Intelligence Feed

1mo ago · hacker-news

Attackers exploited a chain of two vulnerabilities in self-hosted JFrog Artifactory instances—CVE-2026-42018 and CVE-2026-42016—to escalate privileges from unauthenticated access to full administrator control. By exploiting the first flaw to obtain an internal anonymous user token and then abusing the second to elevate it to admin scope, attackers created backdoored administrator accounts and deployed malicious Groovy plugins for code execution. In parallel, a separate critical vulnerability, CVE-2026-82329, allowed unauthenticated attackers to gain admin privileges directly, leading to theft of cluster join keys and deployment of custom Rust-based backdoors on compromised servers.

1mo ago · hacker-news

A suspected Russian-speaking threat actor has exploited CVE-2026-81578 and CVE-2026-82078, a vulnerability chain in PaperCut NG/MF involving authentication bypass and remote code execution, to compromise at least 440 instances across 395 organizations in 48 countries. The attacker used AI agents powered by OpenAI Codex and DeepSeek, along with offensive tools like Mimikatz and Impacket, to automate exploitation and post-compromise activities including credential harvesting and domain reconnaissance. The campaign targeted primarily the education sector and demonstrated rapid lateral movement, with some attacks achieving domain administrator access in under seven minutes. The actor’s ultimate objectives remain unclear, though activity suggests potential initial access brokering or preparation for follow-on attacks such as data theft or ransomware.

1mo ago · hacker-news

Multiple threat actor clusters have exploited two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC) to gain unauthorized access, steal credentials, and deploy ransomware. CVE-2026-20079, a critical authentication bypass flaw (CVSS 10.0), allowed unauthenticated remote attackers to execute scripts and gain root access. CVE-2026-20316, a lower-severity flaw, enabled access via a low-privilege account and was used in conjunction with other vulnerabilities for privilege escalation. Three distinct post-compromise activity clusters were identified: UAT-12197 deployed JSP web shells and JAR-based command executors; UAT-11823 delivered Netcat reverse shells and a Cyclops Blink variant; and UAT-11988, a ransomware operation, used living-off-the-land techniques to deploy Qilin ransomware.

1mo ago · hacker-news

PaperCut has released new maintenance versions (26.0.5, 25.0.13, 24.1.10) that replace emergency patches for two actively exploited vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which allow authentication bypass and arbitrary code execution. A suspected Russian-speaking threat actor has exploited these flaws to compromise at least 395 organizations across 48 countries, primarily targeting the U.S. education sector. The attacks involve the use of hundreds of AI agents and originate from the IP address 45.142.193[.]132, with observed activity avoiding certain geographic regions. Customers are urged to upgrade from emergency patches to the fully tested maintenance releases for complete protection.

1mo ago · hacker-news

The Gigabud banking trojan, attributed to the threat actor GoldFactory, has evolved to use a second malicious app called Vwork to create Android work profiles. This technique isolates a tampered banking app within the work profile, evading malware detection by legitimate banking apps running in the personal profile. The attacker gains full control via Accessibility services, overlays fake login screens, and steals credentials and transaction data. This method has been confirmed in Indonesia, with activity observed across multiple countries, resulting in nearly $1 million in estimated losses.

1mo ago · hacker-news

A Chinese-speaking threat actor is leveraging AI models like Anthropic Claude, Alibaba Qwen, and DeepSeek to automate cyber intrusions against government and financial systems in multiple countries, including Taiwan, Afghanistan, Thailand, and the U.S. The campaign uses an AI orchestration framework called SecFlow to divide tasks among specialized AI agents for reconnaissance, exploitation, and data collection. Exploited vulnerabilities include Log4Shell, Spring4Shell, and Shiro deserialization, leading to web shell deployment and lateral movement using a Go-based backdoor named SecBox. The campaign was first reported in July 2026. Another related campaign involves EtherRAT and TukTuk malware, where attackers deploy ransomware known as The Gentlemen after gaining access via malicious MSI installers and conducting credential theft and lateral movement.

1mo ago · hacker-news

Check Point disclosed two critical vulnerabilities in its Security Gateways and Security Management Server products that could allow unauthenticated remote code execution during VPN certificate processing. The first, CVE-2026-85102, stems from improper certificate trust validation, while the second, CVE-2026-85103, is a heap-based buffer overflow in ASN.1 certificate decoding. Both vulnerabilities carry a CVSS score of 9.8 and affect multiple versions of Check Point's R81 and R82 product lines. While Check Point states the flaws were internally discovered and not yet exploited, mitigation is advised through Live Patch or Jumbo Hotfix updates, though some customers reported delays in patch availability and unclear mitigation instructions.

