Intelligence Feed

1mo ago · hacker-news

A high-severity CSRF vulnerability in Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 allows unauthenticated attackers to take over WordPress sites by tricking an authenticated administrator into clicking a crafted link. The flaw bypasses CSRF protection for cookie-authenticated REST API requests when the string 'elementor/v1/events/' appears in the request URI, enabling actions like creating rogue administrator accounts. The vulnerability affects over 2 million sites and has been patched in version 4.3.2.

1mo ago · hacker-news

Cryptocurrency exchange Bitget suffered a $351.6 million theft from its hot and warm wallets, attributed to suspected North Korean threat actors. The attackers compromised a critical backend system, spoofed transaction data, and triggered unauthorized fund transfers. While customer balances remain intact and cold wallets were unaffected, withdrawals have been suspended during a security review. Bitget has engaged Mandiant and SlowMist for investigation and is collaborating with blockchain foundations to freeze hacker-controlled wallet addresses. The attack pattern aligns with known North Korean hacking groups based on IP behavior and on-chain analysis.

1mo ago · hacker-news

A new variant of the PamStealer macOS malware has been identified, featuring live command-and-control (C2) payload decryption and multi-layer persistence mechanisms. The malware is distributed via a fake cryptocurrency wallet website (wavel[.]app), which delivers a malicious disk image containing a compiled AppleScript that executes a JXA dropper. The dropper initiates a key exchange with the C2 server using X25519 to decrypt the payload, preventing static analysis. The malware employs four persistence methods, including LaunchAgent, shell hooks, and Git hooks, and ultimately deploys a Swift-based stealer to harvest credentials, browser data, keychain items, and system metadata.

1mo ago · hacker-news

Two compromised GitHub Actions, 'actions-cool/issues-helper' and 'actions-cool/maintain-one-comment', were reactivated on September 16, 2026, after being previously disabled due to their involvement in the Mini Shai-Hulud supply chain attack campaign. The repositories resumed serving malicious code that had been introduced on May 18, 2026, allowing credential harvesting from CI/CD pipelines without any new attacker action. The malicious payloads were re-downloaded and executed by workflows referencing the affected version tags, highlighting the risk of mutable version tags in supply chain security. The incident is linked to the Mini Shai-Hulud activity cluster, which also targeted npm packages under the @antv ecosystem.

1mo ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. CVE-2026-5430 is a path traversal flaw in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway that enables unrestricted file upload and remote code execution. CVE-2026-71362 is an incorrect authorization vulnerability in Adobe Commerce and Magento that allows attackers to escalate privileges and access sensitive customer data without user interaction. Exploitation of both vulnerabilities has been observed in the wild, with attacks detected as early as September 10, 2026.

1mo ago · hacker-news

Cloudflare patched a vulnerability in its Containers and Sandboxes services that allowed a customer's container to read leftover disk data from previously deleted containers on the same server. The issue stemmed from thin-provisioned disks that were not properly wiped before reallocation, enabling data remnants—including SQLite databases, .env files, and browser profiles—to be recovered. The flaw was reported by researcher Oren Yomtov via Cloudflare's bug bounty program and was fixed by re-enabling block wiping and retiring all running container disks and caches. Cloudflare found no evidence of exploitation beyond authorized testing.

1mo ago · hacker-news

A pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is being actively exploited in the wild. The flaw exists in the virtuser_query plugin of versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, allowing unauthenticated attackers to inject arbitrary SQL and potentially access mail account credentials and stored messages. The Canadian Centre for Cyber Security and SentinelOne have confirmed active exploitation, though specific threat actor details remain limited. Patches were released in May 2026, but over 500,000 Roundcube instances remain internet-exposed, with at least 10 identified as vulnerable as of late September 2026.

1mo ago · hacker-news

A malicious Android spyware dubbed Corp MDM is targeting logistics firms by distributing fake Google Play pages impersonating CEVA and TKW Logistics. The malware, delivered as a trojanized APK with package name 'com.corp.mdm', steals newly received SMS messages, redirects calls, and maintains a hidden foreground service. It communicates with a command-and-control server at 69.55.61.82 via HTTP, exfiltrating SMS content and device identifiers while supporting remote commands such as call forwarding and self-destruction. The campaign is suspected to be financially motivated, with links to a Russian-Armenian threat actor operating a phishing-as-a-service platform called Global Profit.

