Intelligence Feed

1mo ago · bleeping-computer

Kiteworks has issued a precautionary advisory urging customers to shut down their servers for a six-hour window due to credible threat intelligence from federal authorities indicating a potential imminent cyberattack. While no confirmed breach or exploitation has been identified, the company suspects possible zero-day attacks targeting its secure file-sharing systems. The warning is preventative, with all known vulnerabilities already patched in the latest version (9.5.1). The Clop extortion gang is mentioned as a potential threat actor due to its history of targeting similar platforms.

1mo ago · bleeping-computer

The Clop ransomware gang's data leak site was compromised by the ShinyHunters extortion group through an unpatched path traversal vulnerability in Grav CMS version 1.7.43. ShinyHunters exploited the flaw to upload malicious files, deface the site, and claim theft of source code, plugins, server logs, and Tor private keys, subsequently issuing a ransom demand. Grav CMS confirmed the vulnerability, tracked as CVE-2026-42608, resides in the core of Grav and was fixed in Grav 2.0 but not backported to the 1.7 branch until version 1.7.53.4 was released following disclosure.

1mo ago · bleeping-computer

The Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that they are actively exploited in attacks. These include a critical authentication bypass flaw (CVE-2026-5430) in WSO2 products, an incorrect authorization vulnerability (CVE-2026-71362) in Adobe Commerce and Magento, a high-severity code injection flaw (CVE-2026-65660) in Microsoft SharePoint, and a medium-severity SSH state-machine bypass (CVE-2026-67279) in Mikrotik RouterOS. Security firm watchTowr observed exploitation attempts against WSO2 using forged JWT tokens, and Sansec reported active exploitation of the Adobe Commerce flaw in the wild. Federal agencies are required to patch these flaws by September 27–28, 2026.

1mo ago · bleeping-computer

A cross-site request forgery (CSRF) vulnerability in Elementor plugin versions 4.3.0 and 4.3.1 for WordPress allows unauthenticated attackers to create administrator accounts by tricking a logged-in administrator into opening a malicious link. The flaw exists in the Editor Events module, which bypasses WordPress REST nonce validation when the request URI contains the 'elementor/v1/events/' path, enabling attackers to append this path via query parameters to trigger unauthorized REST API actions. The vulnerability was reported by security firm Patchstack and patched in version 4.3.2, with no CVE assigned at the time of reporting.

1mo ago · bleeping-computer

Cryptocurrency exchange Bitget suffered a breach in which $351.6 million was stolen from its hot and warm wallets. The attack is attributed to suspected North Korean hackers who compromised a critical backend system within Bitget's wallet infrastructure, enabling them to forge transaction data and trigger fund transfers. The breach affected multiple blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base, with XRP suffering the largest single-chain loss. Bitget has suspended withdrawals pending investigation and confirmed that its cold wallets and self-custodial Bitget Wallet were unaffected. The losses will be covered by the User Protection Fund.

1mo ago · bleeping-computer

A new variant of the MacSync info-stealing malware targeting macOS systems has evolved to use public iCloud calendar events as a delivery mechanism for new payloads. Distributed via social engineering and fake applications such as a counterfeit crypto wallet called Toria, the malware retrieves commands from the description field of a public iCloud calendar, which are then executed in the macOS zsh shell. The infection chain leads to the deployment of a backdoor module written in Objective-C that masquerades as Finder, establishes persistence via LaunchAgent, .zshrc modifications, and Git hooks, and can execute remote AppleScripts, deploy malicious browser extensions, and exfiltrate system data.

1mo ago · bleeping-computer

A critical pre-authenticated SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is now being actively exploited in the wild. The flaw exists in the virtuser_query plugin and allows unauthenticated attackers to bypass authentication, execute malicious database commands, and steal data without user interaction. The Canadian Centre for Cyber Security has issued an updated advisory warning of ongoing exploitation, urging administrators to update to patched versions 1.6.16 or 1.7.1, or disable the vulnerable plugin if immediate patching is not possible. Roundcube instances have been frequent targets in the past, including by state-backed groups such as APT28 and TA473.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that ransomware gangs are actively exploiting a critical authentication bypass vulnerability in JetBrains TeamCity, tracked as CVE-2026-63077. This flaw allows unauthenticated attackers to execute arbitrary operating system commands via the TeamCity agent polling protocol, potentially compromising CI/CD pipelines, stealing credentials, and modifying server state. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate within three days. Although patching is available, hundreds of internet-exposed TeamCity servers remain unpatched, making them attractive targets for ransomware and state-sponsored actors.

