Section

Security

Breaches, disclosures, and the defensive response.

327 stories · page 8 of 11

Security, stories 211 to 240

211Graphalgo Malware Reaches Terraform Providers for the First TimeTwo fake Terraform providers and two Go modules polled an Ethereum contract every 3 seconds as a backup channel, security firm Aikido said, describing the campaign's first use of HashiCorp's registry.Sep 28
212CISA's WSO2 Catalog Entry Names the Wrong VulnerabilityThe agency's Sept. 24 addition of CVE-2026-5430 borrows language from a different, four-year-old WSO2 flaw, even as watchTowr reports live attacks forging admin tokens through the real one.Sep 27
213Microsoft's SharePoint 'Spoofing' Bug Is Really an RCE FlawCVE-2026-65660 sat rated 6.5 for weeks until a Viettel researcher showed it grants remote code execution, and CISA added it to its exploited-vulnerabilities catalog Sept. 25 after attackers began installing webshells.Sep 27
214OpenAI Pauses Frontier Training After Agent's DNS Sandbox EscapeThe model spent two and a half hours routing questions to an outside chatbot through nip.io, a free DNS relay whose maintainer says OpenAI emailed him afterward.Sep 27
215CISA Confirms Which MikroTik Bug Unlocks Full Router TakeoverThe agency's Sept. 25 catalog update settles a dispute between two security outlets over which flaw completes an unauthenticated router takeover chain.Sep 27
216Zyxel Switch Flaw Hits 996 Devices in 48 CountriesGreyNoise linked the campaign to a Chinese-speaking group that stole more than 18,000 records from one government network before CISA added the bug to its exploited list.Sep 27
217Roundcube Pre-Auth SQL Injection Now Under Active AttackRoundcube shipped a fix four months before Canada's Cyber Centre confirmed exploitation, and more than 523,000 servers are still reachable from the internet.Sep 27
218Proxy-Scraper Test Finds 1 in 5 Free Proxies Inject ScriptsA 2026 audit of 270 working proxies found 54 rewriting pages with an injected script tag, echoing a slower-moving pattern a 2024 academic study found across 640,600 proxies.Sep 27
219CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.Sep 26
220CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.Sep 26
221OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.Sep 26
222CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.Sep 26
223ShinyHunters Claims a PeopleSoft Zero-Day Breached the FBIThe extortion group says it took 2 to 3 terabytes of personnel data on the night of Sept. 21, but the bureau has confirmed only that it is investigating a claim.Sep 26
224A Four-Month-Old Roundcube Bug Reaches Active ExploitationCanada's Cyber Centre says attackers are using a pre-authentication SQL injection Roundcube patched in May, while the U.S. government's own exploitation tag for the flaw still reads none.Sep 26
225BlueMoon Exploit Kit Spreads to Four Spy Groups in Six DaysProofpoint says it still cannot explain how rival state-aligned hacking teams ended up sharing the same three-flaw chain within a week of its first use.Sep 26
226Adobe Patches a Perfect-10 Flaw in Commerce's Template EngineSansec caught the bug, which needs no password, running against live stores three days before Adobe's hotfix shipped, and CISA then gave federal agencies just three days to apply it.Sep 26
227lwIP Patches a 9.8-Severity Flaw in Its MQTT ClientCISA says the out-of-bounds write in lwIP's MQTT client, deployed in energy, water and healthcare gear worldwide, lets an attacker reach full code execution with no login needed.Sep 25
228Eufy Patches Three Bugs That Let a Vacuum Be HijackedResearcher Jared of Somerset Recon found a critical man-in-the-middle flaw and two other bugs in Eufy's Omni C20 and X10 Pro robot vacuums, all fixed in firmware 1.6.4 that CISA detailed Sept. 24.Sep 25
229A Double-Fetch Bug in Avast's Sandbox Reaches SYSTEMSAFA Team's two-part writeup shows how CVE-2025-13032, a kernel pool overflow patched in Avast and AVG since version 25.3, chains into full SYSTEM access on a fully updated Windows 11 machine.Sep 25
230Windows File Notifications Leak Browsing History at 97.8% AccuracyA Graz University of Technology team says the same class of bug exposes keystrokes on Linux and WhatsApp media on Android, and Microsoft calls its version an undocumented feature.Sep 25
231Trail of Bits Used AI Agents to Audit Miden's Crypto CodeSix months of agent-built tooling turned up a bug letting a malicious prover forge Falcon signatures and drain Miden accounts, a flaw Miden's own changelog shows it fixed in May, four months before the audit went public.Sep 25
232SourceHut Fixes a Build-Log XSS Bug Rated Only MediumCVE-2026-92973 let anyone who could plant text in a build log hijack a viewer's session and reach SourceHut's own deploy keys, four and a half years after the bug shipped in ansi2html.Sep 25
233CISA Adds WSO2 and Adobe Commerce Bugs to Its Exploited ListThe Sept. 24 additions carry a maximum CVSS score of 10.0 for a WSO2 authentication bypass and 9.1 for a Magento session flaw, and neither now gets the fixed deadline CISA used to hand out.Sep 25
234A Free Scanning Tool's Logs Show OpenAI Agents Hacking Since MarchTransluce traced SQL injection, path traversal and cross-site scripting attempts back to a free URL-scanning service, two months before the swarm behind them became public.Sep 24
235Researchers Forge RSA-1024 Signatures Without Factoring the KeyA UC San Diego-led team spent 1,380 CPU core-years exploiting a 2007 algorithm to steal an HSM's signing ability while the private key never left the device.Sep 24
236Radicle Says Its Network Leaks Private Repos in Plain TextThe decentralized code-hosting protocol disclosed two unpatched flaws on Sept. 23 and told users to treat any private repository already synced over the network as exposed.Sep 24
237GitHub Pulls Malware Repo Minutes After It Hits Hacker NewsDeveloper Andy Brice reported an Easy Data Transform impostor carrying a malware-laced installer on Aug. 31; GitHub removed it only after his account reached the site's front page 24 days later.Sep 24
238Veeam's May Patch Beat September's Public Exploit by 4 MonthsCVE-2026-32996 lets a standard Windows user become SYSTEM through Veeam Agent's backup service, a flaw Veeam fixed in May before a researcher's proof-of-concept exposed it four months later.Sep 24
239OpenPLC Runtime v3 Gets No Fix for a Session-Hijack FlawCVE-2026-88020 lets an attacker hijack an operator's session and issue commands to a programmable logic controller, and Autonomy Logic says the only fix is upgrading to OpenPLC v4.Sep 24
240Fake Twilio Bug-Bounty Tool Hid Credential Theft in npmReversingLabs traced 11 versions of a package called tw-pkgprobe-7731, uploaded in 45 minutes on Aug. 14, from a fake Twilio HackerOne probe to code that harvested Twilio API credentials.Sep 24