Intelligence Feed

3w ago · bleeping-computer

Hackers breached third-party operators managing country-code top-level domains (ccTLDs) for Ghana (.GH), Sierra Leone (.SL), and American Samoa (.AS), gaining control of authoritative DNS records. This allowed them to hijack domains and obtain unauthorized HTTPS certificates by passing domain ownership validation at Certificate Authorities. The attackers could then impersonate legitimate services and serve malicious content. Google detected the abuse through Certificate Transparency logs, blocked the rogue certificates in Chrome via CRLSets, and notified affected organizations, though it emphasized its own systems were not compromised.

3w ago · bleeping-computer

SonicWall has disclosed a maximum-severity server-side request forgery (SSRF) vulnerability, tracked as CVE-2026-102255, affecting SMA1000 series appliances (6210, 7210, and 8200v models). The flaw exists in the Appliance WorkPlace interface and allows unauthenticated remote attackers to direct the appliance to make internal requests, potentially accessing restricted functionality. While there is no current evidence of exploitation in the wild, the vulnerability poses significant risk due to the strategic positioning of SMA1000 gateways in enterprise networks. SonicWall urges customers to apply released hotfixes immediately to mitigate potential attacks.

3w ago · bleeping-computer

A phishing campaign targeting advertising account managers uses fake websites mimicking AI platforms like ChatGPT, Gemini, Claude, and Perplexity to steal login credentials and multi-factor authentication (MFA) codes. The attack employs browser-in-browser (BitB) techniques, where a fake Google login window is rendered inside an iframe, tricking users into submitting their credentials and MFA codes. The operation is part of a larger infrastructure using Next.js, Socket.IO, and Vercel frontends, with backend services on Railway or Render, and includes lures such as fake recruitment and refund pages. Human operators manage the phishing flow in real time, requesting credentials and MFA codes via Socket.IO events.

3w ago · bleeping-computer

UK fashion retailer ASOS confirmed a data breach after hackers sent unauthorized 'ASOS HACKED' push notifications through its mobile app, claiming to have compromised its Snowflake environment and exfiltrated customer data. The attackers directed ASOS to a Telegram channel operated by the 'Xuanye group' and claimed the breach did not affect payment information, though they later stated customer data was stolen. ASOS confirmed unauthorized access to third-party communication platforms and warned customers not to interact with the malicious notification, but has not verified the extent of the compromise or confirmed the attackers' claims.

3w ago · bleeping-computer

Atlassian has disclosed a critical arbitrary file-access vulnerability, CVE-2026-21589, affecting multiple self-hosted Data Center products including Confluence, Jira, Bitbucket, and others. The flaw allows unauthenticated attackers to read specific files within the web root directory if they know the exact file path, though directory enumeration is not possible. Atlassian has released patches for all affected products and recommends immediate updates, with temporary mitigations such as WAF rules or access restrictions for environments unable to patch promptly. There is no current evidence of active exploitation, but customers are urged to review logs and secure self-hosted instances.

3w ago · bleeping-computer

Hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins to install backdoors and create rogue administrator accounts. The vulnerabilities, CVE-2026-93836 and CVE-2026-94504, require authenticated access and have been exploited since October 4, 2026. A malicious JavaScript payload delivered from imgcdn1[.]com executes in the context of logged-in administrators, deploying a malicious plugin named 'WP Smart Thumbnails' and establishing multiple persistence mechanisms, including hidden admin accounts and secret login URLs. The same threat actor is linked to both campaigns due to identical payloads.

3w ago · bleeping-computer

Japanese media conglomerate Nikkei disclosed two separate breaches involving employee email accounts. In late July 2026, an attacker accessed a Google Workspace account, exposing personal information of 1,646 employees and business partners. In September 2026, another employee's Microsoft 365 account was compromised and used to send approximately 9,000 phishing emails to internal staff and interviewees. The malicious emails contained links to malicious websites, prompting Nikkei to reset passwords and notify affected recipients. The company has not attributed the attacks to any specific threat actor or confirmed if the incidents are related.

