Intelligence Feed

1mo ago · hacker-news

PaperCut has released new maintenance versions (26.0.5, 25.0.13, 24.1.10) that replace emergency patches for two actively exploited vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which allow authentication bypass and arbitrary code execution. A suspected Russian-speaking threat actor has exploited these flaws to compromise at least 395 organizations across 48 countries, primarily targeting the U.S. education sector. The attacks involve the use of hundreds of AI agents and originate from the IP address 45.142.193[.]132, with observed activity avoiding certain geographic regions. Customers are urged to upgrade from emergency patches to the fully tested maintenance releases for complete protection.

1mo ago · bleeping-computer

A new Android malware named Mantax Otax, distributed by Indonesian operators via malicious APKs outside Google Play, combines ransomware and spyware capabilities. It encrypts files on devices running Android 9 or older, steals sensitive data including lock-screen PINs, SMS, call logs, WhatsApp and Telegram messages, and enables real-time screen streaming. The malware also harasses victims using full-screen overlays, jumpscare images, and text-to-speech messages to pressure ransom payments, while communicating with C2 infrastructure hosted on Firebase.

1mo ago · bleeping-computer

Following a breach of Brevo, a third-party email provider used by Trezor, threat actors sent phishing emails to approximately 347,000 Trezor customers who had opted into newsletters. The phishing emails, appearing to come from help@trezor.io, claimed a 'hardware microcontroller vulnerability' in Trezor wallets and contained a malicious link designed to trick users into downloading a fake app and revealing their wallet backup seeds. Trezor confirmed the incident affected 2,500 users who clicked the link before the malicious domain was taken down within 20 minutes. No Trezor internal systems were compromised.

1mo ago · hacker-news

The Gigabud banking trojan, attributed to the threat actor GoldFactory, has evolved to use a second malicious app called Vwork to create Android work profiles. This technique isolates a tampered banking app within the work profile, evading malware detection by legitimate banking apps running in the personal profile. The attacker gains full control via Accessibility services, overlays fake login screens, and steals credentials and transaction data. This method has been confirmed in Indonesia, with activity observed across multiple countries, resulting in nearly $1 million in estimated losses.

1mo ago · hacker-news

A Chinese-speaking threat actor is leveraging AI models like Anthropic Claude, Alibaba Qwen, and DeepSeek to automate cyber intrusions against government and financial systems in multiple countries, including Taiwan, Afghanistan, Thailand, and the U.S. The campaign uses an AI orchestration framework called SecFlow to divide tasks among specialized AI agents for reconnaissance, exploitation, and data collection. Exploited vulnerabilities include Log4Shell, Spring4Shell, and Shiro deserialization, leading to web shell deployment and lateral movement using a Go-based backdoor named SecBox. The campaign was first reported in July 2026. Another related campaign involves EtherRAT and TukTuk malware, where attackers deploy ransomware known as The Gentlemen after gaining access via malicious MSI installers and conducting credential theft and lateral movement.

1mo ago · bleeping-computer

A new exploit kit named 'BlueMoon' has been observed in the wild, leveraging chained zero-day vulnerabilities in Google Chrome and Microsoft Windows to achieve remote code execution and privilege escalation. The kit has been used by multiple cyber-espionage groups, including JungleBamboo (APT31) and UTA0560, in targeted attacks against NGOs, aerospace, defense, and manufacturing sectors. BlueMoon exploits three specific flaws: two in Chrome's V8 engine and one in Windows ALPC, enabling sandbox escape and local privilege escalation. The attacks are delivered via spearphishing, with payloads including malware loaders and in-memory backdoors such as Grimwedge and ShadowPad.

1mo ago · bleeping-computer

Cisco Talos identified three threat clusters exploiting two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC): CVE-2026-20079 (authentication bypass, CVSS 10.0) and CVE-2026-20316 (static credentials, CVSS 5.3). UAT-11988, linked to Qilin ransomware affiliates, used static credentials to deploy ransomware after reconnaissance and lateral movement. UAT-11823, attributed to the Sandworm APT group, exploited both flaws to deploy a Cyclops Blink variant for persistent access and credential theft. UAT-12197 deployed a JSP web shell and malicious JAR file to steal credentials. Cisco confirmed exploitation of both vulnerabilities in active attacks.

