The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
96 stories match. Clear filters
-
New RatHat Android malware uses an AI subsystem to automate device control
RatHat is a newly discovered Android remote access trojan with an AI-powered subsystem that helps operators navigate a compromised device remotely rather than requiring manual step-by-step control. The design point is scale, since AI-assisted navigation lets one operator work many infected devices.
-
Kaspersky tracks three separate clusters attacking Russian enterprises with backdoors, ransomware, and wipers
Kaspersky reports NightEagle (also APT-Q-95, active since at least 2023), Hacking Cat, and Toy Ghouls targeting Russian enterprises. NightEagle mostly used compromised valid credentials to reach corporate VPNs, with connections originating from Russian IP space tied to Cloudflare WARP tunnels and…
-
Dispel opens a free remote-access program for small US water and electric utilities
Dispel launched its Community Power and Water Program at the American Public Power Association Cybersecurity and Technology Summit, extending secure remote access tooling used by large utilities to small ones. Internet-exposed PLCs at small water and electric utilities remain one of the most…
-
Nozomi finds four memory-corruption flaws in the Siemens SCALANCE LPE9403 PROFINET stack
Nozomi Networks Labs used emulation-driven snapshot fuzzing with the Unicorn CPU emulator to find four memory-corruption vulnerabilities in the PROFINET Discovery and basic Configuration Protocol implementation on the Siemens SCALANCE LPE9403 industrial edge device. DCP is a Layer 2 protocol with…
-
Japan's Digital Agency says a VPN flaw exposed 246,000 personnel records
The agency says an attacker exploited a vulnerability in a VPN device serving the Government Solution Service and accessed roughly 246,000 record rows. About 189,000 concern staff and public officials at organizations using GSS, and 57,000 concern businesses and individuals involved in GSS…
-
Check Point patches two CVSS 9.8 VPN certificate flaws allowing unauthenticated remote code execution
Check Point disclosed two critical flaws in how its firewall and management products handle VPN certificates, both rated CVSS 9.8. CVE-2026-85102 is a failure to properly validate certificate trust during VPN negotiation, affecting Security Gateway and Check Point Spark Firewall configured for…
Also covered by BleepingComputer
-
CISA confirms ransomware gangs exploiting critical WatchGuard Firebox flaw, roughly 9,000 firewalls still unpatched after nine months
CISA updated its Known Exploited Vulnerabilities entry for CVE-2025-14733 to confirm that ransomware operators are now using it. The flaw is an out of bounds write in WatchGuard Fireware OS that allows unauthenticated remote code execution, and CISA rates the exploitation complexity as low…
-
Cisco confirms active exploitation of a CVSS 10.0 auth bypass in Secure Firewall Management Center, three attacker clusters including Sandworm and Qilin
Talos is tracking in the wild exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure FMC that lets an unauthenticated remote attacker execute scripts and obtain root on the underlying OS, chained in some intrusions with CVE-2026-20316, a static credential flaw scoring…
-
FortiGate flaw exploited to deploy PivotC2, an AI-assisted Node.js RAT built for firewall persistence
SOCRadar documented an ongoing campaign exploiting CVE-2025-25249, a heap-based buffer overflow in the FortiOS and FortiSwitchManager cwacd daemon listening on UDP 5246, the CAPWAP port. Unauthenticated exploitation yields remote code execution and an outbound Node.js reverse shell. The payload…
Also covered by CISA, SecurityWeek
-
Fileless Linux rootkit found inside compromised F5 BIG-IP APM appliances
SophosLabs published analysis of an implant ESET calls PoisonedRefresh, tracked by Sophos as Linux/Agnt-IC, found in F5 BIG-IP Access Policy Manager environments. The rootkit intercepts PHP file loading and builds a modified in-memory copy containing the original content plus an attacker web…
-
Citrix NetScaler auth-bypass flaw now under active exploitation (CVE-2026-19490)
Vulnerability intelligence firm Previdian confirmed attackers are targeting CVE-2026-19490, a critical NetScaler ADC/Gateway authentication bypass Citrix patched in mid-August, after a credible proof-of-concept went public. Previdian's sensors caught PoC-matching requests from three countries on…
-
CNIL fines Loire Private Hospital €500,000 over patient data breach
France's data protection authority fined Loire Private Hospital €500,000 after an attacker used an external physician account, lacking VPN or MFA, to access the electronic patient record system undetected over several days during summer 2025, exposing 524,867 patients and 202,246 associated…
-
F5 BIG-IP privilege escalation via TMUI
CVE-2026-66842 (CVSS 8.8) lets an authenticated user create administrative accounts through the BIG-IP Traffic Management User Interface, resulting in full system privilege escalation.