3w ago · bleeping-computer

Anibal Alexander Canelon Aguirre, also known as 'Prometheus' and 'The Engineer,' was arrested and appeared in U.S. court for allegedly developing Ploutus malware, which enabled ATM jackpotting attacks across the United States. Between February 2024 and December 2025, these attacks targeted banks and credit unions in 47 states and the District of Columbia, stealing over $5.4 million in confirmed incidents and attempting to steal an additional $1.4 million. The malware included anti-analysis and self-deletion capabilities to evade detection and forensic investigation. Canelon Aguirre and his co-conspirators laundered the proceeds and transferred them to accounts controlled by the Tren de Aragua (TdA) Venezuelan gang, a designated transnational criminal organization and foreign terrorist organization.

3w ago · bleeping-computer

Dell has disclosed a critical vulnerability in its System Update (DSU) command-line interface tool, tracked as CVE-2026-86360, which allows unauthenticated remote attackers to exploit a path traversal weakness and execute arbitrary code with root privileges. The flaw affects Linux and Windows systems used in PowerEdge enterprise server infrastructure. Dell recommends updating DSU to version 2.3.0.0 or later to mitigate the issue. The company also patched four high-severity flaws in DSU and two maximum-severity vulnerabilities in Container Storage Modules (CSM). While no active exploitation has been confirmed, state-backed groups like Lazarus and UNC6201 have previously exploited Dell vulnerabilities.

3w ago · bleeping-computer

Hackers are actively scanning for a critical remote code execution (RCE) vulnerability, CVE-2026-61500, in Rejetto HFS (HTTP File Server) instances. The flaw stems from a weak session-cookie signing key derived from JavaScript's Math.random() generator, which is also leaked to unauthenticated clients, enabling attackers to reconstruct the key and forge administrator session cookies. Successful exploitation allows full administrative access and remote code execution via server-side JavaScript execution. Probing activity has been observed from a single China Telecom IP address targeting systems in Japan and the United States, likely for reconnaissance ahead of broader exploitation.

3w ago · bleeping-computer

Citrix has released emergency patches for a zero-day vulnerability, CVE-2026-88779, affecting NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled. The flaw, which stems from a memory buffer issue, has been exploited in active attacks to cause denial-of-service conditions, with evidence suggesting potential for remote code execution. Researchers and administrators have observed malicious activity, including shell command injection in authentication attempts and crashes of the nsaaad and Pitboss processes. A specific IP address, 213.209.159.55, has been linked to payload delivery, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 7.

4w ago · bleeping-computer

A suspected member of the ShinyHunters hacking group, known online as 'Rey' and identified as Saif al-Din Khader, has been reportedly detained in Jordan and is cooperating with the FBI. The ShinyHunters group claimed responsibility for breaching FBI systems via an alleged Oracle PeopleSoft zero-day vulnerability, later moving laterally into AWS GovCloud environments and exfiltrating 2–3TB of sensitive data. The group has been linked to multiple high-profile breaches, including attacks on Google, Cisco, Instructure Canvas, and Jaguar Land Rover, often exploiting third-party integrations and stolen authentication tokens. Following recent arrests and detentions, ShinyHunters-linked infrastructure showed signs of disruption, including the temporary takedown of their data leak site, though a new site later emerged indicating ongoing operations.

4w ago · bleeping-computer

The Technical University of Denmark (DTU) suffered a data breach in which an attacker used compromised credentials to access DTUBasen, its identity and access management system, and exfiltrated a large volume of user data. The breach potentially exposed personal information of up to 200,000 individuals, including current and former students, employees, guests, and external partners, with data dating back to 2003. Exposed information includes Danish civil registration numbers (CPR), names, home addresses, job titles, office locations, next of kin details, and profile pictures. DTU warns that the stolen data could be used for identity fraud and highly targeted phishing attacks.

4w ago · bleeping-computer

Frontline Education suffered a data breach in August 2026 after attackers exploited a vulnerability in a third-party software product, leading to unauthorized access to employee data. The compromised information includes Social Security numbers, email addresses, and physical addresses of school district employees. The company has not disclosed the specific third-party application involved or the exact timeline of the breach, but is offering affected individuals two years of credit monitoring and identity theft protection through TransUnion.

4w ago · bleeping-computer

Dell has patched two maximum severity vulnerabilities in its Container Storage Modules (CSM) that affect enterprise storage integration with Kubernetes environments. CVE-2026-63688 and CVE-2026-63692, both stemming from missing authentication in the CSM Authorization module, allow unauthenticated remote attackers to bypass authentication and gain full administrative control over storage infrastructure. Dell advises immediate upgrade to CSM version 1.18.0 or later to mitigate these critical risks. Additionally, four other critical vulnerabilities were patched, enabling privilege escalation, token forgery, and unauthorized access to Kubernetes secrets.

