News Archive
2287 stories · page 16 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers are actively exploiting a critical vulnerability in the Issabel Framework, a web-based component of the open-source unified communications PBX software. This flaw, identified as CVE-2026-89026, allows for unauthenticated remote operating system (OS) command execution, posing a significant risk to affected systems.
Self-improving AI should slow down, von der Leyen tells EU lawmakers
European Commission President Ursula von der Leyen has called for a slowdown in the development of frontier artificial intelligence, citing concerns about its potential misuse for hacking and the risks posed by self-improving models. Speaking to the European Parliament in Strasbourg, von der Leyen announced plans to invite leading AI laboratories to discuss how the EU can support efforts to…
Fake CAPTCHA Scams
A new variant of a long-standing scam has emerged, leveraging the familiar interface of a CAPTCHA challenge to trick users into downloading and executing malicious software. This technique represents an evolution in social engineering, exploiting user expectations regarding security verification steps to deliver payloads.
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google has released a security update addressing a high-severity vulnerability in its Pixel Cellular Modem, acknowledging that the flaw has been exploited in limited, targeted attacks in the wild. The issue, identified as CVE-2026-58704, carries a CVSS score of 8.0, indicating a significant risk.
Mythos has made 2026 patching hell. It might make 2027 a breeze
The year 2026 has seen an unprecedented volume of software patches, creating significant challenges for cybersecurity teams, but this surge in vulnerability disclosures may signal a turning point towards more secure software in 2027. This perspective, presented at Gartner’s IT Symposium in Australia, suggests that AI-powered bug-hunting tools, such as Anthropic’s Mythos, are rapidly…
DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero, an open-source engine designed to automate the discovery of exploitable vulnerabilities in Windows kernel drivers, has identified multiple confirmed flaws within a subset of the Snappy Driver Installer corpus. Some of these findings are reportedly still undergoing the disclosure process. The project, maintained by Rehman Ahmadzai, is available for free on GitHub.
The modern attack chain: Rethinking Google Workspace security in the age of AI
Recent cybersecurity incidents involving Vercel and Composio have revealed an evolving attack chain targeting Google Workspace, where initial compromise often bypasses traditional email-centric defenses. This new pattern, which leverages stolen OAuth tokens as an entry point, mirrors the operational model of legitimate AI agents, raising concerns about unintended data exposure even without…
The vulnpocalypse rains iBugs down on Apple with record-setting number of patches
Apple has released a substantial security update across its operating systems and software, addressing over 260 Common Vulnerabilities and Exposures (CVEs). This marks the largest single patch cycle in the company's history. While no vulnerabilities are currently reported as being under active exploitation, the disclosure of these flaws often prompts attackers to attempt to exploit them.
Acronis warns of actively exploited flaw in its cPanel backup plugin
Acronis has issued a warning about a high-severity local privilege escalation vulnerability, identified as CVE-2026-87886, affecting its backup plugins for cPanel & WHM and Plesk. The company states that this flaw is being actively exploited in targeted attacks.
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle released its September 2026 Critical Security Patch Update (CSPU) on September 15, addressing 672 unique Common Vulnerabilities and Exposures (CVEs) through 673 security updates across 17 product families. This monthly release cycle, introduced in May 2026, aims to provide a faster cadence for high-severity issues compared to the quarterly Critical Patch Updates (CPUs).
U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Cisco Secure Email Gateway, identified as CVE-2026-76461, to its Known Exploited Vulnerabilities (KEV) catalog. This addition mandates that federal civilian executive branch (FCEB) agencies address the flaw by September 17, 2026, to protect their networks from active exploitation.
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
A malicious version of the Admin Menu Editor Pro plugin for WordPress was distributed to over 200 customers, affecting at least 1,500 websites, after an attacker compromised the maintainer's website and pushed updates containing a backdoor. The incident, which began on Monday, September 14, involved the distribution of trojanized versions of the premium plugin.
Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?
