Tag: threat
-
US Lawmakers Eye Stronger Healthcare Cyber Defenses
House Subcommittee Hearing Highlights Threats to Rural Hospitals and Patient Care. As U.S. hospitals, clinics and other medical providers continue to face an onslaught of hacking incidents and disruptive cyberattacks this year, the House Energy and Commerce Committee’s health subcommittee examined on Tuesday two proposed bills aimed at strengthening health sector cybersecurity. First seen on…
-
CVE Authorities Make Score 8 Look More Like the New 10
Exploit Maturity Can Lower Scores Until Attack Evidence or PoCs Emerge. CVSS 4.0 lets threat intelligence alter a vulnerability’s enriched score without changing its Base severity, prompting experts to warn that vendors and defenders must continuously reassess exploitation, exposure and patch priority. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cve-authorities-make-score-8-look-more-like-new-10-a-32829
-
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer’s website and pushed updates that created a hidden user account. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/
-
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer’s website and pushed updates that created a hidden user account. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/
-
Crypto Industry Figures Blackmailed by Revolut’s Hacker
Payments Platform Socially Engineered With Hacked Government Agency Email Account. Personally identifiable information for multiple cryptocurrency industry figures was targeted and stolen by the threat actor who hacked payments platform Revolut, prompting warnings for these customers’ personal safety, with some receiving direct extortion threats. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/crypto-industry-figures-blackmailed-by-revoluts-hacker-a-32824
-
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Tags: banking, browser, chrome, credentials, cybersecurity, finance, google, malicious, malware, threatCybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN.Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google…
-
Daily OT Security News: September 15, 2026
The threat landscape for operational technology (OT) and industrial control systems (ICS) remains critical as organizations face increasing vulnerabilities and targeted attacks. Recent reports highlight significant breaches, regulatory updates, and emerging threats that require immediate attention from security teams. Key… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/daily-ot-security-news-september-15-2026/
-
Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’
According to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists.” First seen on therecord.media Jump to article: therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure
-
Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’
According to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists.” First seen on therecord.media Jump to article: therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure
-
Most Fraudulent Hires Receive Credentials Before Detection
A new report highlights the vast growth in fraudulent candidates, presenting significant insider threat challenges to organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fraudulent-hires-credentials/
-
Most Fraudulent Hires Receive Credentials Before Detection
A new report highlights the vast growth in fraudulent candidates, presenting significant insider threat challenges to organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fraudulent-hires-credentials/
-
Most Fraudulent Hires Receive Credentials Before Detection
A new report highlights the vast growth in fraudulent candidates, presenting significant insider threat challenges to organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fraudulent-hires-credentials/
-
Kura Appoints Acumen Cyber to Deliver 24/7 Cyber Defence
Customer experience provider Kura has appointed Acumen Cyber to provide 24/7 security monitoring, threat detection and incident response across its operations in the UK and South Africa. Kura supports more than 50 brands across financial services, utilities, healthcare and the public sector, operating from Glasgow, Sunderland and Durban. The company handles millions of customer interactions…
-
Cloudflare DDoS Threat Report H1 2026 Attacken werden zur politischen Waffe
First seen on security-insider.de Jump to article: www.security-insider.de/ddos-report-cloudflare-2026-h1-a-baf8c7b00f61f2c157c4b526d6077af2/
-
Cloudflare DDoS Threat Report H1 2026 Attacken werden zur politischen Waffe
First seen on security-insider.de Jump to article: www.security-insider.de/ddos-report-cloudflare-2026-h1-a-baf8c7b00f61f2c157c4b526d6077af2/
-
China spy chief points at US AI models in cyber threat warning
China’s spy chief identified Anthropic’s Claude Mythos and OpenAI’s GPT-5.5-Cyber as signs of what he called a “disruptive upgrade” in cyber capabilities, increasing the speed and potential weaponization of vulnerability discovery and malware development. First seen on therecord.media Jump to article: therecord.media/china-spy-chief-warns-of-us-ai-models
-
Uncensored AI sold on hacking forum as alternative to ChatGPT and Claude jailbreaks
A new AI subscription service called Luciferus is being marketed on a hacking forum as an alternative to jailbreaking ChatGPT or Claude, Sophos found. The Counter Threat Unit … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/15/luciferus-uncensored-ai-service-hacking-forum/
-
eBook: Identity-First Threat Intelligence
Attackers increasingly bypass traditional defenses by logging in with credentials that have already been stolen, exposed, or sold on the Dark Web. As infostealer malware … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/15/enzoic-ebook-identity-first-threat-intelligence/
-
53 Prozent mehr Cyber-Angriffe auf deutsche Unternehmen im August
Der Monthly-Cyber-Threat-Report für August 2026 von Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies, zeigt einen Anstieg globaler Cyber-Angriffe um 22 Prozent. Auch Phishing-Mails und Ransomware-Angriffe nehmen weltweit deutlich zu. Im vergangenen Monat verzeichneten Unternehmen Analysen von Check Point Research zufolge weltweit durchschnittlich 2422 Cyber-Angriffe pro Woche. Dies entspricht einem Anstieg von…
-
Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors
Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites. The vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of…
-
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access.In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo…
-
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
Tags: access, china, credentials, cyber, exploit, hacker, linux, rce, remote-code-execution, threat, vulnerabilityA Chinese-speaking threat actor known as Red Heron has exploited a critical remote code execution (RCE) vulnerability in Gitea to steal private source code, harvest credentials, establish persistent access, and move laterally within victim infrastructures. Researchers from the Acronis Threat Research Unit (TRU) have linked this operation to a newly documented Linux implant called JITTERLY,…
-
One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, before Chrome’s patch shipped, deploying different backdoors each. Two China-linked threat actors used the same Chrome/Windows zero-day against NGOs starting September 1, 2026, Volexity’s new report lays out the whole chain in detail. On September 1, Volexity detected a spear-phishing campaign by UTA0560 targeting several…
-
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Tags: authentication, credentials, cve, cyber, exploit, flaw, hacker, rce, remote-code-execution, threat, vulnerabilityA threat actor exploited a critical pre-authentication remote code execution vulnerability in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in just eight seconds, according to the Sysdig Threat Research Team. This vulnerability, tracked as CVE-2026-39987, affects marimo versions up to 0.20.4 and…
-
Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/
-
Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/
-
Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/
-
Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting
Threat actors are moving from using artificial intelligence as a productivity aid to deploying autonomous agentic systems that can execute major portions of an intrusion with minimal human intervention. Google Threat Intelligence Group (GTIG) has documented a financially motivated actor that used a multi-agent framework to plan, build, and run a mass credential-harvesting operation in…
-
Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware
Threat actors are increasingly weaponizing Microsoft’s Volume Shadow Copy Service (VSS) for two distinct objectives: removing recovery options before ransomware deployment and extracting credential material from protected Windows files. The shift means VSS telemetry should no longer be treated as a simple backup or disk-maintenance event, but as behavior requiring process, identity, and endpoint context.…
-
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE.Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.”The First seen…