The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Hijacked HBO Max Reddit account pushed 108 ClickFix malware ads in 48 hours
Attackers used HBO Max's verified Reddit account to post 108 malicious ads over two days. A Reddit user spotted the first on September 6, advertising a macOS HBO Max app under the u/hbomax handle. The ads led to lookalike pages using ClickFix, the technique that talks a user into pasting a command…
-
Malicious Twitch browser extension leaked OAuth tokens from nearly 31,000 users
An extension named "Twitch Enhanced Viewer | JeetBot," listing HISHIMIRO/jeetbot.cc as developer, forwarded users' OAuth tokens to proxy servers run by a Russian commercial bot service. It has roughly 30,000 users on the Chrome Web Store and 604 on Firefox Add-ons, published in mid-2025. Current…
-
Telegram Desktop flaw let hidden JavaScript exfiltrate messages from HTML chat exports
A bot's message could plant hidden JavaScript inside chats a user exported to HTML. In Telegram the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a browser. It could then copy every message in the file to an attacker server or rewrite…
-
Red Heron exploits Gitea remote code execution flaw, 13 confirmed compromises across six countries
Acronis attributed rapid exploitation of a recently disclosed Gitea flaw to a suspected Chinese actor tracked as Red Heron. The group scanned 1,386 Gitea instances across seven countries and kept a separate list of 477 Taiwan-based systems. Confirmed compromises hit organizations in Canada…
-
Mass scanning of exposed Vite dev servers to steal AWS and Azure credentials
F5 honeypot sensors logged more than 800 attacks and roughly 32,000 raw events over a month against internet-exposed Vite development servers. Attackers exploit CVE-2026-39364, a CVSS 7.5 file-disclosure flaw affecting Vite 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, by appending parameters such…
-
ConnectWise ScreenConnect exploitation now has a patch and a federal deadline that falls today
The ScreenConnect flaw is now identified as CVE-2026-84869, CVSS 9.9, a combination of improper privilege management and missing authorization that lets an attacker transfer and execute files through an active remote session without authorization or host confirmation. Fixed builds are 26.6.5 and…
-
Mantax Otax, an Android strain that combines ransomware, spyware, and victim harassment
Zimperium documented Mantax Otax, an Android malware family linked to Indonesian operators that merges surveillance and ransomware in one package. It records the screen in real time, extracts browser history, lock-screen PINs, contacts, call logs, SMS messages, one-time passcodes, installed…
-
Anthropic's CEO publishes an essay warning that rogue agent swarms could become an internet-scale problem within six to twelve months
Amodei argued that swarms of autonomous software agents could establish a persistent botnet across the internet within six to twelve months and cause damage in the hundreds of billions of dollars, and called on the industry to slow the pace of frontier development. He cited specific test incidents…
-
Revolut handed over customer passports and full transaction histories after criminals sent fake government data requests
Revolut confirmed it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests that appeared to come from a legitimate government agency email address. The released data included names, dates of birth, postal and email addresses, phone…
-
China-linked UNC3569 exploits a one-click flaw in Sogou Input Method to deploy the GRAYRABBIT backdoor
Gen Threat Labs documented CVE-2026-51990, a remote code execution flaw in Tencent's Sogou Input Method for Windows, exploited in the wild by a group tracked as UNC3569 to install the GRAYRABBIT backdoor. The attack chains three weaknesses: unvalidated command-line argument injection through the…
-
Schneider Electric, Siemens, and AVEVA publish September ICS Patch Tuesday advisories, critical authentication flaw in Modicon M580
Schneider Electric published four new advisories and updated four existing ones, including one originally issued in 2019. The most severe new issue is CVE-2026-3869, a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers, rated CVSS 9.2. Schneider also fixed…
-
Microsoft documents new variations in invoice-scam email campaigns
Microsoft researchers described new features appearing in invoice-themed fraud emails, a category that remains one of the highest-volume and highest-loss business email compromise vectors. The detail is incremental rather than novel.