1mo ago · hacker-news

A threat campaign dubbed ClickFix is compromising legitimate Ukrainian business websites to serve fake Cloudflare verification pages that trick users into executing a malicious command. The command downloads an MSI installer delivering Psychedelic Stealer, a previously undocumented information stealer that exfiltrates browser credentials, cryptocurrency wallets, and account tokens. The attackers also use a lure management panel hosted on uasputnik.com, and the malware establishes persistence via scheduled tasks and communicates with C2 servers. A second malware chain delivers RemotePanel, a remote access tool, and BoundSiphon, a .NET stealer, using similar social engineering lures.

1mo ago · hacker-news

The domain third-party[.]com, historically used as a documentation placeholder in code and technical writing, has been registered by an attacker and is now serving a ClickFix social engineering lure targeting Windows users. When accessed from Windows, the site poisons the clipboard with a malicious PowerShell command intended for execution via the Run dialog, while showing a benign or unsupported message to other platforms like macOS. The domain is referenced in over 1,700 public GitHub repositories, including AI agent skills and API documentation, amplifying exposure. Additionally, two other placeholder domains—yoursite[.]com and your-domain[.]com—are actively serving scams and scareware, particularly targeting macOS users with fake security alerts and fraudulent investment offers.

1mo ago · hacker-news

The article details multiple active cyber threats, including the RemControl Android banking trojan targeting users in Western Europe, the Middle East, and Canada via fake Google Play Store pages distributed through Meta ads. The malware abuses Android Accessibility Services to perform screen streaming, keystroke logging, and remote control, with command-and-control infrastructure dynamically resolved through encrypted Telegram dead-drops. Phishing overlays and operator panels show signs of AI-assisted development, and Russian-language code comments suggest Russian-speaking involvement. The campaign shares infrastructure and tactics with the Medusa UNKN affiliate botnet, indicating a coordinated threat operation.

1mo ago · hacker-news

A security researcher, Rasmus Moorats, identified two unpatched vulnerabilities in OnePlus devices running OxygenOS that can be chained to allow a locally installed Android app with no permissions to gain full root access. The first flaw is in the AtlasService, which runs as root and accepts unvalidated input from any app, enabling command injection into a restricted root environment. The second flaw leverages the olc2 hardware helper service, which executes arbitrary shell commands if the caller has root—achieved via the first flaw—granting full system-level control. As of September 24, 2026, no fix or CVE had been issued by OnePlus, and the company warned the researcher against public disclosure, citing legal consequences.

1mo ago · hacker-news

ClickFix is a social engineering-based initial access technique that manipulates users into pasting malicious commands into trusted system interfaces, bypassing traditional security controls. The attack leverages compromised websites, often WordPress-based, to serve fake verification pages that trigger clipboard manipulation and user-driven command execution. Infrastructure is resilient, using blockchain (Polygon) and Telegram/Steam for dynamic domain resolution, enabling rapid rotation and evasion of blocklists. Payloads are fingerprint-gated, delivering malware like Vidar Stealer only to specific victims based on hardware and account identifiers, making sandbox analysis unreliable.

1mo ago · hacker-news

Threat actors are actively exploiting CVE-2026-87902, a critical vulnerability in WordPress that allows unauthenticated remote code execution (RCE) under specific conditions. Exploitation requires the active theme to have a directory starting with 'page-' and a readable local PHP file such as 'pearcmd.php' on the server. Attackers are leveraging the vulnerability to write PHP web shells to temporary directories and are retrieving payloads from a GitHub repository. Multiple IP addresses have been observed conducting exploitation attempts, with the first recorded just hours after the patch was released.

1mo ago · hacker-news

The UNK_CondorFiltration campaign, leveraging the TeamFiltration framework, conducted brute-force attacks against Microsoft 365 accounts across 28 tenants, primarily targeting Chilean financial and retail organizations. The attackers exploited unmanaged service accounts with default or unrotated passwords and no multi-factor authentication, compromising seven accounts. Six of the seven breaches occurred within seven minutes of each other, suggesting shared credentials. Post-compromise, the threat actor used German VPN nodes to access corporate resources including Azure Portal, SharePoint Online, and Microsoft Graph API.

