The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
DOE funds three OT security vendors under the SENTRY energy cybersecurity program
The Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response named Frenos, Raptor Dynamix, and Bastazo as recipients under the Securing Energy Technology Resiliency program. Federal funding direction is a reasonable leading indicator of where energy-sector OT…
-
Zelensky appoints former police chief to lead Ukraine's cyber coordination center
Ukraine named Ihor Klymenko, formerly head of the national police, to lead its cyber coordination center. Ukraine's wartime cyber defense structure continues to consolidate under centralized coordination, and personnel choices signal whether the emphasis sits with law enforcement, military, or…
-
China's intelligence chief names US AI models as a cyber threat to Chinese infrastructure
Chen Yixin, head of China's Ministry of State Security, wrote in the Cyberspace Administration of China's journal that Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber represent a "disruptive upgrade" in cyber capability, accelerating vulnerability discovery and malware development. He stopped…
-
Manhattan DA takes down 12 AI deepfake pornography sites
The Manhattan District Attorney's office seized or shut down twelve sites generating non-consensual AI deepfake sexual imagery. This is local prosecutorial action against AI-abuse infrastructure rather than federal or regulatory enforcement, which is a notable venue for this category of case.
-
CenterPoint Energy confirms customer data theft after dark-web leak
The Texas electric and gas utility confirmed a breach exposing customer personal information after an attacker leaked data allegedly stolen from its systems. The attacker claims 7.5 million customer records. CenterPoint confirmed the breach only after the data appeared publicly, which is the…
-
Microsoft ships emergency out-of-band updates after September patches broke Remote Desktop Services
September's security updates destabilized Remote Desktop Services on Windows Server 2019, 2022, and 2025, causing RDP sign-in failures and unresponsive servers that in some cases needed a hard reset. Microsoft released out-of-band fixes including KB5129195 for Windows 11 24H2 and 25H2 and…
-
BambooToken malware uses MQTT as command and control across Windows and Linux
A previously undocumented malware framework called BambooToken, active since at least 2023, now uses the MQTT messaging protocol to control infected Windows and Linux hosts. MQTT is a legitimate lightweight publish-subscribe protocol built for IoT and telemetry, which means the traffic blends into…
-
Nozomi finds four memory-corruption flaws in the Siemens SCALANCE LPE9403 PROFINET stack
Nozomi Networks Labs used emulation-driven snapshot fuzzing with the Unicorn CPU emulator to find four memory-corruption vulnerabilities in the PROFINET Discovery and basic Configuration Protocol implementation on the Siemens SCALANCE LPE9403 industrial edge device. DCP is a Layer 2 protocol with…
-
Compromised maintainer site pushes backdoored Admin Menu Editor Pro to 1,500 WordPress installs
A threat actor compromised the maintainer's website and pushed malicious updates of Admin Menu Editor Pro to more than 200 customers, backdooring roughly 1,500 sites. The malicious versions created a hidden administrator account. This is a trusted-update-channel compromise, not an exploited…
-
Attackers exploit a critical WooCommerce Wholesale Lead Capture flaw to plant PHP backdoors
A critical vulnerability in the premium WooCommerce Wholesale Lead Capture plugin is being actively exploited to upload a PHP backdoor to WordPress sites. This is a paid third-party plugin, so automated update coverage is inconsistent and many site owners do not know it is installed.