1mo ago · bleeping-computer

A financially motivated threat actor is leveraging AI-powered tools to conduct large-scale attacks on online retailers, stealing over 600,000 credit card records and deploying skimmer malware on at least 119 websites. The campaign uses three AI tools—Strix for vulnerability scanning, Cairn for autonomous exploitation, and Hermes for campaign orchestration with decision-making powered by claude-opus-4.6. The attacker, believed to be Chinese, provides high-level instructions while the AI agents execute attacks, including injecting skimmers via multiple methods and performing post-exfiltration data cleanup to erase traces in databases, causing operational disruptions.

1mo ago · bleeping-computer

Threat actors are actively exploiting a critical unauthenticated path traversal vulnerability in WordPress, tracked as CVE-2026-87902, to achieve remote code execution under specific conditions. The exploitation involves writing malicious PHP files to the server's filesystem, which execute shell commands when accessed. Initial activity began within hours of the patch release, with reconnaissance escalating to active payload delivery, including file writing to /tmp and /var/tmp directories using attacker-controlled content.

1mo ago · bleeping-computer

Check Point has confirmed active exploitation of two critical vulnerabilities in its Security Gateway product: CVE-2026-85102, a pre-authentication remote code execution flaw in the VPN certificate-handling functionality, and CVE-2026-93616, a pre-authentication path traversal vulnerability in the Management web service. Exploitation of CVE-2026-93616 began as a zero-day on July 23, 2026, and widespread attacks on CVE-2026-85102 started on September 12, with threat actors using anonymizing infrastructure such as VPNs and proxies. The U.S. CISA has added both flaws to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 25, 2026.

1mo ago · bleeping-computer

A new Android malware-as-a-service (MaaS) platform named RemControl is targeting users in Europe, Canada, and the Middle East through malvertising campaigns impersonating the TVTap IPTV app. The malware uses phishing overlays to steal banking credentials, leverages Accessibility Services for persistent access, and can stream real-time UI data to attackers. It communicates with C2 servers via Telegram channels and uses a VPN service to bypass Google Play Protect checks.

1mo ago · bleeping-computer

The domain third-party.com, commonly used as a placeholder in developer documentation, is now being used to serve a ClickFix attack that mimics a Cloudflare security verification page. When users click a 'Verify you are human' prompt, a malicious PowerShell command is copied to the clipboard, instructing them to paste and execute it via the Windows Run dialog. The command downloads and runs a PowerShell script that fetches a 134MB zip archive named update26.zip, which extracts and attempts to execute a file called draw.io.exe. The attack specifically targets Windows users, while macOS and Linux users are shown an error message and not served the malicious payload.

1mo ago · bleeping-computer

A security vulnerability dubbed 'ConfigConfusion' allows attackers with access to a Kubernetes namespace to escalate privileges and gain full control of a Google Cloud (GCP) organization by exploiting misconfigurations in Google Kubernetes Config Connector (KCC). KCC uses a single, highly privileged service account to manage cloud resources on behalf of developers, but does not validate whether the requesting user has appropriate Google Cloud IAM permissions. As a result, an attacker can submit a malicious IAMPolicyMember YAML resource to grant themselves owner-level access to the entire GCP organization, even without possessing any cloud credentials. This represents a confused deputy problem where KCC acts as an overprivileged intermediary.

1mo ago · bleeping-computer

Arista Networks has patched a zero-day vulnerability, tracked as CVE-2026-93952, in its VeloCloud Orchestrator (VCO) On-Prem deployments that was actively exploited in the wild. The flaw stems from improper input validation and allows remote unauthenticated attackers to access privileged internal functionality by exploiting certificate-based authentication mechanisms. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to remediate by September 25, 2026.