1mo ago · hacker-news

Cisco Talos identified a novel Windows malware named CLOSEDQUORUM that leverages commercial AI models—DeepSeek, Qwen, Mistral, and Google Gemini—to make autonomous decisions on attack actions through a voting mechanism. The malware performs credential theft, code injection, persistence, and lateral movement based on consensus from AI models, with decisions logged and data exfiltrated via a Discord webhook. While the public version is non-functional due to placeholder API keys and webhook URLs, the malware represents a new paradigm in AI-driven threats. Indicators include specific behaviors such as AI service queries from non-AI applications, LSASS memory dumping, process injection, and WMI-based persistence with Windows Update-themed names.

1mo ago · hacker-news

Threat actors, attributed to North Korea, are distributing Go-based malware through malicious Terraform providers and Go modules hosted on the HashiCorp and npm registries, marking a novel supply chain attack vector. The malware uses dual command-and-control channels via Ethereum smart contracts on testnets and Slack, with execution often gated by cryptographic checks to hinder analysis. The same infrastructure and techniques are linked to the previously known Graphalgo and PolinRider campaigns, indicating a coordinated, targeted operation using fake job interviews as an initial access vector.

1mo ago · hacker-news

A use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem, tracked as CVE-2026-80521, enables container escape to gain root privileges on the host. The flaw affects unpatched Ubuntu 26.04, 24.04, and 22.04 LTS releases, despite an upstream fix being available since August 6, 2026. Security firm DepthFirst released exploit code targeting Ubuntu 26.04, demonstrating the practical risk of containerized environments where default seccomp policies allow access to AF_UNIX sockets. Although no active attacks have been confirmed, the vulnerability undermines container security assumptions, especially as AI-assisted research accelerates discovery of such flaws.

1mo ago · hacker-news

cPanel disclosed three security flaws, two of which are critical, allowing privilege escalation and unauthorized access on shared hosting servers. CVE-2026-87899 enables a logged-in cPanel account holder to execute code as root via the CalDAV and CardDAV service, achieving full server control. CVE-2026-87900 affects the WP Toolkit plugin, allowing a user to modify databases belonging to other accounts. CVE-2026-68490 permits local users to read calendar and contact data from other accounts, though not modify it or escalate privileges. All vulnerabilities have been patched, but no exploitation in the wild has been reported.

1mo ago · hacker-news

Unknown threat actors have compromised specific versions of the MemTensor packages on npm and PyPI, injecting a malicious Go-based credential stealer named sckit. The malicious packages, when used in development or CI environments, execute a payload that harvests sensitive credentials from cloud services, source control, package registries, and developer tools. The malware exfiltrates stolen data to the domain skyleen[.]fr and can self-propagate via GitHub, npm, and PyPI. Organizations are advised to pin to known clean versions, rotate secrets, and block the C2 domain.

1mo ago · hacker-news

ShinyHunters, a cyber extortion group, claimed responsibility for breaching the U.S. Federal Bureau of Investigation (FBI), asserting they exfiltrated sensitive data on current and former agents and job applicants. The group reportedly exploited a zero-day vulnerability in Oracle PeopleSoft to gain remote code execution and deface the FBI's jobs portal, FBIjobs.gov, with a taunting banner. They linked the attack to retaliation for an FBI public service announcement criticizing their prior activities, particularly around the Canvas LMS breach. While the FBI has acknowledged awareness of the claims and is investigating, no technical evidence or data dumps have been independently verified yet.

1mo ago · hacker-news

A critical vulnerability in Next.js, tracked as CVE-2026-94545, allows server-side code execution when attacker-controlled input is processed by the ImageResponse feature during SVG generation. The flaw exists in versions 16.2.0 through 16.3.5 when using the Node.js runtime, where unsanitized input can be interpreted as SVG code due to improper escaping in the underlying Satori library. This could enable remote attackers to execute arbitrary code on the server if user-supplied values are embedded in SVG content, attributes, or styles. The vulnerability was patched in Next.js 16.3.6 and Satori 0.33.5, with no public exploits or active attacks reported at the time of disclosure.

1mo ago · hacker-news

A Chinese threat actor, UTA0565, exploited a zero-day chain involving vulnerabilities in Google Chrome and Microsoft Windows to deploy a new malware family named CLEANGULP. The attacks, observed on September 3 and 4, 2026, used fake websites mimicking media organizations and NGOs to deliver the BlueMoon exploit kit, which leveraged CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to escape the browser sandbox and execute code remotely. The malware, delivered as 'chrome_cleanup.exe', communicates with a hard-coded C2 domain and provides capabilities including command execution, process listing, file upload/download, and beacon object file execution.

