Tag: hacker
-
Not So Harmonious: EU States Hoard Cyber Incident Data
Cross-Border Cooperation Hasn’t Reached Cybersecurity Incidents, Auditors Find. When hackers triggered cascading disruptions to European air travel in fall 2025, none of the affected countries – including Germany, Belgium and Ireland – activated European Union-level coordination to cope with the incident. The go-it-alone approach is endemic. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/so-harmonious-eu-states-hoard-cyber-incident-data-a-32881
-
Foreign Hackers Target Two Colorado Water Utilities
Hackers targeted two Colorado water utilities, changing OT settings and disabling alarms, but causing no impact on water services or safety. Foreign hackers targeted the operational technology (OT) systems of two small private water utilities in Colorado in late August, apparently trying to disrupt operations. Local authorities haven’t identified the affected utilities or the attackers.…
-
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed ‘Click2Shell’ that affects the platform’s Core component. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/
-
SailPoint CEO Mark McClain: When AI Can Move ‘Thousands’ Of Times Faster Than Humans, Identity Security Is Key
While human hackers can only move so fast, the arrival of autonomous agents capable of attacking at unprecedented speeds should result in a ‘completely different calculus’ for identity and security teams, SailPoint CEO Mark McClain says during the latest episode of CRN’s Security or Else! podcast. First seen on crn.com Jump to article: www.crn.com/news/security/2026/sailpoint-ceo-mark-mcclain-when-ai-can-move-thousands-of-times-faster-than-humans-identity-security-is-key
-
China-nexus actor steals thousands of documents in monthslong exploitation campaign
Researchers suspect the hacker employed LLMs to develop custom tools. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-nexus-steals-thousands-documents-exploitation/830902/
-
China-nexus actor steals thousands of documents in monthslong exploitation campaign
Researchers suspect the hacker employed LLMs to develop custom tools. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-nexus-steals-thousands-documents-exploitation/830902/
-
China-nexus actor steals thousands of documents in monthslong exploitation campaign
Researchers suspect the hacker employed LLMs to develop custom tools. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-nexus-steals-thousands-documents-exploitation/830902/
-
Belgian table tennis, gymnastics federations hit by cyberattacks
Belgium’s national table tennis federation is investigating a cyberattack after a hacker claimed to have stolen data on tens of thousands of members. First seen on therecord.media Jump to article: therecord.media/belgium-table-tennis-cyberattack
-
Belgian table tennis, gymnastics federations hit by cyberattacks
Belgium’s national table tennis federation is investigating a cyberattack after a hacker claimed to have stolen data on tens of thousands of members. First seen on therecord.media Jump to article: therecord.media/belgium-table-tennis-cyberattack
-
Belgian table tennis, gymnastics federations hit by cyberattacks
Belgium’s national table tennis federation is investigating a cyberattack after a hacker claimed to have stolen data on tens of thousands of members. First seen on therecord.media Jump to article: therecord.media/belgium-table-tennis-cyberattack
-
A BYD Shark 6 Hack Shows the Risks of Connected Cars
A BYD Shark 6 was remotely hacked, exposing vehicle controls, location tracking and cabin audio, raising serious connected-car security concerns. A journalist drove a BYD Shark 6 down a country road outside Canberra while a hacker sitting on the shoulder killed the headlights with a keystroke. That’s not a hypothetical. It’s what happened during a…
-
Kritik von SPD-Digitalexperten – Hacker erbeutet Daten von Studierenden der Münchner LMU
Tags: hackerFirst seen on security-insider.de Jump to article: www.security-insider.de/lmu-muenchen-hackerangriff-studierendendaten-a-f7c301b1a01ea89f94c6aef16d1b944c/
-
Hackers exploit Gyazo server flaw to steal 23.6 million user records
Japanese software company Helpfeel has confirmed a data breach on its screenshot-sharing platform Gyazo, in which attackers exploited a vulnerability in its image upload … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/21/helpfeel-gyazo-data-breach/
-
Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords
Threat actors are increasingly abusing Microsoft Teams’ external chat capabilities to impersonate corporate IT help desks. They trick employees into installing malware, granting remote access, and stealing Windows credentials. These attacks exploit a simple vulnerability: employees tend to distrust suspicious emails but often do not apply the same caution to collaboration platforms like Teams. Attackers…
-
New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments. Research by YesWeHack researcher Alex Brumen highlights flaws that occur when web caches create cache keys by directly…