1mo ago · hacker-news

Threat actors are abusing Google Play's Early Access program to distribute deceptive Android apps that promise rewards, casino winnings, or premium content but fail to deliver. These apps bypass user reviews and ratings, enabling malicious actors to promote them via social media ads featuring AI-generated celebrity deepfakes. The apps often deliver virtual rewards initially but stall progression before withdrawals, serving excessive ads to generate illicit revenue. Additional Android malware families such as Hagaseca, Mantax Otax, StreamRat, and Vwork are also active, with capabilities ranging from remote access and data theft to ransomware and financial fraud.

1mo ago · hacker-news

Multiple espionage-motivated threat actors, including APT31 and several China-aligned clusters, have leveraged a previously undocumented exploit kit named BlueMoon to exploit unpatched vulnerabilities in Google Chrome and Microsoft Windows. The exploit chain combines CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to achieve sandbox escape and local privilege escalation, delivered via phishing emails leading to malicious URLs. The kit downloads payloads such as the GemStone browser backdoor, ShadowPad, and Rust-based malware using DLL sideloading and in-memory execution techniques. The U.S. CISA has added all three CVEs to its KEV catalog, mandating federal agencies to patch them by mid-September 2026.

1mo ago · hacker-news

Wiz Research identified that nearly 1 in 10 internet-facing LiteLLM gateways accepted the default example admin key 'sk-1234', exposing critical cloud IAM credentials and API keys. Attackers with access to the master key can read all model provider API keys, execute code via misconfigured endpoints, and exploit pass-through routing to harvest cloud instance metadata. Multiple CVEs have been documented, including authentication bypasses and post-authentication code execution flaws, some of which are already being exploited in the wild to deploy cryptocurrency miners and extract sensitive data. Despite patches, many deployments remain vulnerable due to misconfigurations and unrotated default keys.

1mo ago · hacker-news

A critical vulnerability in Alby Hub, a self-hosted Lightning wallet, affects versions v1.7.0 through v1.18.5 and could allow attackers to take over internet-exposed wallets and potentially steal funds. The flaw exists when users expose the Hub's management interface to the public internet, contrary to intended deployment on private networks. Alby has confirmed one user was affected, though it is unclear if funds were lost. The company recommends immediately restricting external access and upgrading to version v1.24.0, while also changing the wallet's unlock password if exposed.

1mo ago · hacker-news

A critical vulnerability in DeepSeek Harness, an open-source tool for running AI coding agents, allowed sandboxed agents to disable their own file sandbox by invoking a local web interface without authentication. The flaw, tracked as CVE-2026-82533, enabled an agent to switch its session to 'danger-full-access' mode via a single command, escaping file restrictions and potentially executing commands outside its workspace. The vulnerability affected versions 0.1.1-rc.2 and earlier, with the fix introduced in version 0.1.2-alpha.2, which added one-time token authentication for the local interface. Researchers from OX Research reported the issue, and community members had previously observed the same behavior before official disclosure.

1mo ago · hacker-news

Information stealer malware such as Lumma Stealer and Vidar are harvesting session tokens and API keys from compromised systems, enabling threat actors to replay these credentials and gain unauthorized access to AI services like Google Gemini, OpenAI, Anthropic, and others, bypassing multi-factor authentication. A 7 GB infostealer dump analyzed by Okta contained 44,791 unique JSON Web Tokens (JWTs), 555 of which were likely tied to AI service authentication, along with 2,937 encrypted JWE structures, primarily from OpenAI. Attackers are using stolen tokens to access premium AI models and sell access on underground forums, leveraging anti-detect browsers like Camoufox to avoid detection. The abuse of valid, unexpired API keys and tokens—termed 'LLMjacking'—allows attackers to conduct espionage, resource theft, or run up AI service bills on victims.

1mo ago · hacker-news

A critical pre-authentication remote code execution vulnerability, CVE-2026-86218 (CVSS score: 10.0), in N-able N-central is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code remotely, enabling full compromise of the platform used by MSPs and large IT organizations to manage downstream systems. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 11, 2026. Although N-able released a fix in version 2026.3 Hotfix 4, evidence suggests prior exploitation of internet-facing instances, with potential links to ransomware threat actors.