1mo ago · unit42

This research demonstrates a post-exploitation technique enabling an attacker with root access on a compromised Kubernetes node to spoof workload identities in SPIFFE/SPIRE environments by manipulating Linux cgroup metadata. The attacker can trick the SPIRE agent into issuing legitimate SPIFFE Verifiable Identity Documents (SVIDs) belonging to co-located workloads, enabling identity impersonation and lateral movement. The trust model of SPIFFE/SPIRE collapses when node integrity is breached, as workload attestation relies on unspoofed cgroup information. The researchers developed an open-source tool called Spooffe to automate this attack for defensive testing purposes.

1mo ago · hacker-news

Check Point disclosed two critical vulnerabilities in its Security Gateways and Security Management Server products that could allow unauthenticated remote code execution during VPN certificate processing. The first, CVE-2026-85102, stems from improper certificate trust validation, while the second, CVE-2026-85103, is a heap-based buffer overflow in ASN.1 certificate decoding. Both vulnerabilities carry a CVSS score of 9.8 and affect multiple versions of Check Point's R81 and R82 product lines. While Check Point states the flaws were internally discovered and not yet exploited, mitigation is advised through Live Patch or Jumbo Hotfix updates, though some customers reported delays in patch availability and unclear mitigation instructions.

1mo ago · hacker-news

Threat actors are abusing Google Play's Early Access program to distribute deceptive Android apps that promise rewards, casino winnings, or premium content but fail to deliver. These apps bypass user reviews and ratings, enabling malicious actors to promote them via social media ads featuring AI-generated celebrity deepfakes. The apps often deliver virtual rewards initially but stall progression before withdrawals, serving excessive ads to generate illicit revenue. Additional Android malware families such as Hagaseca, Mantax Otax, StreamRat, and Vwork are also active, with capabilities ranging from remote access and data theft to ransomware and financial fraud.

1mo ago · bleeping-computer

IDScan, an identity verification company, confirmed a data breach in which an unauthorized third party may have accessed or copied customer information stored on its IDScan.net cloud platform. The breach is linked to a dark-web service called 'Nexus' that advertised access to over 153 million driver's license scans, along with millions of other government-issued IDs. The exposed data includes full names, government-issued identification numbers, and scanned images of driver's licenses. IDScan has engaged third-party specialists, is cooperating with federal law enforcement including the FBI, and is offering credit monitoring to affected individuals.

1mo ago · talos

Cisco Talos is tracking active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software: CVE-2026-20079, a critical authentication bypass flaw, and CVE-2026-20316, which allows login via a low-privileged account. Three distinct threat clusters have been identified: UAT-12197 deployed a JSP web shell and a JAR-based command executor; UAT-11823, linked to Sandworm, used CVE-2026-20079 and CVE-2026-20316 to deploy Cyclops Blink malware via a Netcat reverse shell; and UAT-11988, a Qilin ransomware operator, leveraged static credentials to conduct reconnaissance, deploy tunneling tools, and execute ransomware. Customers are urged to apply available patches immediately.

1mo ago · hacker-news

Multiple espionage-motivated threat actors, including APT31 and several China-aligned clusters, have leveraged a previously undocumented exploit kit named BlueMoon to exploit unpatched vulnerabilities in Google Chrome and Microsoft Windows. The exploit chain combines CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to achieve sandbox escape and local privilege escalation, delivered via phishing emails leading to malicious URLs. The kit downloads payloads such as the GemStone browser backdoor, ShadowPad, and Rust-based malware using DLL sideloading and in-memory execution techniques. The U.S. CISA has added all three CVEs to its KEV catalog, mandating federal agencies to patch them by mid-September 2026.

1mo ago · hacker-news

Wiz Research identified that nearly 1 in 10 internet-facing LiteLLM gateways accepted the default example admin key 'sk-1234', exposing critical cloud IAM credentials and API keys. Attackers with access to the master key can read all model provider API keys, execute code via misconfigured endpoints, and exploit pass-through routing to harvest cloud instance metadata. Multiple CVEs have been documented, including authentication bypasses and post-authentication code execution flaws, some of which are already being exploited in the wild to deploy cryptocurrency miners and extract sensitive data. Despite patches, many deployments remain vulnerable due to misconfigurations and unrotated default keys.

