Stories tagged security.
The Record (Recorded Future)
The ShinyHunters cybercriminal organization on Tuesday replaced agency images on the FBIjobs.gov site with a photo of a Pokemon that has become the group’s defacto mascot.
LWN.net
The Radicle peer-to-peer code-collaboration project has disclosed two critical vulnerabilities in the network protocol used by Radicle nodes. The first flaw is that the network protocol used by Radicle "does not give the confidentiality it was expected to give", which allows anyone who can observe…
The Hacker News
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup…
ServeTheHome / The Next Platform / KitGuru / HotHardware
It would seem that Asus recently suffered a security breach through its online store. In an email sent out to registered Asus eshop customers, the company confirms that it recently became aware of "unauthorised access" to customer order information, but no financial information was touched. The…
Cybersecurity Dive
More than one-third of industrial firms consider cyber risk as the top obstacle to growth.
CNET
Malwarebytes reports that the scam, which appears as a website offer from Anthropic, is not as easy to detect as most.
BleepingComputer
A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into a path to…
LWN.net
A critical vulnerability has been discovered in WordPress's get_page_template() function for page-template resolution that could allow remote-code execution (RCE) by an unauthenticated attacker, in some limited circumstances. The project has provided an update for the most recent branch of…
The Hacker News
Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and…
Rapid7
Security teams already have long queues of potential application vulnerabilities. The useful question is what happens next: can they see how a weakness behaves in a running application, reproduce the attack, and give developers enough evidence to fix it? Dynamic application security testing (DAST)…
Cisco PSIRT
Update for September 16, 2026: The original 1.0 version of this advisory was specific to the Cisco Adaptive Security Virtual Appliance (ASAv) and Cisco Secure Firewall Threat Defense Virtual (FTDv) models. However, it was later found that this vulnerability affects all Cisco Secure Firewall…
ransomware.live
Urban Engineering is a company that specializes in providing engineering services. They focus o n delivering innovative solutions for various projects. Their intended clients include business es and organizations seeking professional engineering expertise. The company is headquartered i n…
The New Stack
With often hundreds of thousands of alerts a day, many tech organizations are buried in vulnerabilities and worn down by The post Vulnerability alert fatigue nearly swamped WHOOP. But its fix still keeps a human in charge. appeared first on The New Stack.
Africa: TechCabal / Techpoint Africa / TechCentral / WeeTracker / Ventureburn
Nosike Nwigene set out to become a doctor but was eventually kicked out of medical school. A career in communications followed, taking him from startup public relations to policy advocacy and the Nigeria Startup Bill. Now, he is building an advisory while deepening his work in technology policy and…
SiliconANGLE
Vulnerability remediation company Vicarius Inc. today launched an artificial intelligence engine that writes detection and remediation scripts for software flaws with no vendor patch available. ScriptAI is aimed at the gap between a public disclosure and a working fix. Mean time to exploit stood at…
Huntress
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
Wired
Meta says it issued a fix for the Muse zero-day vulnerability that would have let attackers do “whatever” they wanted on a victim’s Mac, highlighting the inherent dangers of AI helpers.
ransomware.live
Virginia A Lemon PLLC 267 Stratton Aly, Lewisburg, West Virginia, USA vlemonlaw.com Leaked data: 16.8 Gb, 42к files corporate documents, litigation materials, client personal data, financial documents and reporting, personal files of employees, and much more.
The Record (Recorded Future)
Latvian police arrested a 23-year-old man suspected of hacking at least two companies, stealing personal information and attempting to extort money from the victims.
BleepingComputer
Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
ransomware.live
HIT d.d. is a prominent entertainment and gaming provider based in Nova Gorica, Slovenia, offer ing a diverse range of services including hotels, casinos, wellness centers, and dining options . With over 40 years of experience, the company operates multiple resorts and entertainment ven ues across…
ransomware.live
Apex Litigation Support is a business that provides comprehensive litigation services to attorn eys and law firms. Our team of experienced professionals is committed to delivering accurate an d timely results that exceed our client's expectations. We will upload 77gb of corporate data soon…
SecurityWeek
Only 21% of industrial security leaders report a complete OT asset inventory, even as 88% call their programs mature. The post Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare appeared first on SecurityWeek.
CyberScoop
An AI compact built around capability, control, and continuity can ensure the country stays safe and secure while also leading the world in the technology. The post The president has called for AI leadership. Here’s the mission. appeared first on CyberScoop.
The Hacker News
A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change…
Huntress
The Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it.
The Hacker News
Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good. Point one at a realistic target and what comes back is a report the agent wrote about itself: confident prose, a list of findings, and no way to tell which of them happened. Someone with a…
The Hacker News
Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a "major step up from Opus 5," and "achieves the best scores of any model to…
Utility Dive / pv magazine / Energy-Storage.news
Energy-Storage.news speaks with Nathan Picarsic, co-founder of Horizon Advisory, at the 2026 US Battery Asset Management and Solar and Storage Finance Summits in Garden Grove, California.