1mo ago · hacker-news

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities across its software ecosystem, including two actively exploited Windows zero-day flaws. CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC that enables local privilege escalation to SYSTEM privileges. CVE-2026-81963 is an improper link resolution vulnerability in the Windows Update Stack, also allowing local privilege escalation. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 22, 2026.

1mo ago · hacker-news

SAP has patched a critical CVSS 10.0 vulnerability, CVE-2026-44756 (OVERPASS), in the SAP kernel's Extended Passport (EPP) processing, enabling unauthenticated remote code execution with administrative privileges. The flaw arises from missing boundary validation during EPP deserialization, allowing attackers to execute arbitrary OS commands, compromise business data, and move laterally across SAP systems. The vulnerability is reachable via multiple internet-facing protocols without authentication, including web, SAP GUI, and RFC layers. Another critical flaw, CVE-2026-58240 (S4GET), in SAP NetWeaver Message Server also allows unauthenticated remote code execution on SAP S/4HANA systems.

1mo ago · hacker-news

Security researcher Chaotic Eclipse has released a proof-of-concept (PoC) exploit demonstrating a patch bypass for CVE-2026-69414, a vulnerability in Microsoft Defender previously known as ShieldBreak. The newly disclosed bypass, dubbed ShieldCrash, allows arbitrary file read with SYSTEM privileges on all supported versions of Windows despite Microsoft's patch in Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft failed to fully address the original vulnerability, leaving a code path still exploitable under specific conditions.

1mo ago · hacker-news

Malware exploiting CVE-2025-53521 on F5 BIG-IP APM appliances injects a PHP web shell directly into memory, evading traditional disk-based detection. The malware modifies the Apache binary at /usr/sbin/httpd and hooks into the Apache Portable Runtime to intercept loading of PHP modules, dynamically injecting the web shell when specific PHP scripts are loaded. Attackers can gain remote code execution without authentication, and the malware establishes persistence through modified system binaries and hidden sockets, with indicators including unexpected file modifications, SELinux disablement, and anomalous HTTP responses.

1mo ago · hacker-news

cPanel has patched a critical vulnerability, tracked as CVE-2026-67401, that allows an authenticated hosting account with mail privileges to execute arbitrary code as root due to an SQL injection flaw in the EmailTrack component. The vulnerability affects all supported versions of cPanel and WHM, enabling a local privilege escalation path from a regular user to full server compromise. While no public exploit or active attacks have been observed as of September 9, 2026, similar recent cPanel flaws have been exploited in the wild, including in ransomware campaigns. The CVE record for this flaw had not yet been published at the time of reporting, and no mitigations are provided for systems unable to update immediately.

1mo ago · hacker-news

A zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, tracked as CVE-2026-87491, is being actively exploited in the wild. The flaw is an out-of-bounds write that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Google has patched the vulnerability in Chrome versions 153.0.8010.36 and later, but has not disclosed specific details about the exploitation or the threat actor involved, likely to prevent further abuse before widespread patching.

1mo ago · hacker-news

Researchers at Calif demonstrated a zero-click worm exploiting a vulnerability in WeChat that allows full takeover of a user's account via an incoming call, without requiring any interaction from the target. The exploit spreads laterally by leveraging compromised accounts to call other contacts, enabling rapid propagation across devices. The attack works even if the call is not answered, though declining the call stops that particular attempt. Tencent mitigated the exploit server-side and released client updates (Android 8.0.77, iOS 8.0.76) in August 2026, but has not issued a formal advisory or CVE. No real-world attacks have been observed, and technical details have been withheld pending a future conference presentation.

1mo ago · hacker-news

A financially motivated threat actor known as TeamPCP (aka Altered Spider, UNC6780) has conducted large-scale software supply chain attacks targeting PyPI, npm, and Docker Hub, deploying credential stealers SANDCLOCK and DUSTMAKER. SANDCLOCK, used in March and April 2026, is a Python-based tool targeting Linux and Kubernetes environments with container escape capabilities, while DUSTMAKER is a cross-platform JavaScript payload focused on credential theft in CI/CD pipelines and includes AI-targeting techniques like prompt injection. The group exfiltrates API credentials and targets AI coding assistants, monetizing access through ransomware and data theft extortion networks.

1mo ago · hacker-news

Slim Spider is a financially motivated threat actor targeting Brazilian financial institutions since at least March 2026. The group conducts multi-stage intrusions into cloud environments to steal cryptocurrency custody secrets and access instant payment systems like Pix. They use custom Bash scripts to extract cloud credentials, implement cloud-native cryptographic signing via OpenSSL, and deploy backdoors such as MikeDor. Slim Spider also leverages malicious DevOps pipelines and maintains web-based panels for automating attacks, including endpoint scanning, email reconnaissance, and unauthorized Pix transactions.

