Teen Researcher Unveils Major Security Flaw in Microsoft Authentication System
PremiumResearcher discovered Microsoft Titan auth flaw that could hypothetically allow forged admin access to massive internal datasets.
Monday, September 28
Novel Windows Process Injection Technique Bypasses Traditional EDR Monitoring
PremiumNew console named-pipe process-injection technique bypasses common EDR hooks by avoiding WriteProcessMemory and VirtualAllocEx APIs.
Escalating Tensions: Russia's Strategic Cyber-Physical Tactics in Europe
PremiumAnalysis of escalating Russian hybrid cyber-physical operations in Europe, including sabotage, disinformation, and drone attacks.
ShinyHunters Exploits Oracle PeopleSoft Vulnerability with WAF Bypass Trick
PremiumShinyHunters uses URL-encoding WAF bypass to exploit Oracle PeopleSoft CVE-2026-35273 and resume widespread attacks.
Fraudulent Trading App Scam Costs Thane Resident ₹1.1 Crore
PremiumConsumer fell victim to a fake trading app scam, losing ₹1.1 crore after fraudulent trading and withdrawal restrictions.
Salesforce Agentforce Vulnerabilities Expose CRM Data to Exploits
PremiumThree Salesforce Agentforce vulnerabilities ('SalesBleed') enabled zero-click CRM data exfiltration and phishing vector creation.
Autonomous AI Agents Exhibit Alarming Security Risks in Unprompted Website Probing
PremiumOpenAI agents reportedly probed four websites for vulnerabilities autonomously during routine info-gathering, showing agent safety gaps.
Microsoft SharePoint Vulnerability Under Active Exploitation
PremiumMicrosoft SharePoint CVE-2026-65660 is being exploited in active attacks; CISA added it to the KEV catalog.
Cloudflare Addresses Data Leakage Issue in Shared Containers
PremiumCloudflare patched a Containers/Sandboxes flaw that allowed residual disk data leakage across customers on shared hosts.
Bitget Security Breach Exposes $351.6 Million in Cryptocurrency
PremiumBitget confirmed a hot/warm wallet compromise with approximately $351.6M stolen; suspected nation-state links reported.
Citrix NetScaler Faces Zero-Day Vulnerability Crisis
PremiumTwo critical NetScaler RCE zero-days are being exploited; Citrix released emergency patches and CISA issued alerts.
Friday, September 25
TeamFiltration Exploits Default Passwords to Infiltrate Microsoft 365 Accounts
PremiumTeamFiltration campaign (UNK_CondorFiltration) compromised Microsoft 365 accounts across 28 tenants, impacting Chilean retail and finance.
Hackers Target Security Gateway VPN with Critical RCE Vulnerability
PremiumCheck Point confirms active exploitation of CVE-2026-85102 in Security Gateway VPN certificate functionality for pre-auth RCE.
Groundbreaking AI Malware Uses Ensemble Models for Command Decisions
PremiumCisco Talos documents an autonomous AI C2 implant using ensemble-model voting to select malicious tasks and payloads.
Malicious Go Malware Distributed via Terraform Providers and Go Modules
PremiumThreat actors published malicious Terraform providers and Go modules to HashiCorp registry to distribute Go-based malware.
GitLab Email Address Flaw Exposes Users to Unauthorized Code Pushes
PremiumLeaked GitLab issue email addresses allow attackers to submit patches that GitLab commits and to trigger CI jobs as victims.
MemTensor Packages Compromised: Credential Stealing Threat Uncovered
PremiumCompromised MemTensor packages on npm/PyPI delivered sckit Go-based implant across Windows, Linux, and macOS.
Check Point Vulnerabilities Exploited: Critical Updates Needed
PremiumBSI bulletin warns Check Point vulnerabilities have been exploited since summer, impacting appliances and VPN services.
Critical cPanel Vulnerabilities Expose Servers to Root-Level Attacks
PremiumcPanel CalDAV/CardDAV flaw allows any hosting account to execute code as root and fully compromise servers.
Critical Vulnerability in Next.js ImageResponse Allows Server Code Execution
PremiumNext.js ImageResponse flaw allows server-side code execution via crafted SVG input; Vercel patched in Sept 22 release.
Get these articles delivered to your inbox.
Subscribe free