability, CVE-2026-76461, in its Secure Email Gateway (SEG) software that was actively exploited by threat actors. The flaw resides in the email parsing logic of Cisco AsyncOS and allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to root-level command execution on the underlying operating system. Exploitation occurs by sending a specially crafted email containing malicious SQL statements. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within three days.

1mo ago · bleeping-computer

Hackers hijacked HBO Max's verified Reddit account (u/hbomax) to distribute malicious advertisements as part of a campaign dubbed PasteSwitch. These ads used ClickFix social engineering tactics, tricking users into pasting malicious commands into Windows Run, PowerShell, or macOS Terminal under the guise of installing legitimate software or fixing errors. The attack distributed information-stealing malware such as MacSync and AMOS helper on macOS, and PowerShell-based payloads on Windows, including memory-resident Amatera Stealer. Attackers used domains like hbomaxx[.]us and infrastructure including ember-bridge[.]com to deliver payloads and rotate between campaigns targeting both general users and developers.

1mo ago · bleeping-computer

The Twitch Enhanced Viewer | JeetBot browser extension, with over 30,000 installs on Chrome and Firefox, captures users' Twitch OAuth tokens and sends them to proxy servers controlled by JeetBot, a commercial Russian-language streaming and chatbot service. The tokens are transmitted as cleartext in URL query parameters when video playlist requests are proxied, exposing them in server logs. Earlier versions of the extension openly admitted to collecting OAuth tokens, claiming it was necessary for HD streaming functionality. Security researchers recommend users uninstall the extension, revoke Twitch sessions, and re-authenticate to mitigate exposure.