Tag: attack
-
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks/
-
Hackers chain Plex flaws in Plex2Shell attacks to breach servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index…
-
Critical PHP Patches Address ‘Very, Very Bad Vulnerability’
Immediate Updating Advised as Experts Warn Large-Scale Attacks Likely Imminent. Security experts are warning all organizations to immediately apply new fixes for two critical PHP2Shell vulnerabilities in widely used PHP that can be remotely exploited by unauthenticated attackers to run arbitrary code, take full control of the underlying server and steal data. First seen on…
-
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
The group has been linked to a 2025 attack targeting technology firm Ingram Micro. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589/
-
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/new-phaas-uses-ai-phishing-lures/
-
ClickFix has never been bigger, and AI tools are its most convincing lure yet
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet/
-
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
Researchers at Symantec have uncovered an AI agent designed to operate a full cyber-attack without human intervention First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/symantec-ai-agent-llmjacking/
-
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the ‘finger’ utility to launch a CAPTCHA that installs malware, including the Lumma stealer. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks – and both are evolving their tactics in an attempt to outdo one another First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
-
Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws
Cloudflare has issued a warning about emerging attacks targeting two critical PHP vulnerabilities. In response, the company has implemented emergency web application firewall (WAF) rules while developers await an official security release. The PHP Foundation has provided advance notice, assigning both vulnerabilities a CVSS v4 score of 9.2, indicating the urgent need for affected environments…
-
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness is where the…
-
Critical Fortinet FortiSIEM RCE Vulnerability Gets Public PoC Exploit, Allowing Unauthenticated Attacks
Horizon3.ai has released a public proof-of-concept exploit for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM. This vulnerability allows unauthenticated attackers to turn arbitrary file writes into remote code execution. Researcher Zach Hanley published a technical analysis on October 20, following Fortinet’s security advisory released on October 13. The vulnerability specifically affects the product’s gRPC communication…
-
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/children-data-stolen-password1/
-
CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems
Tags: advisory, attack, backup, cisa, cyber, data, encryption, infrastructure, ransomware, theft, usaCISA has warned that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data theft and encryption with deliberate attacks on backup systems to obstruct recovery. The October 20, 2026, joint advisory describes operations spanning North America, South America, Europe, and Australia since August 2024. Published with the FBI,…
-
NSA, NIST, CISA Issue Guidance on Rogue AI Agents
Federal Advisory Outlines Five Stages for Detecting and Containing AI Incidents. The NSA, NIST and CISA have issued voluntary guidance for detecting, containing and recovering from rogue AI agent incidents, urging frontier AI developers to strengthen monitoring, restrict access and treat dangerous near-misses as security events while leaving adversarial attacks outside its scope. First seen…
-
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said. First seen on cyberscoop.com Jump to article: cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
-
ConnectWise customers hit by supply-chain attack linked to compromised API secret
Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded. First seen on cyberscoop.com Jump to article: cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/
-
EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product’s support period, which manufacturers define. First seen on therecord.media Jump to article: therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack
-
AOMEI Backupper servers hijacked for minutes at a time to push backdoor
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/aomei-backupper-compromised-supply-chain/
-
Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/hackers-abuse-ai-pen-test-tool-cairn
-
Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/
-
Quarantined, but still on your calendar: The explosion of invite-based attacks
There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/malicious-calendar-invites/
-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a…
-
Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47…
-
Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an…
-
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man to the attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/qilin-ransomware-arrested-synnovis-patient-death
-
New RedAgents AI Platform Deploys Multiple Hacking Agents to Find and Exploit Vulnerabilities
RedAgents, a cloud platform that deploys multiple AI penetration testing agents against authorized targets to discover vulnerabilities and test attack paths. Announced on October 16, 2026, the service brings Artex Pro, Cyber(YanJi), Yanxun, and CyberStrikeAI Enterprise Edition into a single environment for security operations teams. The platform addresses a limitation of automated security assessments: different…
-
Microsoft Warns AI Agents Can Be Hijacked Through Prompt Injection Attacks
Microsoft has issued a warning about the risks posed by AI agents that access enterprise systems, especially when attackers manipulate them through methods like prompt injection, compromised inputs, or shifts in task context. To address this issue, the company is enhancing Project Perception with controls to identify agents, limit their authority, and manage unsafe behavior…