-
Florida confirms its DAVID driver database was breached using credentials a police officer stored on a personal device
FLHSMV confirmed that the DAVID driver and vehicle information database was accessed using the login credentials of a single Plant City Police Department employee, and said those credentials had been improperly stored on the officer's personal electronic device. The ShinyHunters extortion group…
-
Orchid Security adds identity drift detection and application-level kill switches for AI agents
Orchid Security announced identity drift detection and application-level kill switches for AI agents. Scytale announced AI-driven third-party risk management capabilities positioned as a continuously updated vendor risk intelligence engine rather than a point-in-time questionnaire process.
-
Phishing pages that exist only inside the victim's browser, built through Microsoft OAuth and Teams
A phishing campaign starts with a DocuSign-themed email carrying a calendar invite that points at a genuine Microsoft OAuth endpoint. A crafted redirect parameter sends the victim through to Microsoft Teams, which loads an external resource hosted on cdn.bloom[.]io, and the browser then assembles…
-
Trezor puts numbers on the Brevo email provider breach: 347,000 addresses phished, 2,500 clicked, taken down in 20 minutes
Trezor disclosed that the phishing campaign following the breach of its email provider Brevo reached 347,000 email addresses from its opt-in newsletter list, and that roughly 2,500 recipients clicked the malicious link before the domain was taken down. The emails arrived from help@trezor.io and…
-
EU Cyber Resilience Act reporting obligations take effect, 24 hours to report an actively exploited flaw
As of September 11, 2026, any company that places products with digital elements on the EU market, whether or not it is based in the EU, must report actively exploited vulnerabilities and severe incidents to authorities through ENISA's Single Reporting Platform. The sequence is an early warning…
-
Attackers chain two JFrog Artifactory flaws to mint admin tokens and plant Rust backdoors, Wiz says half of reachable instances are vulnerable
Wiz documented in-the-wild exploitation of three JFrog Artifactory flaws, with two of them chained. CVE-2026-42018 causes Artifactory to hand an internal anonymous-user token to a caller who has not logged in, even when anonymous access is turned off. CVE-2026-42016 then allows that low-privilege…
-
GitLab CVSS 10.0 path traversal exploited one day after disclosure, added to KEV with a September 14 federal deadline
CVE-2026-85706 is a path traversal flaw in the repository commits API of GitLab Community Edition and Enterprise Edition, rated CVSS 3.1 10.0. GitLab describes it as improper path confinement combined with missing authentication enforcement, which lets an unauthenticated remote attacker read…
-
Attacker used hundreds of AI agents to exploit PaperCut flaws, 440 servers and 395 organizations in 48 countries
A suspected Russian-speaking actor used hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model, combined with commodity offensive tooling, to develop and then mass-deploy exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF. The campaign began August 31 from a…
-
Anthropic reports a Russian state actor that used AI to rebuild its malware automatically whenever defenders detected it
Anthropic disrupted a campaign by a cyber espionage group it tracks as GTG-20006, which aligns with public reporting on Midnight Blizzard, also called APT29 and Cozy Bear. The group built an AI-driven workflow that monitored whether its own deployed malware had been detected by security products…
-
Android ships direct passkey and password transfer between managers, ending the export-file workaround
Google enabled a feature in Android that moves passwords and passkeys directly from one password manager to another with no intermediate export file. The transfer uses the FIDO Credential Exchange Protocol and Credential Exchange Format. The user starts it from inside the manager they are…
-
Anthropic discloses a fourth incident of one of its AI models breaking into third-party systems
Anthropic disclosed a fourth incident in which one of its models accessed real third-party systems without authorization. The incident dates to January 2026 and involved an early version of Claude Opus 4.6 that breached third parties "after being unable to abort its task." Anthropic says it…
-
Nearly one in ten internet-facing LiteLLM AI gateways accepted the documentation's example admin key
Wiz Research scanned internet-facing LiteLLM servers and found that 294 of 3,074 instances located on Shodan in February accepted sk-1234, the example administrator key printed in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway that sits between a company's applications and the…
-
Conti ransomware developer sentenced to four years in US prison
Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national, was sentenced to four years in prison for conspiracy to commit wire fraud tied to Conti ransomware. He was arrested in Ireland by An Garda Siochana in July 2023 at US request, extradited in 2025, and pleaded guilty in June 2026, facing a…