1mo ago · bleeping-computer

F5 has released security updates to address a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP APM (Access Policy Manager) product that is being actively exploited in remote code execution attacks. The vulnerability affects systems configured as an OAuth Authorization Server with specific access policies and OAuth profiles on a virtual server. Exploitation can lead to remote code execution, and F5 has confirmed active attacks. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate by a specified deadline.

1mo ago · bleeping-computer

Check Point has released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-93616, in its Security Management Server that allows unauthenticated attackers to perform path traversal and upload and execute arbitrary scripts. The vulnerability is actively exploited in the wild, with Check Point confirming attacks against a handful of customers. The affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. CISA and FBI have previously warned software vendors about the persistence of such path traversal flaws, which remain a high-risk attack vector.

1mo ago · bleeping-computer

Cisco Talos discovered a new Windows malware named ClosedQuorum, which autonomously makes post-compromise attack decisions using multiple AI models including Google Gemini, DeepSeek, Qwen, and Mistral. The malware uses a voting system among the AI models to decide actions such as credential theft, code injection, persistence, and lateral movement, with DeepSeek breaking ties. Stolen data is exfiltrated via Discord webhooks. While the sample analyzed contains placeholder credentials and no active lateral movement capability, it represents an early example of fully automated, AI-driven attack chains with no human operator involvement.

1mo ago · bleeping-computer

The ShinyHunters extortion gang claims to have breached FBI systems using an unpatched zero-day vulnerability in Oracle PeopleSoft, enabling remote code execution and lateral movement into FBI-managed AWS GovCloud infrastructure. They allege exfiltration of 2–3TB of sensitive data, including personally identifiable and health-related information of current and former FBI employees and job applicants. ShinyHunters defaced the FBI Jobs website (apply.fbijobs.gov) with their branding and claim to be exploiting the same vulnerability against Fortune 500 companies. The group stated the attack was retaliation for an FBI FLASH report published in May 2026, and they have not ruled out releasing the stolen data.

1mo ago · bleeping-computer

D-Link has issued a warning about a maximum-severity zero-day vulnerability, CVE-2026-86296, affecting legacy DIR-822A Wi-Fi routers. The flaw is a stack-based buffer overflow in the DHCP server component (udhcpcd/serverpacket.c) that can be exploited without authentication or user interaction by sending crafted DHCP packets. Proof-of-concept exploit code has been publicly released, increasing the risk of weaponization. D-Link is also investigating a second critical vulnerability, CVE-2026-86510, an out-of-bounds write in the L2TP control message parser, which could allow arbitrary memory corruption on devices using L2TP or L2TPv6 WAN connectivity.

1mo ago · bleeping-computer

Microsoft, in coordination with the Health-ISAC, law enforcement, and SpyCloud, disrupted the EvilTokens phishing-as-a-service (PhaaS) platform, which had compromised over 12,000 Microsoft accounts across 10,000 organizations. The threat actor, tracked as Storm-2992, offered AI-powered device-code phishing capabilities that bypassed MFA by abusing Microsoft's OAuth 2.0 device-authorization flow. The service enabled affiliates to conduct business email compromise (BEC) campaigns by harvesting credentials through phishing lures impersonating legitimate services and using AI to identify high-value targets within compromised inboxes.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-7273, a high-severity stack-based buffer overflow vulnerability in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The flaw allows unauthenticated threat actors on the local network to execute arbitrary operating system commands via malicious HTTP requests. CISA mandated federal agencies to patch affected systems by Thursday under Binding Operational Directive 26-04. GreyNoise reported that a suspected Chinese-speaking malicious cyber actor has exploited the vulnerability to compromise nearly 1,000 switches globally, exfiltrating sensitive data from 996 devices across 48 countries.

1mo ago · bleeping-computer

Security researcher Abdelhamid Naceri (Nightmare Eclipse) disclosed a new Windows Defender zero-day vulnerability named BigDiskBuster, which allows standard users to block Microsoft antivirus definition updates by preventing Defender from performing platform and signature updates. The exploit affects all supported Windows versions and must run in the background to be effective. This is part of an ongoing series of zero-day releases by the researcher in response to a dispute with Microsoft, who has patched some but not all of the disclosed flaws.