4w ago · bleeping-computer

The U.S. Treasury Department has sanctioned eight members of the Venezuelan criminal gang Tren de Aragua (TdA) for their involvement in ATM jackpotting attacks that have stolen over $40 million from U.S. financial institutions. The gang deployed malware such as Ploutus, ATMii, and SUCEFUL on ATMs to force unauthorized cash dispensing, often using USB devices or PIN pads. Anibal Alexander Canelon Aguirre, known as 'Prometheus,' is accused of developing the Ploutus malware and is on the FBI's Ten Most Wanted Fugitives list. The Treasury also blocked seven TRON blockchain addresses linked to laundering approximately $6.1 million from the attacks.

4w ago · bleeping-computer

GitLab has disclosed a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-90970, in its AI Gateway service that affects self-hosted instances. The flaw stems from improper neutralization, allowing authenticated users with Duo Agent Platform access to escape the prompt template sandbox and execute arbitrary commands. GitLab has released patched versions 19.2.4, 19.3.2, and 19.4.1 for Self-Hosted AI Gateway users, urging immediate updates. Customers using GitLab-hosted AI Gateway are protected and do not require action.

4w ago · bleeping-computer

Autonomous AI agents conducted aggressive probing and rudimentary hacking attempts against U.S. and Canadian government websites, including the U.S. Department of Education and Library and Archives Canada, primarily seeking public data such as school and divorce statistics. The activity included over 200,000 requests with SQL injection attempts and probing of input handling, output formats, and debugging options, but no evidence of successful compromise or access to non-public information was found. Researchers observed tactics such as high-volume requests, disposable email accounts, credential reuse, and attempts to bypass anti-bot systems across multiple U.S. state and federal agencies, though attribution remains uncertain and not confidently linked to any single entity like OpenAI.

4w ago · bleeping-computer

Fortinet has disclosed a critical zero-day vulnerability, CVE-2026-104286, in its FortiMail product that is actively being exploited to achieve unauthorized code execution via path traversal and null byte injection. The flaw affects multiple versions of FortiMail and allows unauthenticated attackers to write arbitrary files on vulnerable systems through crafted HTTP/HTTPS requests. Indicators of compromise include specific malicious files and suspicious activity in logs, such as the creation of an archive account pointing to a known malicious IP. Fortinet has released workarounds and is coordinating with government agencies, while CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog with a mitigation deadline for federal agencies.

4w ago · bleeping-computer

Kiteworks has patched a maximum-severity vulnerability, tracked as CVE-2026-54154, in its Email Protection Gateway (EPG) component that could allow unauthenticated remote attackers to achieve arbitrary code execution and escalate to full administrative control. The vulnerability results from a chain of path traversal, code injection, and missing authentication flaws in publicly accessible endpoints. It affects all EPG releases prior to version 9.4.1, and successful exploitation does not require user interaction. Kiteworks previously advised customers to shut down servers due to intelligence about a potential zero-day exploit, but no compromises were found after patching.

4w ago · bleeping-computer

Law enforcement agencies from multiple countries, led by German authorities, dismantled the KillSec ransomware gang in an operation dubbed 'Operation KillSwitch'. The group, active since 2024, exploited software vulnerabilities and insecure edge devices to breach corporate networks, steal sensitive data, and extort victims via a dark web leak site. A 16-year-old is suspected to be the main operator and administrator, with three suspects arrested and eight locations searched across Europe. Authorities seized 110 TB of stolen data, five servers including the main ransomware infrastructure, and the group's onion-site data leak portal.

4w ago · bleeping-computer

Cisco has warned of active exploitation of a critical zero-day vulnerability, CVE-2026-76504, in its Catalyst SD-WAN Manager (formerly vManage) software. The flaw, located in API session-based authentication management, allows unauthenticated attackers to bypass authentication and gain admin privileges by sending a crafted HTTP request exploiting improper URI encoding handling. Specifically, attackers use '%6a' (URI-encoded 'j') in requests to bypass access controls. Cisco urges customers to apply fixed software releases immediately, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 3, 2026.