1mo ago · hacker-news

F5 has patched a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution on systems where APM is configured as an OAuth authorization server. The vulnerability is a heap-based buffer overflow with a CVSS v3.1 score of 9.8, and it is actively exploited in the wild. Malicious traffic targeting the virtual server can trigger remote code execution, bypassing protections on the management interface. The U.S. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and mandated federal agencies to apply mitigations within three days.

1mo ago · hacker-news

A former Microsoft security researcher, Abdelhamid Naceri, publicly released a zero-day proof-of-concept tool called BigDiskBuster that blocks Microsoft Defender from installing platform and signature updates by consuming all available disk space. The tool monitors Defender's update paths and creates a large hidden temporary file to prevent update downloads, deleting it once the update attempt fails. This denial-of-service technique could leave Defender with outdated detection capabilities, increasing risk of undetected malware. No patch or CVE has been issued, and the tool reportedly works across all supported Windows versions.

1mo ago · hacker-news

A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the gateway server via a single HTTP request. The flaw, tracked as CVE-2026-90898, affects all versions prior to 2.1.0 when management authentication is disabled by default. Attackers can exploit the /api/mcp/client endpoint to register a stdio-type MCP client, leading to immediate command execution as the gateway process user, potentially exposing stored API keys for LLM providers. A second related vulnerability, CVE-2026-86242, allows unauthenticated registration of a custom plugin from an HTTP URL, resulting in remote code execution or server-side request forgery depending on the build type.

1mo ago · hacker-news

Microsoft, in collaboration with multiple public and private partners, disrupted the EvilTokens phishing-as-a-service (PhaaS) platform, which leveraged AI to automate and scale business email compromise (BEC) attacks. The service abused OAuth 2.0 device authorization flows to gain persistent access to Microsoft accounts without stealing passwords, using social engineering to trick users into entering device codes on legitimate Microsoft login pages. EvilTokens offered AI-powered tools to analyze compromised inboxes, identify financial workflows, and draft convincing phishing emails, enabling even low-skill attackers to conduct sophisticated fraud. The operation led to the seizure of 50 websites, takedown of 150 domains, and the arrest of two individuals, with evidence linking the service to over 12,000 compromised inboxes across 10,000 organizations worldwide.

1mo ago · hacker-news

A malicious npm package named 'tw-pkgprobe-7731' was uploaded to the npm registry by a now-defunct account 'twdepprobe7731', masquerading as an authorized Twilio bug-bounty probe. The package targets Twilio developers by checking for specific environment conditions and, if met, exfiltrates environment variables, system configurations, and Twilio credentials such as ACCOUNT_SID and AUTH_TOKEN. Later versions attempted to inject malicious npm packages and perform OSINT gathering on Twilio-related infrastructure, though the final versions reverted to benign behavior, suggesting possible testing or evasion. The package violates Twilio's HackerOne security research guidelines and shows no obfuscation, indicating a low sophistication threat actor.

1mo ago · hacker-news

WordPress has patched a critical vulnerability, CVE-2026-87902, that allows unauthenticated attackers to exploit a path traversal flaw in the template loading mechanism, potentially leading to remote code execution on vulnerable servers. The vulnerability affects all WordPress versions from 4.7.0 to 7.1.1 and stems from insufficient sanitization of user-supplied input used to construct template file paths. Successful exploitation requires the active theme to have a top-level directory starting with 'page-' and depends on server-side PHP configuration (e.g., register_argc_argv enabled) for full code execution. While no active exploitation has been observed as of September 22, 2026, the flaw is rated with a CVSS score of 9.2 and affects a wide range of WordPress installations.

1mo ago · hacker-news

A vulnerability in SharePoint Server, tracked as CVE-2026-65660, initially misclassified by Microsoft as a spoofing flaw, actually enables authenticated remote code execution. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition, and stems from improper handling of double quotes in web-part markup within the ToolPane component, allowing arbitrary .NET class registration and subsequent code execution via XamlServices.Parse() deserialization. Researcher Dinh Ho Anh Khoa demonstrated the exploit and noted it could be chained with a previously patched authentication bypass to achieve pre-authentication RCE on anonymously accessible servers. Although no in-the-wild exploitation has been reported, the full exploit is public, and the patch was released in Microsoft's August 11 updates.