1mo ago · bleeping-computer

BigCommerce notified multiple merchants of a data breach resulting from compromised credentials for third-party Ribon and Ribon 1.5 applications, operated by Be A Part Of (a Fastr company). Attackers used the stolen application keys between September 13 and 17, 2026, to access customer data in BigCommerce stores, including names, email addresses, phone numbers, and shipping addresses. The platform confirmed that its core systems were not breached and that payment and password data remained secure. Malicious scripts were injected into affected merchant storefronts, and BigCommerce uninstalled the apps to revoke access.

1mo ago · bleeping-computer

A pre-authenticated remote code execution vulnerability in WordPress Core, dubbed 'Click2Shell', allows attackers to force-install a theme from the WordPress.org catalog and execute arbitrary PHP code via a Customizer preview. The exploit chain does not require attacker authentication but relies on a logged-in administrator visiting a crafted URL. The vulnerability was patched in WordPress 7.1.1, which fixes improper escaping of the theme slug in jQuery selectors and restricts selector scope to legitimate theme cards. Successful exploitation could lead to full server compromise, including access to database credentials and creation of rogue admin accounts.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert warning of active exploitation of three Linux kernel vulnerabilities. One of the flaws, CVE-2025-39964, has existed for 14 years and was demonstrated to enable privilege escalation and container escape. Public exploits exist for CVE-2025-39682 and CVE-2026-53266, with the latter having a potential privilege escalation path inferred from prior vulnerabilities like Dirty Pipe. Federal agencies are ordered to patch affected systems immediately and conduct forensic triage to detect prior compromise.

1mo ago · bleeping-computer

Security researchers discovered two sandbox escape vulnerabilities in OpenAI's Codex that allowed untrusted code to execute commands on the host system. The more severe, named Heapjack, exploited shared memory in a Node.js process to steal a UUID token and gain unauthorized access to a privileged parent process, enabling remote code execution without user interaction. The second flaw, Overpatch, abused a patch utility in Codex CLI to escalate file write permissions and modify files outside the intended directory via symlink manipulation. Both vulnerabilities were fixed by OpenAI within eight days of disclosure.

1mo ago · bleeping-computer

A malicious npm campaign distributed counterfeit packages, including 'indexed-btree', designed to mimic the legitimate 'sorted-btree' library. The threat evades npm's install-script restrictions by embedding malicious logic in runtime code—specifically within the BTree.prototype.set() method—triggering execution only when called with a specific key. The malware collects system information, exfiltrates it via Slack and Telegram, and communicates with a C2 server through an Ethereum smart contract on the Sepolia test network using encrypted payloads. The attackers also created nine additional malicious packages with fabricated repositories and commit histories to appear legitimate.

1mo ago · bleeping-computer

North Korean threat actor WaterPlum conducted a global campaign from December 2025 to July 2026, compromising over 30,000 devices and stealing more than $10.7 million in cryptocurrency. The group targeted job seekers by impersonating legitimate companies and delivering malware through malicious npm packages and Visual Studio Code projects. WaterPlum deployed multiple malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal credentials, cryptocurrency keys, and conduct espionage. The actors are linked to North Korea's 313 General Bureau and operate alongside fraudulent IT worker operations using stolen identities and AI face-swapping during fake interviews.

1mo ago · bleeping-computer

Security researcher Gal Weizman discovered a new attack technique called BragJack that hijacks AI browser agents through malicious browser extensions. The proof-of-concept targets AI assistants in Chromium-based browsers including Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome by exploiting trust relationships and browser extension capabilities. The attacks use declarativeNetRequest (DNR) rules to manipulate trusted components, enabling unauthorized access to sensitive data and control over AI agents without user interaction. The technique, dubbed 'Prompt Forcing,' allows attackers to send full prompts and instructions to the AI agent, leveraging its legitimate privileges to perform malicious actions.