-
CISA adds five more actively exploited flaws to KEV catalog
Alongside the SonicWall pair, CISA added five more actively exploited CVEs: Sangoma Switchvox (SQL injection, CVE-2026-9586), Kludex Starlette (HTTP request/response smuggling, CVE-2026-48710), Kestra OSS (OS command injection, CVE-2026-49869), BerriAI LiteLLM (improper authentication…
Also covered by Security Affairs
-
SonicWall SMA1000 zero-days chained for unauthenticated remote code execution
SonicWall confirmed active exploitation of two previously undisclosed flaws in SMA1000 series appliances (models 6210, 7210, 8200v): CVE-2026-83548, a pre-auth SSRF in the Appliance Work Place interface (CVSS 10), and CVE-2026-83549, an OS command injection in the Appliance Management Console…
-
Internet-exposed OT and edge devices remain the top disruptive-risk focus
This digest synthesizes a UK NCSC advisory (Aug 27) on rising OT targeting and a Claroty Team82 analysis of 200+ cyber-physical attacks over 12 months, finding 82% involved VNC-based remote access to exposed assets and 66% involved compromised HMIs or SCADA systems. Recommendations: asset…
-
North Korean fraudulent worker scheme expands into healthcare and sales roles
DPRK-linked operators long associated with fraudulent IT employment are now placing workers in sales, marketing, and medical roles. The scheme relies on stolen or forged identity documents, VPNs, and proxy services to conceal location, with proceeds funding weapons programs. The activity is…
-
China-linked Fire Ant hijacks Cisco IOS XR routers and TACACS servers, then erases the evidence
Fire Ant, a China-nexus espionage actor previously known for VMware ESXi and vCenter targeting, has moved into Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Sygnia found purpose-built IOS XR implants: one embeds a modified system library that forwards a log…
-
China-made ZBT routers ship with two factory implants giving unauthenticated root
VulnCheck disclosed SPEAKINGSTONE and DARKLANTERN, two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics, tracked as CVE-2026-74232 and CVE-2026-74233, each rated 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1. SPEAKINGSTONE runs as the yunmgrd service…
-
Next.js patches two critical unauthenticated RCE flaws, one in AVIF handling and one Windows-only path traversal
Vercel published fixes for two critical vulnerabilities in Next.js that each allow unauthenticated remote code execution. CVE-2026-75604 (CVSS 9.0) is a path traversal that affects applications using both the Pages Router and App Router without Cache Components when the server runs on a Windows…
-
Citrix NetScaler flaw now exploited for pre-auth RCE, CISA gives agencies until August 29
Citrix patched CVE-2026-8452 on June 30 and described it as a high-severity memory overflow leading to denial of service, but WatchTowr published analysis and proof-of-concept code on August 14 showing it can be driven to unauthenticated remote code execution. Previdian and Defused reported…
Also covered by The Hacker News
-
Unit 42 finds AI speeds malware development but does not improve success rates
Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached production endpoints. The finding is that generative tooling compresses the build phase without meaningfully raising the odds that the resulting malware works against defended environments.
-
OpenAI bans Russian accounts running an influence operation through a fake Israeli think tank
OpenAI removed a cluster of accounts that used VPNs to bypass access restrictions and generate social posts and comments distributed on Substack, Telegram, X, Facebook, and LinkedIn. The operation promoted the International Burke Institute, a self-described expert community based in Israel, and…
-
E4del and PINHOLE RATs pull commands out of FTP server banners
Two previously unreported remote access trojans are using FTP welcome banners as dead drop resolvers, reading command-and-control instructions from the text string an FTP server returns on connection. SOCRadar says this is the first time the technique has been seen in the wild, though…
-
Unpatched Calix router flaw lets anyone on the internet punch a permanent hole through the firewall
CVE-2026-75501 affects Calix GS7 XGS (GS5239XG) residential gateways running EXOS/6.6.47, sold through US broadband providers including Cox, Brightspeed, ALLO, CityFibre, and Conexon. The device binds its MiniUPnPd WANIPConnection SOAP service to the public WAN interface on TCP 5000 with no access…