1mo ago · bleeping-computer

Trezor has warned customers about a phishing campaign exploiting a breach of its third-party email provider. Users received fake 'critical security alert' emails from help@trezor.io, claiming a vulnerability in STM32 microcontrollers used in Trezor wallets could expose recovery seeds. The emails were phishing attempts containing malicious links, and Trezor confirmed the domain used in the attack has been taken down. This incident follows prior breaches involving ShipMonk and a support ticketing portal, with attackers leveraging stolen data for further targeting.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability, CVE-2025-14733, in WatchGuard Firebox firewalls. The flaw allows unauthenticated attackers to execute arbitrary code remotely due to an out-of-bounds write issue, particularly affecting systems with IKEv2 VPN configurations. Despite patches being available since December 2025, nearly 9,000 vulnerable devices remain exposed online, posing ongoing risks to organizations. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch it within one week.

1mo ago · socket-dev

A coordinated campaign involving malicious Chrome and Firefox extensions has been targeting cryptocurrency traders using Axiom Trade and Padre (now Terminal) platforms. The extensions, including J7Tracker, VREO, and Orbit Tracker, steal authenticated session tokens, wallet data, and browser state by injecting malicious JavaScript modules into active trading sessions. Data is exfiltrated via browser navigation to attacker-controlled domains hosted on Vercel and bonto.run infrastructure, bypassing CORS restrictions. The threat actor uses repackaged extensions with cloned functionality and maintains persistence through rotating C2 infrastructure and new publisher accounts, posing a direct risk of account compromise and cryptocurrency theft.

1mo ago · wiz

Multiple critical vulnerabilities were discovered in LiteLLM, a popular open-source LLM gateway, enabling authentication bypass, remote code execution, and cloud credential theft. CVE-2026-59822 allows unauthenticated access to MCP endpoints via a Bearer token bypass, while CVE-2026-59821 enables post-authentication root-level RCE through unsandboxed custom code guardrails. A default master key (sk-1234) is accepted by 9.6% of public instances, allowing attackers to achieve admin access and exploit these vulnerabilities. Additionally, pass-through endpoints can be abused to exfiltrate cloud metadata and IAM credentials, especially when combined with default or missing authentication.

1mo ago · bleeping-computer

Veradigm, a healthcare technology company, disclosed a data breach resulting from a cybersecurity incident at a third-party vendor, which led to unauthorized access to patient data via compromised API credentials. The Gentlemen ransomware group claimed responsibility, stating they exfiltrated 3.5 million patient records containing personally identifiable information, including names, addresses, Social Security numbers, and email addresses. The group threatens to leak the data if a ransom is not paid, with a deadline of September 11, 2026. While clinical data was not accessed, the breach involved sensitive personal information, and Veradigm has initiated incident response procedures and customer notifications.

1mo ago · bleeping-computer

The Skullcandy Dime 3 wireless earbuds (model S2DCW) running firmware version 1.0.0.28 are vulnerable to Bluetooth hijacking due to a missing authentication flaw in the Airoha Bluetooth Audio SDK. This high-severity vulnerability, tracked as CVE-2025-20701, allows nearby attackers to pair with the device without user interaction or PIN confirmation. Once paired, the attacker's device becomes trusted and can automatically reconnect, enabling audio hijacking, microphone access, and connection disruption. Although Skullcandy released a fix in firmware version 1.0.0.30, there is no user-accessible method to update existing vulnerable units, leaving them permanently exposed.

1mo ago · bleeping-computer

AdaptHealth, a healthcare provider, confirmed a cyberattack in July 2026 that exposed the personal and health information of 4.1 million individuals. The breach resulted from a social engineering attack that compromised a third-party contractor's privileged account, allowing attackers to exfiltrate data from cloud-based systems. The ShinyHunters threat group claimed responsibility for the attack, which involved the theft of full names, contact details, demographic data, health insurance, and health information. The company detected the intrusion on June 5 and received a ransom demand on June 15, but has found no evidence of data misuse to date.

1mo ago · bleeping-computer

Cisco has confirmed active exploitation of a critical authentication bypass vulnerability, CVE-2026-20079, in its Secure Firewall Management Center (FMC) software. The flaw, rated CVSS 10.0, allows unauthenticated remote attackers to execute commands as root by sending crafted HTTP requests. Indicators of compromise, including a specific log entry referencing '/var/tmp/license.tmp', were observed as early as July 23, 2026, suggesting exploitation began before Cisco's public awareness in August. The U.S. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 12, 2026.

