Intelligence Feed

1mo ago · hacker-news

SAP has patched a critical CVSS 10.0 vulnerability, CVE-2026-44756 (OVERPASS), in the SAP kernel's Extended Passport (EPP) processing, enabling unauthenticated remote code execution with administrative privileges. The flaw arises from missing boundary validation during EPP deserialization, allowing attackers to execute arbitrary OS commands, compromise business data, and move laterally across SAP systems. The vulnerability is reachable via multiple internet-facing protocols without authentication, including web, SAP GUI, and RFC layers. Another critical flaw, CVE-2026-58240 (S4GET), in SAP NetWeaver Message Server also allows unauthenticated remote code execution on SAP S/4HANA systems.

1mo ago · hacker-news

Security researcher Chaotic Eclipse has released a proof-of-concept (PoC) exploit demonstrating a patch bypass for CVE-2026-69414, a vulnerability in Microsoft Defender previously known as ShieldBreak. The newly disclosed bypass, dubbed ShieldCrash, allows arbitrary file read with SYSTEM privileges on all supported versions of Windows despite Microsoft's patch in Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft failed to fully address the original vulnerability, leaving a code path still exploitable under specific conditions.

1mo ago · hacker-news

Malware exploiting CVE-2025-53521 on F5 BIG-IP APM appliances injects a PHP web shell directly into memory, evading traditional disk-based detection. The malware modifies the Apache binary at /usr/sbin/httpd and hooks into the Apache Portable Runtime to intercept loading of PHP modules, dynamically injecting the web shell when specific PHP scripts are loaded. Attackers can gain remote code execution without authentication, and the malware establishes persistence through modified system binaries and hidden sockets, with indicators including unexpected file modifications, SELinux disablement, and anomalous HTTP responses.

1mo ago · hacker-news

cPanel has patched a critical vulnerability, tracked as CVE-2026-67401, that allows an authenticated hosting account with mail privileges to execute arbitrary code as root due to an SQL injection flaw in the EmailTrack component. The vulnerability affects all supported versions of cPanel and WHM, enabling a local privilege escalation path from a regular user to full server compromise. While no public exploit or active attacks have been observed as of September 9, 2026, similar recent cPanel flaws have been exploited in the wild, including in ransomware campaigns. The CVE record for this flaw had not yet been published at the time of reporting, and no mitigations are provided for systems unable to update immediately.

1mo ago · hacker-news

A zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, tracked as CVE-2026-87491, is being actively exploited in the wild. The flaw is an out-of-bounds write that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Google has patched the vulnerability in Chrome versions 153.0.8010.36 and later, but has not disclosed specific details about the exploitation or the threat actor involved, likely to prevent further abuse before widespread patching.

1mo ago · hacker-news

Researchers at Calif demonstrated a zero-click worm exploiting a vulnerability in WeChat that allows full takeover of a user's account via an incoming call, without requiring any interaction from the target. The exploit spreads laterally by leveraging compromised accounts to call other contacts, enabling rapid propagation across devices. The attack works even if the call is not answered, though declining the call stops that particular attempt. Tencent mitigated the exploit server-side and released client updates (Android 8.0.77, iOS 8.0.76) in August 2026, but has not issued a formal advisory or CVE. No real-world attacks have been observed, and technical details have been withheld pending a future conference presentation.

1mo ago · bleeping-computer

The ShinyHunters extortion gang claims to have breached the Florida Department of Motor Vehicles' 'DAVID' (Driver and Vehicle Information Database) system via a password-reset vulnerability, stealing over 200,000 driver records. As proof, they published a screenshot of Jeffrey Epstein's DMV record containing sensitive personal information. The attackers claim they accessed the system using compromised accounts belonging to DMV employees and an FBI agent, then exfiltrated data by iterating through driver IDs. They state they have since lost access and that the vulnerability is being patched, while also indicating plans to disclose breaches of other state DMVs in the near future.

1mo ago · bleeping-computer

Microsoft's September 2026 Patch Tuesday addresses 966 security vulnerabilities, including two actively exploited zero-day flaws. The first, CVE-2026-81963, is an elevation of privilege vulnerability in the Windows Update Stack that allows attackers to gain SYSTEM privileges through improper link resolution. The second, CVE-2026-85880, is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that enables local privilege escalation to SYSTEM. Both vulnerabilities were actively exploited in the wild before patches were released, though technical details on exploitation are not disclosed. The update marks Microsoft's largest Patch Tuesday to date, attributed to the use of AI-powered vulnerability discovery.