Microsoft has reportedly committed to implementing new, comprehensive privacy rules and guardrails for its artificial intelligence tools when used in educational settings. This agreement was reached following negotiations with the American Federation of Teachers, signaling a potentially significant shift in how AI technologies are managed within the academic sphere.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Cybersecurity researchers have reported on a new banking malware operation, dubbed KREMLIN, which targets users of Google Chrome and Microsoft Edge browsers to steal credentials and session tokens. The operation, tracked by Elastic Security Labs as REF9334, has been active since at least May 2025 and primarily targets Brazilian banking customers through sophisticated social engineering lures.
Iranian spies hit Windows machines with Chosen Brick data-stealing malware
Three Western governments have issued a joint warning regarding Iranian state-sponsored cyber actors deploying surveillance and data-stealing malware, dubbed "Chosen Brick," on Windows machines. The campaign, active since at least 2025, targets individuals perceived as threats to the Iranian regime, including dissidents, activists, and journalists.
Before You Patch. Why Patch Reliability Matters for Confident Deployment
Microsoft's September 2026 security updates, specifically KB5124008 and KB5124012, have been confirmed by Microsoft to cause issues with USB audio devices on some Windows systems. The problems, which surfaced after the September 8, 2026, updates were installed, primarily affect USB Audio Class 1.0 devices, causing them to fail to start or produce audio.
Hackers target WordPress sites via third-party WooCommerce plugin
Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, enabling them to upload PHP backdoors to compromised sites. The flaw, identified as CVE-2026-27540, affects plugin versions 2.0.3.1 and older.
Most Firms Unable to Recover Quickly from Ransomware
A new report from incident response firm Fenix24 indicates that very few organizations are able to recover quickly from ransomware attacks, with only a tiny fraction achieving even partial operational capacity within their target recovery windows. The firm's first "State of Recoverability" report, released on September 15, analyzed over 500 ransomware recovery engagements and found that none…
Electric and gas utility CenterPoint Energy warns of data breach after dark web post
CenterPoint Energy, a major electric and gas utility, has confirmed a data breach after discovering a dark web post claiming to offer stolen customer data. The Houston-based company filed an 8-K form with the Securities Exchange Commission (SEC) on Monday evening, September 14, 2026, acknowledging that an investigation into the claims revealed unauthorized access to one of its external-facing…
Suspected Black Axe gang leaders face cybercrime charges in the US
Five individuals, identified as alleged leaders of the Black Axe cybercrime syndicate, have been extradited to the United States to face charges of wire fraud and money laundering. The defendants, Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru, are accused of orchestrating an internet fraud campaign from Cape Town, South Africa, between 2011 and 2021.
Meta AI builds detailed profiles of children from years of family posts
Meta AI, the company's artificial intelligence assistant, has been observed creating detailed profiles of children by aggregating information from years of family posts on Facebook and Instagram. The issue came to light in early September when a mother, Kalie Robins, posted a video of her young daughter on Facebook. Meta AI then prompted her with the question, "Who is the child passenger?"
Former AT&T store worker jailed after moonlighting as a SIM-swap gang’s inside man
A former AT&T retail store employee, Kenneth Carter, has been sentenced to 16 months in federal prison for his role in a SIM-swapping scheme that aimed to steal over half a million dollars from victims. Carter, 44, of Portland, Oregon, admitted to using his insider access at AT&T to facilitate the fraudulent activities.
Most chief audit executives can’t tell you what AI is worth yet
A recent survey indicates that while artificial intelligence (AI) tools are widely adopted within audit departments, most chief audit executives (CAEs) are not yet measuring the value derived from these technologies. The survey, conducted in May, polled 142 CAEs and found that 54% have not begun to quantify the benefits of AI in their audit functions.
Supreme Court denies Trump request to allow USPS mail ballot changes
The Supreme Court has rejected a request from the Trump administration to implement changes to how the U.S. Postal Service (USPS) handles mail-in ballots for the upcoming 2026 midterm elections. The 7-2 decision, handed down on Monday, upheld lower court rulings that had blocked the executive order.