Tag: hacker
-
Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot
Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Researchers attribute the operation to APT41 with medium confidence. BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022. ESET confirmed its capabilities in March 2023, demonstrating exploitation of Baton Drop, tracked…
-
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled. ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant. Citrix disclosed the vulnerability on September 27, 2026,…
-
Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities. Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200…
-
China-Aligned Hackers Used Agentic AI to Target ConnectWise
Tags: access, ai, attack, china, cloud, credentials, framework, hacker, microsoft, open-source, supply-chainMicrosoft Ties Storm-0940 to Automated Intrusions Across Hundreds of Targets. Microsoft linked the ConnectWise supply chain compromise to China-aligned Storm-0940, which used the open-source Artex agentic AI framework to automate credential attacks, abuse trusted cloud applications and attempt access to more than 2,250 customer tenants at machine speed. First seen on govinfosecurity.com Jump to article:…
-
Capcom confirms data breach affecting 11.7 million accounts
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/
-
Breach Roundup: Russian Hackers Hit Ukrainian Grain Firm
Also: eMudhra Exits TLS Cert Biz, German Police Probe 2024 Synnovis Cyberattack. Russian hackers wiped a Ukrainian grain logistics firm, eMudhra killed its TLS certs biz, Germany investigated the 2024 Synnovis hack, OpenCode flaw, another Nikkei breach. A Revolut outage, a California Medicaid biller breach and a Nigerian man got eight years in a U.S.…
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/
-
The race to fix huge PHP code flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
The race to fix huge PHP flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Pretty Huge Problem with the internet The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
China State-Aligned Group Storm-0940 Used Agentic AI At Rate Of 2,900 Sign-In Attempts Per Minute In ConnectWise Breach
Here’s a look at how agentic AI was used by a China state-aligned hacker organization to successfully breach MSP platform maker ConnectWise. First seen on crn.com Jump to article: www.crn.com/news/security/2026/china-state-aligned-group-storm-0940-used-agentic-ai-at-rate-of-2-900-sign-in-attempts-per-minute-in-connectwise-breach
-
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said. First seen on therecord.media Jump to article: therecord.media/china-cyber-connectwise-ai
-
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise’s breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/
-
What is PHP and how serious is the computer language flaw causing website shutdowns?
Tags: attack, computer, cyber, data, exploit, flaw, government, hacker, open-source, programming, vulnerabilityAn estimated 70% of websites use the open-source language. What is the identified vulnerability in it?Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem.The <a href=”https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world”>newly discovered vulnerabilities in PHP, a programming language that…
-
Pretty Huge Problem with the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
China-nexus actor linked to attack on ConnectWise Cloud Backup
Researchers said the hackers employed a powerful AI tool to accelerate and scale the attacks against hundreds of Microsoft 365 users. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-nexus-actor-attack-connectwise-cloud-backup/833727/
-
Agentic AI helps hackers level up, even without detailed instructions
Low-skilled hackers are likely to become a lot more dangerous over the next 12 months, CrowdStrike warned. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/agentic-ai-cyberattacks-harnesses-crowdstrike/833714/
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/
-
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/
-
K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign
A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data. The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts. Researchers identified potential connections to the FortiBleed…
-
Hackers Used AI-Generated Scripts to Break Into Government Linux Servers and Hunt for Secrets
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and official mailboxes in a campaign tracked as CL-UNK-1211. The investigation, published October 15, linked the operation to government entities and state-affiliated infrastructure. Attribution remains unresolved: under Unit 42’s attribution framework, the UNK designation means researchers have not established…
-
Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions
Hirudo, an Android banking remote-access trojan (RAT) that can steal credentials and remotely control an infected phone. Its most unusual feature is the ability to replace selected genuine banking apps with modified copies designed to interfere with security checks from inside the app itself. Hirudo uses a two-app setup. Victims first install a convincing shopping…
-
Russian hackers teamed up to wipe data at Ukrainian grain firm
The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday. First seen on therecord.media Jump to article: therecord.media/ukraine-hackers-russia-grain-sandworm
-
Hackers Exploit Siemens Software Center Vulnerability to Execute Malicious Code
Siemens has confirmed that the CVE-2026-110936 vulnerability, a DLL side-loading flaw in Siemens Software Center, is being actively exploited. Attackers are using this vulnerability to execute malicious code through a legitimate, digitally signed application. Siemens published advisory SSA-580366 on October 15 and has addressed the issue in version 4.0.9.8. According to the campaign report, attackers…
-
North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign
Tags: communications, cryptography, cyber, cyberespionage, encryption, finance, group, hacker, infection, korea, lazarus, malicious, malware, north-korea, phishing, software, spear-phishingNorth Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain. Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory. The campaign followed Operation SyncHole, a Lazarus operation…
-
Hackers Combine Claude Code, Codex, Grok, and DeepSeek to Automate Attacks Worldwide
A Chinese-speaking threat operator combined ARTEX, Claude Code, Codex, and configurations requesting DeepSeek, GLM, and Grok models to coordinate attacks against organizations worldwide. The investigation expands earlier reporting on South Korean financial institutions, exposing a workflow built around shared instructions, persistent project records, and automated handoffs between AI sessions. Recovered prompts, dated August 4 through…
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up scanning…
-
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet. First seen on wired.com Jump to article: www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
-
Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/