1mo ago · hacker-news

A financially motivated threat actor known as TeamPCP (aka Altered Spider, UNC6780) has conducted large-scale software supply chain attacks targeting PyPI, npm, and Docker Hub, deploying credential stealers SANDCLOCK and DUSTMAKER. SANDCLOCK, used in March and April 2026, is a Python-based tool targeting Linux and Kubernetes environments with container escape capabilities, while DUSTMAKER is a cross-platform JavaScript payload focused on credential theft in CI/CD pipelines and includes AI-targeting techniques like prompt injection. The group exfiltrates API credentials and targets AI coding assistants, monetizing access through ransomware and data theft extortion networks.

1mo ago · hacker-news

Slim Spider is a financially motivated threat actor targeting Brazilian financial institutions since at least March 2026. The group conducts multi-stage intrusions into cloud environments to steal cryptocurrency custody secrets and access instant payment systems like Pix. They use custom Bash scripts to extract cloud credentials, implement cloud-native cryptographic signing via OpenSSL, and deploy backdoors such as MikeDor. Slim Spider also leverages malicious DevOps pipelines and maintains web-based panels for automating attacks, including endpoint scanning, email reconnaissance, and unauthorized Pix transactions.

1mo ago · bleeping-computer

Adobe has patched a critical zero-day vulnerability, CVE-2026-75650 (StyleSmuggler), actively exploited in the wild to backdoor Magento and Adobe Commerce servers. The flaw allows arbitrary code execution, and attackers have deployed PHP web shells to exfiltrate server data. A second threat actor using different tooling has also been observed exploiting the same vulnerability. Sansec discovered the attacks, which began at least on September 4, 2026, and recommend immediate application of Adobe's hotfix and credential rotation.

1mo ago · hacker-news

Check Point Research discovered a vulnerability in ChatGPT that allowed a maliciously crafted prompt to enable covert data exfiltration from a user's session. By exploiting a shared internal JFrog Artifactory service used for package caching, an attacker could establish a hidden communication channel between isolated ChatGPT containers across different accounts. This allowed the silent reading of Gmail data, chat history, and files from a victim's session and transmitting them to an attacker-controlled account without user consent or awareness. The vulnerability stemmed from improper isolation in the internal service and excessive container permissions, which allowed write access to shared metadata properties. OpenAI confirmed the issue and took the internal service offline, but no user-facing patch was required or released.

1mo ago · hacker-news

On September 6, 2026, approximately 4,000 bitcoin (worth ~$320M) were withdrawn from the Liquid Network's federation wallet due to a bug in the Elements software underlying the sidechain. The attackers, who claim to be white hats, returned 3,400 bitcoin after confirming that Blockstream had patched its systems, but are still holding 598.5 bitcoin (~$47M). The exploit leveraged the SideSwap Peg-out Authorization Key to initiate a peg-out without compromising any private keys, suggesting a flaw in logic or validation within the Elements codebase. Communications occurred on-chain, including a PGP-encrypted message sent via a microtransaction, and the incident remains unresolved as the network stays offline.

1mo ago · bleeping-computer

An Elasticsearch cluster named 'pax-info', linked to a Vietnamese organization and hosted in Viettel-assigned IP space, was found exposed online due to chained security misconfigurations. The database contained over 220 million traveler and crew records spanning from January 2017 to April 2026, including personally identifiable information such as names, passport details, flight data, and nationalities. The system was accessible via default credentials after initial HTTP 401 authentication was bypassed through a cloud-based path, and it was secured on June 8 following disclosure by Kinryū Labs. It remains unknown whether the data was accessed or exfiltrated by malicious actors prior to remediation.

1mo ago · talos

Cisco Talos identified a cryptocurrency theft campaign dubbed ClickFix that abuses legitimate services, particularly the Google Visualization API, for command and control (C2). The attackers use social engineering to trick victims into pasting malicious JavaScript into their browser or installing it via the Tampermonkey browser extension, enabling persistent access. The malicious script acts as a web skimmer, intercepting and altering cryptocurrency deposit addresses in real time, hijacking clipboard content, and injecting fake UI elements to deceive users into believing they are receiving transaction bonuses. The campaign primarily targets cryptocurrency traders through lures distributed on Telegram, DarkForums, and paste sites, using Google Sheets to host obfuscated payloads and evade detection.

