OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

Making installation easier and putting a new wrapper on the interface while leaving most of the security to users is a recipe for more trouble with the popular agent harness

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Research by: hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the malware since early […] The post Breaking

Berlin confirms data theft after Rhysida ransomware attack claims

Berlin's city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. [...]

McKesson Confirms Data Breach as Attacker Deadline Looms

The ShinyHunters extortion group has claimed the theft of 284 million records from the company’s systems. The post McKesson Confirms Data Breach as Attacker Deadline Looms appeared first on SecurityWeek.

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed. [...]

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. [...]

Chrome Web Store extensions caught stealing crypto, browser data

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures. [...]

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 112

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor FTP Banners: The New Dead Drop Resolver Delivering Novel RATs The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic […]

Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch

PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution. PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evide

Security Affairs newsletter Round 592 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Hack One Robot, Reach the Next: Unitree G1 Security Flaws Rhysida Ransomware Group Targets Berlin Government Ahead […]

Brits Want Private Messages to Remain Encrypted

A new poll indicates that a significant majority of British adults desire their private online communications to remain encrypted and inaccessible to the government without a court order. The research also reveals widespread distrust in any government's ability to handle such access responsibly, regardless of political affiliation. These findings emerge amidst ongoing tensions between the UK government's desire for access to encrypted data and the tech industry's stance on maintaining strong encryption.

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Unpatched Zimbra servers are falling to CVE-2026-73570 attacks At least 274 internet-facing Zimbra instances have been compromised by unknown attackers via CVE-2026-73570, the Shadowserver Foundation shared on Monday. AI supply chain risk is showing up in developer workflows first In this Help Net Sec

New Malware Uses Fake CAPTCHAs to Deploy Backdoor

A new malware variant, identified as TerminalFix, has been discovered by Microsoft. This malicious software tricks users into executing harmful commands through Windows Terminal or PowerShell by presenting fake Cloudflare CAPTCHAs. Unlike previous versions that targeted the Run dialog, this variant's use of the command line interface may increase its success rate.

Anthropic is cutting Claude Code's current weekly limits by 17%

Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. [...]

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in

Brave browser adds email aliases to help users evade tracking

The latest version of the Brave browser, 1.94, introduces a feature called 'Email Aliases' that allows users to generate disposable email addresses when signing up to a new service. [...]

Hack One Robot, Reach the Next: Unitree G1 Security Flaws

A security researcher has discovered a chain of two vulnerabilities in the Unitree G1 humanoid robot that allows for remote, unauthenticated root access. The flaws can be exploited through a combination of Bluetooth, Unitree's cloud infrastructure, and the mobile app, enabling an attacker to compromise a robot and then use it to attack other nearby robots. Unitree has since patched the cloud vulnerability and issued bounties for the discovered flaws.

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

The government of Berlin is responding to a ransomware attack by the Rhysida group, which claims to have stolen 5.79 TB of data, including personal information and sensitive government documents. Officials have refused to pay the ransom, citing advice against such payments and asserting that election data was not compromised. The attack occurred weeks before a state election, raising concerns about its timing and the potential impact of data leaks.

The Cybersecurity Apocalypse Is Coming in ‘Months,’ AI Giants Warn

Leading AI companies and over 100 other organizations have signed a letter warning that the world has only months to prepare for sophisticated AI-driven cyberattacks. The letter urges immediate leadership focus on cyber defense and calls for governments to provide defensive AI tools to critical infrastructure and impose costs on attackers. Meanwhile, federal officials reported that over 100 water systems were targeted in July, with hackers reportedly using AI to generate attack scripts.

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

A suspected Chinese-speaking cyber operator has targeted Philippine nuclear and naval entities by exploiting known vulnerabilities in ownCloud and WordPress systems. The actor successfully exfiltrated sensitive data, including nuclear reactor information and personnel records, from a nuclear research body and a marine engineering company supporting the Philippine Navy. The intrusions were discovered after an exposed server containing attack tools and stolen data was found.

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

A sophisticated cyber campaign dubbed TerminalFix, a variant of ClickFix, is targeting organizations by tricking users into executing malicious PowerShell commands via a fake Cloudflare CAPTCHA. This campaign deploys a multi-stage attack involving DLL sideloading, steganographic payload extraction from images, and extensive Active Directory reconnaissance. The ultimate goal is to establish a persistent reverse tunnel, granting attackers network-level proxy access to internal systems for further exploitation.

[Virtual Event] Building a Secure AI Strategy for the Enterprise

[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AI

McKesson discloses breach after ShinyHunters claims patient data theft

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records. [...]