1mo ago · hacker-news

A critical vulnerability in Alby Hub, a self-hosted Lightning wallet, affects versions v1.7.0 through v1.18.5 and could allow attackers to take over internet-exposed wallets and potentially steal funds. The flaw exists when users expose the Hub's management interface to the public internet, contrary to intended deployment on private networks. Alby has confirmed one user was affected, though it is unclear if funds were lost. The company recommends immediately restricting external access and upgrading to version v1.24.0, while also changing the wallet's unlock password if exposed.

1mo ago · hacker-news

A critical vulnerability in DeepSeek Harness, an open-source tool for running AI coding agents, allowed sandboxed agents to disable their own file sandbox by invoking a local web interface without authentication. The flaw, tracked as CVE-2026-82533, enabled an agent to switch its session to 'danger-full-access' mode via a single command, escaping file restrictions and potentially executing commands outside its workspace. The vulnerability affected versions 0.1.1-rc.2 and earlier, with the fix introduced in version 0.1.2-alpha.2, which added one-time token authentication for the local interface. Researchers from OX Research reported the issue, and community members had previously observed the same behavior before official disclosure.

1mo ago · hacker-news

Information stealer malware such as Lumma Stealer and Vidar are harvesting session tokens and API keys from compromised systems, enabling threat actors to replay these credentials and gain unauthorized access to AI services like Google Gemini, OpenAI, Anthropic, and others, bypassing multi-factor authentication. A 7 GB infostealer dump analyzed by Okta contained 44,791 unique JSON Web Tokens (JWTs), 555 of which were likely tied to AI service authentication, along with 2,937 encrypted JWE structures, primarily from OpenAI. Attackers are using stolen tokens to access premium AI models and sell access on underground forums, leveraging anti-detect browsers like Camoufox to avoid detection. The abuse of valid, unexpired API keys and tokens—termed 'LLMjacking'—allows attackers to conduct espionage, resource theft, or run up AI service bills on victims.

1mo ago · bleeping-computer

Google has patched a new Chrome zero-day vulnerability, CVE-2026-87491, which has been actively exploited in the wild. The vulnerability is a high-severity out-of-bounds write issue in the V8 JavaScript and WebAssembly engine, allowing remote attackers to execute arbitrary code within the browser sandbox by luring users to malicious HTML pages. Exploitation can lead to heap corruption, data exposure, or browser crashes. Google has not disclosed further details about the ongoing attacks to avoid exposing technical details before most users are patched.

1mo ago · bleeping-computer

An anonymous security researcher known as Nightmare Eclipse disclosed a new zero-day exploit named 'ShieldCrash' that exploits an incomplete patch for the previously patched Microsoft Defender privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The exploit allows attackers to achieve arbitrary file read with SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. This disclosure is part of an ongoing dispute between the researcher and Microsoft over bug bounty and vulnerability disclosure practices. Microsoft has not yet patched this newly revealed bypass.

1mo ago · bleeping-computer

Over 36,000 internet-exposed Plex Media Server instances remain unpatched against multiple security vulnerabilities disclosed by Plex in September 2026. Affected versions include v1.43.2 and earlier. Plex has released version 1.43.3 to address these issues, but CVE identifiers have not yet been assigned, limiting visibility and response within the security community. Attackers could reverse-engineer the patches to develop exploits, especially given the history of prior vulnerabilities in Plex being exploited for credential theft and remote code execution.

1mo ago · hacker-news

A critical pre-authentication remote code execution vulnerability, CVE-2026-86218 (CVSS score: 10.0), in N-able N-central is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code remotely, enabling full compromise of the platform used by MSPs and large IT organizations to manage downstream systems. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 11, 2026. Although N-able released a fix in version 2026.3 Hotfix 4, evidence suggests prior exploitation of internet-facing instances, with potential links to ransomware threat actors.

1mo ago · hacker-news

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities across its software ecosystem, including two actively exploited Windows zero-day flaws. CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC that enables local privilege escalation to SYSTEM privileges. CVE-2026-81963 is an improper link resolution vulnerability in the Windows Update Stack, also allowing local privilege escalation. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 22, 2026.