News Archive
2287 stories · page 26 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
NIS2 compliance: Fixing IAM and access control before the 2026 audit
The NIS2 Directive is imposing new, legally binding cybersecurity obligations on organizations across the European Union, with member states now moving from transposition into enforcement. Compliance deadlines are approaching, with national implementation laws coming into force and mandatory self-registration periods closing. Non-compliance can lead to significant penalties, including fines up…
What your vendor says about PQC tells you if they are ready
Mobile network operators face a complex and urgent challenge in preparing for post-quantum cryptography (PQC), according to Dr. Yaakov Stein, VP CTO of Allot. While some traffic, like subscriber voice calls or web browsing, quickly loses sensitivity, critical data such as subscriber identity mappings, billing records, and call metadata can remain sensitive for years, necessitating PQC…
Healthcare cyberattacks hit pacemakers and millions of patient records
Two major healthcare companies, Boston Scientific and McKesson, have recently disclosed details regarding separate cyberattacks that have impacted their operations and patient data. Boston Scientific, a medical device manufacturer, reported an ongoing cyberattack affecting its IT systems, while pharmaceutical and medical supply giant McKesson confirmed an intrusion with data exfiltration, for…
McKesson copes with fallout from data theft extortion attack
McKesson, a major healthcare sector vendor, has confirmed a cyberattack that resulted in data theft and temporary service disruptions. The company disclosed on Friday, August 29, that attackers gained unauthorized access to some of its third-party applications and exfiltrated data belonging to a subset of customers in its oncology, multispecialty, and medical-surgical business units.
Anthropic Users Hit by Infostealer Attacks, Session Thefts
Reports indicate that users of Anthropic's Claude AI platform have been targeted in a series of infostealer attacks. The attacks reportedly involved a threat actor deploying various infostealing malware to compromise user systems, subsequently collecting session information, and then using this data to gain unauthorized access to the affected users' Claude accounts. The scope of the…
ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool
Cybersecurity researchers at Kaspersky have uncovered a new malware campaign utilizing a modified version of a legitimate Chinese desktop wallpaper application, QN Wallpaper, to deliver the ValleyRAT backdoor. The campaign, which has been detected over 100,000 times in 2026, leverages DLL sideloading to evade detection and establish persistent control over infected systems.
Fraudsters steal $6 million from Tectonic crypto platform after inflating token price
The decentralized lending platform Tectonic confirmed on Sunday, August 30, 2026, that it had been targeted in a security incident, resulting in the theft of at least $6 million. Attackers manipulated the price of Tectonic's native Tonic coin, inflating its value by over 100 times within a 20-minute window, then used the artificially high-priced tokens as collateral to borrow other assets.
OpenClaw 2.0 pours glitter on slow-burning security dumpster fire
The OpenClaw Foundation has released version 2.0 of its AI agent harness, an update described by community manager Hannes Rudolph as the most extensive in the platform's history. The new version, announced Sunday, focuses heavily on usability enhancements, including a simplified installation process and a redesigned browser interface, alongside some security features that have drawn criticism…
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
Since early 2025, Check Point Research has been tracking JSCeal, a sophisticated cryptocurrency-focused stealer that also performs credential theft, surveillance, and traffic interception. The malware is delivered as compiled V8 bytecode in `.jsc` files, protected by the `javascript-obfuscator` tool, which employs techniques such as RC4-protected strings, control-flow flattening, proxy…
Berlin confirms data theft after Rhysida ransomware attack claims
Berlin's city administration has confirmed that it is facing an extortion attempt following a cyberattack by the Rhysida ransomware group, which listed the city on its data leak site. The incident, discovered in mid-August, was publicly claimed by the attackers on August 28. Berlin Mayor Kai Wegner stated that the city will not pay the ransom. The State Criminal Police Office, the public…
McKesson Confirms Data Breach as Attacker Deadline Looms
McKesson has confirmed a data breach following claims by the ShinyHunters extortion group. The group asserts they have stolen 284 million records from the company's systems and has set a deadline for their demands. The confirmation from McKesson indicates an active incident response effort is underway regarding the reported data compromise.