-
New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments. Research by YesWeHack researcher Alex Brumen highlights flaws that occur when web caches create cache keys by directly…
-
New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments. Research by YesWeHack researcher Alex Brumen highlights flaws that occur when web caches create cache keys by directly…
-
New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments. Research by YesWeHack researcher Alex Brumen highlights flaws that occur when web caches create cache keys by directly…
-
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors. SentinelOne identified an Indian IT services provider compromised with the same FLATROOF and ROOFDECK implants previously linked to the April 2026 KelpDAO-LayerZero attack. The campaign…
-
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
Threat actors linked to the TanStack npm supply chain compromise allegedly used a stolen GitHub OAuth token to clone about 170 private CrowdSec repositories, exposing source code, limited contact information, and a restricted AWS notification credential. CrowdSec stated that the compromise originated from a former employee’s account, which remained in the company’s GitHub organization for…
-
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
Threat actors linked to the TanStack npm supply chain compromise allegedly used a stolen GitHub OAuth token to clone about 170 private CrowdSec repositories, exposing source code, limited contact information, and a restricted AWS notification credential. CrowdSec stated that the compromise originated from a former employee’s account, which remained in the company’s GitHub organization for…
-
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
Threat actors linked to the TanStack npm supply chain compromise allegedly used a stolen GitHub OAuth token to clone about 170 private CrowdSec repositories, exposing source code, limited contact information, and a restricted AWS notification credential. CrowdSec stated that the compromise originated from a former employee’s account, which remained in the company’s GitHub organization for…
-
Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers
Threat actors rapidly exploited a critical authentication bypass in cPanel and WHM to compromise internet-facing hosting servers, with Japanese telemetry data linking the campaign to a sharp rise in Mirai-like scanning and attack traffic targeting Telnet services. The activity centers on CVE-2026-41940, a critical vulnerability in cPanel and WHM’s session-management layer that enables a remote,…
-
Click2Shell WordPress Flaw Lets Hackers Execute PHP Code and Take Over Websites
A recently disclosed WordPress vulnerability, known as Click2Shell, could let attackers execute remote PHP code on vulnerable sites after convincing a logged-in administrator to click a specially crafted link. WordPress version 7.1.1, released on September 17, 2026, addresses this issue. Researchers at PWNAI reported that the flaw exploits WordPress’s theme-preview workflow to install a theme…
-
RNLI warns supporters their personal information may have been hacked
Data raid comes amid targeting of lifeboat charity by far-right agitators who object to migrant boat rescuesSupporters of the Royal National Lifeboat Institution (<a href=”https://www.theguardian.com/uk-news/rnli”>RNLI) have been warned that their personal information could have been stolen by hackers amid targeting of the charity by far-right agitators.In a letter accompanying the autumn copy of its Lifeboat…
-
Security Affairs newsletter Round 595 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Google Gemini also Broke Out of Its Test Environment AI Helps Hackers Hijack OpenAI Staff Accounts Through…
-
Hackers Are Using Passkey Updates as a New Microsoft Phishing Hook
Microsoft warns attackers are using passkey and MFA update requests to phish employees, hijack sessions, and access Microsoft 365 data. The post Hackers Are Using Passkey Updates as a New Microsoft Phishing Hook appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-passkey-phishing-mfa-device-code/
-
Hackers Crack Flock Camera, Expose 1.6M Images in 21 Days
Hackers physically compromised a Flock camera and found an encryption key, 27,000 clips, and 1.6 million images generated in 21 days. The post Hackers Crack Flock Camera, Expose 1.6M Images in 21 Days appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-flock-camera-hack-1-6m-images/
-
North Korean WaterPlum hackers infected 30,000 devices worldwide
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
-
AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum
AI helped researchers exploit a Discourse flaw in under 72 hours, hijacking OpenAI staff accounts and exposing the risks of shared SSO. Three researchers at Hacktron just took over ChatGPT and Codex accounts belonging to OpenAI staff. The attack did not rely on phishing techniques or a leaked password. Through an image upload on OpenAI’s…