1mo ago · talos

Cisco Talos identified a multi-stage WebDAV-based infection chain dubbed ClearFake, delivering the Amatera stealer and secondary payloads including ZigCryptoStealer and NetSupport Manager. The attack begins with malicious JavaScript injected via a compromised site and Cloudflare Worker, retrieving code from BNB Smart Chain contracts, leading to a fake CAPTCHA prompt that tricks users into executing a malicious command. This command retrieves a disguised DLL over WebDAV and executes it via rundll32.exe. Two distinct loader variants—'pf.ch' and 'verification.google'—were observed, both delivering Amatera stealer with different secondary payloads based on C2 instructions. The 'pf.ch' chain delivers ZigCryptoStealer and a Go reverse proxy, while the 'verification.google' chain installs an unauthorized NetSupport Manager instance, indicating a Russian threat actor.

1mo ago · hacker-news

BengalSEO is a financially motivated threat actor operating since at least 2015 from Rajasthan, India, using black hat SEO techniques to poison Bing search results and promote malicious lure pages. These pages are used to deliver the MayaBot malware via JavaScript droppers or redirect victims to tech support scams. The group uses a sophisticated traffic distribution system (TDS) with cloaking, fingerprinting via Matomo analytics, and abuse of trusted hosting platforms like GitHub Pages and Cloudflare to evade detection. The infrastructure includes multiple redirector domains, malicious ZIP files, and lure pages hosted across high-reputation services to manipulate search rankings and deliver payloads.

1mo ago · hacker-news

Adobe has patched a critical zero-day vulnerability, CVE-2026-75650 (CVSS score 10.0), actively exploited in the wild and dubbed StyleSmuggler by Sansec. The flaw affects Adobe Commerce and Magento Open Source, enabling unauthenticated remote code execution via PHP code injection in the template system. Threat actors are exploiting the vulnerability to deploy a Rust-based Linux backdoor and a PHP web shell for persistent access and arbitrary code execution on compromised e-commerce servers.

1mo ago · hacker-news

PEEP is a post-compromise Chromium-based toolkit that installs a malicious browser extension to establish persistence and enable command-and-control (C2) operations within compromised Chrome or Edge browsers. The malware bypasses browser security checks by manipulating Secure Preferences and uses native messaging to execute host-level commands, steal credentials, and exfiltrate browsing data. It communicates with C2 servers every 30 seconds over HTTP, supports remote updates, and includes PowerShell and Python scripts for cross-platform deployment, indicating active targeting of both Windows and Linux environments.

1mo ago · bleeping-computer

ConnectWise has identified a vulnerability in its ScreenConnect remote access platform that affects both cloud and on-premises deployments, specifically related to insecure file transfer behavior. A CVE ID has not yet been assigned, and no patch is currently available, though temporary mitigations are recommended. The vulnerability could allow attackers to abuse file transfer permissions during sessions, posing a risk to managed service providers and IT support teams. Given the history of exploitation of ScreenConnect flaws by ransomware groups and state-backed actors, this issue is considered high risk.

1mo ago · bleeping-computer

A zero-day vulnerability dubbed 'StyleSmuggler' in Magento and Adobe Commerce is actively exploited to achieve remote code execution and deploy a Rust-based Linux backdoor. The exploit leverages PHP code injection via Magento's template system to trigger malicious activity, including the creation of a disguised backdoor process and a persistent cron job. The backdoor communicates with C2 infrastructure using spoofed NTP traffic on UDP port 123 to evade detection, and checks for tracing before beaconing. Adobe has not yet released a patch, but mitigation advice includes disabling GraphQL.

1mo ago · hacker-news

A public proof-of-concept exploit has been released that chains multiple vulnerabilities in Telerik UI for ASP.NET AJAX to achieve unauthenticated remote code execution. The attack chain leverages a padding oracle (CVE-2026-13182) to decrypt and forge encrypted state, leading to type confusion and deserialization of a malicious mixed-mode DLL via an unguarded type resolution flaw (CVE-2026-13181). Successful exploitation requires non-default configurations, including use of a custom encryption key and presence of the RadAsyncUpload control. While no confirmed in-the-wild exploitation has been reported, the release of working tooling increases risk for misconfigured systems.

1mo ago · hacker-news

Cybersecurity firm Huntress identified worm-like activity abusing ConnectWise ScreenConnect to propagate a four-stage VBScript chain across newly connected hosts. The attack uses social engineering, phishing, or fake refund forms to deploy rogue ScreenConnect clients, which then execute a sequence of malicious VBScripts (1.vbs to 4.vbs) for reconnaissance, payload retrieval, and execution. The final stage deploys backdoors, privilege escalation tools, or cryptocurrency miners based on system state, and the infected host re-infects new connections, creating self-propagating behavior. ConnectWise issued an advisory recommending disabling file transfer permissions to mitigate the risk.