FulcrumSec claims Manchester Airports hack, theft of 86 GB of data
The Manchester Airports Group (MAG), operator of Manchester, London Stansted, and East Midlands airports, recently confirmed a data breach affecting customer information. Extortion group FulcrumSec has claimed responsibility for the attack, asserting that it exfiltrated approximately 86 GB of data.
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
Anthropic has issued a warning to some users of its Claude AI service, indicating that their accounts have been compromised by infostealer malware. The company reports that these malicious programs have stolen active Claude login sessions from users' computers, enabling attackers to access accounts and consume their allocated usage.
Chrome Web Store extensions caught stealing crypto, browser data
Multiple extensions for Google Chrome and Microsoft Edge have been identified as delivering a sophisticated malware framework designed to steal cryptocurrency, sensitive user data, and browser history. The operation, uncovered by application security company Socket, appears to have been active since early 2024.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 112
A China-nexus threat actor has been observed using a Go-based backdoor, dubbed HOOKEDGE, to target diplomatic and defense organizations in Myanmar. The backdoor is delivered via VHD files as part of an operation named QUICKSILVER. This activity is consistent with the tactics of the Russian APT group BlueDelta, which has also been seen employing HOOKEDGE against similar targets.
Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch
PaperCut, a widely used print management software, has confirmed active exploitation of a pre-authentication remote code execution vulnerability in its servers, with nearly half of tracked installations remaining unpatched. The flaw, which affects schools, hospitals, and offices globally, was confirmed by PaperCut on August 27, following observations of real-world attacks.
Security Affairs newsletter Round 592 by Pierluigi Paganini – INTERNATIONAL EDITION
A cyberattack on UK airport operator Manchester Airports Group (MAG) has led to the exposure of data belonging to 8.7 million customers across three of its airports. The breach was confirmed by MAG, though specific details about the nature of the data compromised or the exact timeline of the attack were not immediately available.
Brits Want Private Messages to Remain Encrypted
A recent poll indicates that a significant majority of British adults believe they have a right to private online conversations and that their personal messages should not be accessible without a court order. The survey, commissioned by the Center for Democracy & Technology (CDT) and conducted by Public First in April, found that 93 percent of respondents affirmed their right to online…
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Attackers are actively exploiting a previously patched vulnerability in Citrix NetScaler ADC and Gateway, identified as CVE-2026-8452. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed this exploitation by adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
New Malware Uses Fake CAPTCHAs to Deploy Backdoor
A newly identified malware variant, dubbed TerminalFix by Microsoft, has been observed leveraging deceptive Cloudflare CAPTCHAs to trick users into executing malicious commands. This particular variant is notable for its method of operation, which involves manipulating users into running harmful instructions through Windows Terminal or PowerShell.
Anthropic is cutting Claude Code's current weekly limits by 17%
Anthropic has announced a permanent adjustment to the weekly usage limits for its Claude Code service, which will result in a 17% reduction compared to current temporary allowances. While the company frames the change as a 25% increase over previous standard limits, users currently benefiting from a temporary boost will experience a decrease in their available usage.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Recent reports indicate the disclosure of five critical security flaws affecting various WordPress plugins and themes. These vulnerabilities, identified in products such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, collectively present risks ranging from authentication bypass to full site takeover and remote code execution (RCE). The findings highlight persistent security…
Brave browser adds email aliases to help users evade tracking
Brave, the privacy-focused web browser, has introduced a new feature called Email Aliases in its latest version, 1.94, designed to enhance user privacy by providing disposable email addresses. This functionality allows users to generate unique, temporary email addresses when registering for online services, thereby concealing their actual email address from websites.
Hack One Robot, Reach the Next: Unitree G1 Security Flaws
A security researcher has uncovered a series of vulnerabilities in the Unitree G1 humanoid robot that could allow an attacker to gain remote root access and potentially compromise other robots within proximity. The researcher, Olivier Laflamme, spent approximately three months investigating the G1 and detailed two distinct vulnerabilities, identified as CVE-2026-76639 and CVE-2026-76640.