-
CISA says ransomware gangs have joined attacks on a critical VMware vCenter flaw patched in July
CISA warned that ransomware operators are now exploiting a critical VMware vCenter remote code execution vulnerability that VMware patched in July 2026. The progression matters: initial exploitation by targeted actors, then broad adoption by ransomware crews once tooling spreads. vCenter…
-
Acronis warns of actively exploited privilege escalation in its cPanel and Plesk backup plugin
Acronis assigned CVE-2026-87886 (CVSS 7.8) to a Linux local privilege escalation flaw in its backup add-ons for cPanel, WHM, and Plesk, and says it has seen exploitation in limited, targeted attacks. Acronis told BleepingComputer the assessment rests on a single report from a potentially affected…
-
Google patches an actively exploited Android zero-day on Pixel devices
Google shipped the September 2026 Pixel security patches covering 110 vulnerabilities, including CVE-2026-58704, which Google says may be under limited, targeted exploitation. Targeted mobile exploitation usually means a small victim set and a specific adversary, not mass compromise. The patch is…
-
China-linked UTA0560 chains Chrome and Windows flaws against NGOs to deploy GRIMWEDGE
Volexity attributed a September 1 spear-phishing campaign against multiple non-governmental organizations to a Chinese threat cluster it tracks as UTA0560. The emails linked to a U.S. university website and abused a reflected cross-site scripting flaw there to redirect victims to attacker…
-
LiteSpeed Enterprise flaw lets one hosting account take root on a shared server
cPanel warned that a critical flaw in LiteSpeed Web Server Enterprise before version 6.3.7 lets a low-privilege hosting account gain root on a shared-hosting machine. On such servers many customers run on one box, so an attacker with a single account could reach or alter other customers' sites and…
-
Cisco Secure Email Gateway zero day under active exploitation, root command execution with no authentication
Cisco disclosed CVE-2026-76461, a CVSS 9.8 flaw in AsyncOS for Secure Email Gateway that lets an unauthenticated remote attacker execute arbitrary commands as root by sending a crafted email containing malicious SQL statements. Cisco says the flaw is in email parsing logic and affects both…
-
Microsoft publishes a draft Humanist AI Code of Conduct with explicit cyberattack boundaries
Microsoft AI released a draft code of conduct for its MAI models and opened a six-week public comment period running through late October. The document blocks models from producing working exploit code, attack tooling, targeting methodology, intrusion procedures, evasion techniques, and…
-
WordPress adds automated security review of every plugin update before distribution
WordPress will now run an automated security review on each plugin release before it goes out through the WordPress.org update API. Plugin Repository Team co-lead David Perez noted that new plugins are reviewed on entry but updates ship continuously afterward, leaving no consistent review step…
-
Debian 13.7 ships 92 security advisories and updates 106 packages
Debian published the 13.7 point release carrying fixes behind 92 security advisories across 106 updated packages. Point releases roll up previously issued security updates and stability fixes rather than introducing new functionality, so systems already tracking security updates are largely current.
-
Japan's Digital Agency says a VPN flaw exposed 246,000 personnel records
The agency says an attacker exploited a vulnerability in a VPN device serving the Government Solution Service and accessed roughly 246,000 record rows. About 189,000 concern staff and public officials at organizations using GSS, and 57,000 concern businesses and individuals involved in GSS…
-
Telus warns customers of account breaches spanning February 2025 through June 2026
Telus, one of Canada's largest telecom providers, notified customers that stolen credentials were used in a multi-month campaign to reach subscriber personal data and billing records. Exposed fields include names, account numbers, phone numbers, billing addresses, email addresses, partial payment…
-
Attacker held root inside Thai broadband provider 3BB using MeshCentral as a backdoor
Hunt.io found the intrusion by examining an attacker-operated server left exposed on the internet, captured June 3, 2026, while the operation was still running. The server held the attacker's tooling and a list of machines under their control. The tools had been run from a computer inside 3BB's…
-
Hijacked HBO Max Reddit account pushed 108 ClickFix malware ads in 48 hours
Attackers used HBO Max's verified Reddit account to post 108 malicious ads over two days. A Reddit user spotted the first on September 6, advertising a macOS HBO Max app under the u/hbomax handle. The ads led to lookalike pages using ClickFix, the technique that talks a user into pasting a command…
-
Malicious Twitch browser extension leaked OAuth tokens from nearly 31,000 users
An extension named "Twitch Enhanced Viewer | JeetBot," listing HISHIMIRO/jeetbot.cc as developer, forwarded users' OAuth tokens to proxy servers run by a Russian commercial bot service. It has roughly 30,000 users on the Chrome Web Store and 604 on Firefox Add-ons, published in mid-2025. Current…
-
Telegram Desktop flaw let hidden JavaScript exfiltrate messages from HTML chat exports
A bot's message could plant hidden JavaScript inside chats a user exported to HTML. In Telegram the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a browser. It could then copy every message in the file to an attacker server or rewrite…