1mo ago · hacker-news

Check Point Research discovered a vulnerability in ChatGPT that allowed a maliciously crafted prompt to enable covert data exfiltration from a user's session. By exploiting a shared internal JFrog Artifactory service used for package caching, an attacker could establish a hidden communication channel between isolated ChatGPT containers across different accounts. This allowed the silent reading of Gmail data, chat history, and files from a victim's session and transmitting them to an attacker-controlled account without user consent or awareness. The vulnerability stemmed from improper isolation in the internal service and excessive container permissions, which allowed write access to shared metadata properties. OpenAI confirmed the issue and took the internal service offline, but no user-facing patch was required or released.

1mo ago · hacker-news

On September 6, 2026, approximately 4,000 bitcoin (worth ~$320M) were withdrawn from the Liquid Network's federation wallet due to a bug in the Elements software underlying the sidechain. The attackers, who claim to be white hats, returned 3,400 bitcoin after confirming that Blockstream had patched its systems, but are still holding 598.5 bitcoin (~$47M). The exploit leveraged the SideSwap Peg-out Authorization Key to initiate a peg-out without compromising any private keys, suggesting a flaw in logic or validation within the Elements codebase. Communications occurred on-chain, including a PGP-encrypted message sent via a microtransaction, and the incident remains unresolved as the network stays offline.

1mo ago · hacker-news

BengalSEO is a financially motivated threat actor operating since at least 2015 from Rajasthan, India, using black hat SEO techniques to poison Bing search results and promote malicious lure pages. These pages are used to deliver the MayaBot malware via JavaScript droppers or redirect victims to tech support scams. The group uses a sophisticated traffic distribution system (TDS) with cloaking, fingerprinting via Matomo analytics, and abuse of trusted hosting platforms like GitHub Pages and Cloudflare to evade detection. The infrastructure includes multiple redirector domains, malicious ZIP files, and lure pages hosted across high-reputation services to manipulate search rankings and deliver payloads.

1mo ago · hacker-news

Adobe has patched a critical zero-day vulnerability, CVE-2026-75650 (CVSS score 10.0), actively exploited in the wild and dubbed StyleSmuggler by Sansec. The flaw affects Adobe Commerce and Magento Open Source, enabling unauthenticated remote code execution via PHP code injection in the template system. Threat actors are exploiting the vulnerability to deploy a Rust-based Linux backdoor and a PHP web shell for persistent access and arbitrary code execution on compromised e-commerce servers.

1mo ago · hacker-news

PEEP is a post-compromise Chromium-based toolkit that installs a malicious browser extension to establish persistence and enable command-and-control (C2) operations within compromised Chrome or Edge browsers. The malware bypasses browser security checks by manipulating Secure Preferences and uses native messaging to execute host-level commands, steal credentials, and exfiltrate browsing data. It communicates with C2 servers every 30 seconds over HTTP, supports remote updates, and includes PowerShell and Python scripts for cross-platform deployment, indicating active targeting of both Windows and Linux environments.

1mo ago · hacker-news

A public proof-of-concept exploit has been released that chains multiple vulnerabilities in Telerik UI for ASP.NET AJAX to achieve unauthenticated remote code execution. The attack chain leverages a padding oracle (CVE-2026-13182) to decrypt and forge encrypted state, leading to type confusion and deserialization of a malicious mixed-mode DLL via an unguarded type resolution flaw (CVE-2026-13181). Successful exploitation requires non-default configurations, including use of a custom encryption key and presence of the RadAsyncUpload control. While no confirmed in-the-wild exploitation has been reported, the release of working tooling increases risk for misconfigured systems.

1mo ago · hacker-news

Cybersecurity firm Huntress identified worm-like activity abusing ConnectWise ScreenConnect to propagate a four-stage VBScript chain across newly connected hosts. The attack uses social engineering, phishing, or fake refund forms to deploy rogue ScreenConnect clients, which then execute a sequence of malicious VBScripts (1.vbs to 4.vbs) for reconnaissance, payload retrieval, and execution. The final stage deploys backdoors, privilege escalation tools, or cryptocurrency miners based on system state, and the infected host re-infects new connections, creating self-propagating behavior. ConnectWise issued an advisory recommending disabling file transfer permissions to mitigate the risk.