1mo ago · hacker-news

Multiple active threats were reported this week, including a Chrome zero-day under active exploitation (CVE-2026-85046), which allows remote code execution via a crafted HTML page. MikroTik RouterOS devices are being targeted using an exploit chain called MikroTrick, combining CVE-2026-67276 and CVE-2026-86060 to achieve unauthenticated remote code execution. Unpatched Magento and Adobe Commerce stores are being compromised via a zero-day named StyleSmuggler, leading to backdoor installation. A supply chain attack on Coder's infrastructure delivered malicious Terraform modules that steal credentials. Additionally, the RevStealer information stealer is spreading via fake game cheats and a counterfeit Claude desktop app, using blockchain-based dead drops for resilience.

1mo ago · hacker-news

A threat cluster tracked as PREY-0058 by Arctic Wolf is conducting data theft and extortion attacks targeting Microsoft 365 users, primarily executives, through vishing (voice phishing) and adversary-in-the-middle (AitM) attacks. Attackers impersonate IT help desk personnel and direct victims to malicious authentication pages using domains that mimic legitimate services, such as 'mfaregister[.]com', to steal credentials and MFA tokens. These tokens are then replayed via residential proxy infrastructure to access Microsoft 365 services, enabling large-scale data exfiltration from SharePoint, OneDrive, Exchange, and Box without deploying malware or moving laterally within networks.

1mo ago · bleeping-computer

A data breach at Trezor's shipping provider, ShipMonk, has impacted 81,000 customers, with personal data including names, email addresses, phone numbers, and shipping addresses exposed. The breach originated from a critical SQL injection zero-day vulnerability in the third-party analytics platform Metabase, which was exploited by the ShinyHunters extortion gang. Trezor warns affected users of increased phishing and physical security risks, though its own systems and devices remain secure.

1mo ago · bleeping-computer

Mathspace disclosed a data breach affecting over 1 million individuals, primarily students, staff, and parents in Australia and New Zealand, following the exploitation of a critical SQL injection vulnerability in its self-hosted Metabase instance. The attackers gained unauthorized access on August 10, 2026, and exfiltrated data from the Australian reporting database on August 27. The compromised data included personal information, though academic records, credentials, and authentication tokens were not exposed. The breach is part of a broader campaign by the ShinyHunters extortion gang, which has targeted multiple organizations through similar Metabase vulnerabilities.

1mo ago · bleeping-computer

The BigBear 2.0 phishing-as-a-service platform has been used to bypass multi-factor authentication (MFA) and steal over 5,000 Microsoft 365 credentials from 258 organizations. The service leverages an Evilginx2-based adversary-in-the-middle (AiTM) framework to intercept passwords, session cookies, and MFA tokens by proxying traffic between victims and Microsoft's legitimate authentication infrastructure. Attackers use the 'offy' configuration to capture credentials and session data, which is then exfiltrated in real time to affiliate operators via Telegram bots. The platform also employs custom JavaScript to disable FIDO2/WebAuthn support in browsers, forcing users toward weaker authentication methods, and uses geo-matched residential proxies across 69 countries to evade detection.

2mo ago · datadog-security-labs

The N4D Mesh Controller is an active Linux malware campaign that exploits exposed Model Context Protocol (MCP) servers to enable credential theft, lateral movement, persistence, and command and control. The campaign uses a UPX-packed Go-based agent named 'go-titan' that communicates with controllers via custom headers and supports secondary C2 through Cloudflare Quick Tunnels. The agent targets AI and infrastructure services including Ray Dashboard, LightLLM, PostgreSQL, Redis, Kubernetes, and Jenkins, using automated scanning and exploitation techniques.

1mo ago · hacker-news

JSCeal is a compiled V8 JavaScript malware designed to steal browser credentials, cookies, and OAuth tokens, enabling attackers to bypass Google authentication via session replay attacks. It is distributed through malvertising campaigns, particularly the SourTrade operation, which impersonates legitimate cryptocurrency trading platforms like TradingView, Solana, and Luno. The malware uses heavy obfuscation techniques and in-memory assembly to avoid detection, and includes modules for keystroke logging, screenshot capture, and traffic interception via a local proxy targeting financial and cryptocurrency services.