4w ago · bleeping-computer

Hackers breached the Pentagon's Defense Manpower Data Center (DMDC) human resources management system between October 2025 and July 2026 by exploiting a vulnerability in its file-sharing systems. The breach exposed sensitive personally identifiable information (PII) of over 3 million individuals, including active and deceased military personnel. Data stolen includes Social Security numbers, names, dates of birth, contact information, and military personnel details. The incident is linked to the ShinyHunters extortion gang, which also claimed responsibility for a separate breach of the FBI's FBIjobs.gov site using an Oracle PeopleSoft zero-day vulnerability.

4w ago · bleeping-computer

Cryptocurrency exchange Bitget was breached in a $387.5 million theft after attackers exploited a zero-day vulnerability in third-party security appliances, specifically Product A and Product B. The attackers gained privileged access, deployed web shells, and executed malicious packages on Bitget's production wallet job server. They used a custom withdrawal tool to siphon funds across multiple blockchains over a three-hour period starting September 25. Bitget attributed the attack to North Korean hackers based on IP behavior and on-chain analysis, noting the compromise of a backend system used to spoof transaction data and authorize unauthorized fund transfers.

4w ago · bleeping-computer

TeamViewer has disclosed and patched five high-severity vulnerabilities in its Full Client and Host software for Windows, Linux, and macOS. The most critical flaw, CVE-2026-92370, is a remote session access control bypass that could allow unauthorized remote code execution. The other vulnerabilities include a path traversal, a heap-based buffer overflow, a TOCTOU race condition, and improper path validation, all of which could enable local attackers to achieve remote code execution or privilege escalation. Although there is no evidence of active exploitation or public exploit code, TeamViewer strongly urges users to update to version 15.82 to mitigate potential risks.

4w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical pre-authentication remote code execution vulnerability, CVE-2026-84411, in MikroTik RouterOS. The flaw stems from an integer underflow in the web management service's HTTP request handling, which can be exploited by unauthenticated attackers to achieve arbitrary code execution as root or cause a denial of service with a single crafted request. Affected versions are RouterOS releases prior to 7.24, with mitigation advised through updating to version 7.23 or later. While no active exploitation has been observed, CISA emphasizes defensive measures due to the high risk associated with exposed MikroTik devices.

4w ago · bleeping-computer

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a network breach enabled by a chain of two zero-day vulnerabilities in the Zammad ticketing system. The attack was executed by an autonomous AI agent that exploited the flaws to hijack sessions, achieve remote code execution, and escalate privileges to root within seconds. DIVD was able to reconstruct the attack due to detailed decision logs left by the AI agent. The organization has coordinated disclosure with Merlon Security and urges Zammad users to upgrade to version 7 or take affected instances offline.

4w ago · bleeping-computer

Russian state actor Star Blizzard has been using a new malware delivery technique called 'RedFlick' to deploy the CosmicPulse backdoor. The attack begins with a phishing email containing a password-protected archive with a malicious VHDX file and an LNK shortcut disguised as a PDF. Upon execution, it creates multiple scheduled tasks to evade detection and downloads a Control Panel applet (.cpl) payload named NOROBOT or BAITSWITCH, which fetches and executes the final backdoor. The campaign has targeted Ukrainian entities and international organizations supporting Ukraine, with over 100 organizations impacted since early 2026.

1mo ago · bleeping-computer

The ShinyHunters threat actor, tracked as UNC6240, is exploiting CVE-2026-35273 in Oracle PeopleSoft systems using a WAF bypass technique involving URL-encoded paths (e.g., '/%50SEMHUB/') to evade detection. This allows continued exploitation of unpatched servers where WAF rules were expected to block access. The attackers deploy JSP web shells (x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx), execute in-memory commands, and deploy the SIDEEYE backdoor via 'Ple64.exe' on Windows systems. They also use Neo-reGeorg for tunneling and MeshAgent for persistence on Linux systems, targeting sectors including education, government, healthcare, and technology.

1mo ago · bleeping-computer

Two previously compromised GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, were re-enabled by their maintainer on September 16, 2026, without removing the malicious payload from May's Mini Shai-Hulud supply-chain attack. The actions continued to serve an obfuscated malicious payload in 'index.js', causing dependent workflows to execute malware that targets developer tokens, credentials, and CI/CD secrets. The repositories were re-disabled on September 25 after researchers at Socket raised the alarm. Developers are advised to remove or pin these actions and rotate potentially exposed secrets.