BigCommerce Faces Data Breach Through Ribon App Exploit
Attackers abused a compromised Ribon BigCommerce app key to inject malicious scripts and exfiltrate merchant customer data.
Wednesday, September 23
ShinyHunters Exploit Zero-Day to Breach FBI Systems via PeopleSoft
ShinyHunters claims to have exploited an Oracle PeopleSoft zero-day to access FBI systems and steal internal data.
AI-Powered Phishing Campaign Targets Companies with Sophisticated Scams
Microsoft-tracked AI-assisted phishing campaign sent more than one million personalized payment-diversion scam emails.
Critical Zero-Day Flaw Discovered in D-Link DIR-822A Routers
D-Link warns of maximum-severity zero-day CVE-2026-86296 with PoC affecting legacy DIR-822A routers and no patch yet.
Security Breach at Colorado Water Utilities Exposes Critical Vulnerabilities
Report: Colorado water utilities breached and fake online job interviews used to distribute malware to victims.
Chinese Cyber Threat Group UTA0565 Exploits Chrome and Microsoft Vulnerabilities
Volexity observes UTA0565 exploiting Chrome and Microsoft defects with a shared exploit kit across China-aligned groups.
SideCopy Expands Espionage Campaign to Indian Academia with ReverseRAT
SideCopy uses spear-phishing and mshta.exe to deliver ReverseRAT, targeting Indian academic institutions for espionage.
North Korean Hackers Compromise Global Devices and Steal Millions in Cryptocurrency
WaterPlum/Contagious campaign compromised ~30,000 devices and siphoned funds or credentials from 7,000 crypto wallets.
Federal Agencies Urged to Patch Critical Zyxel Vulnerability
CISA orders federal agencies to patch an actively exploited Zyxel GS1900 switch vulnerability used for data theft.
WordPress Urges Immediate Patch for Click2Shell Vulnerability
WordPress released fixes for Click2Shell CSRF allowing PHP execution and potential remote code execution; patch immediately.
AI-Driven Cyber Attacks: A New Level of Automation Threatens Online Retailers
Reports show AI agents used to steal cards, run autonomous malware, and make strategic attack decisions post-compromise.
BigDiskBuster Zero-Day Exploit Challenges Microsoft Defender Updates
Researcher Nightmare Eclipse published Defender exploits/PoC (BigDiskBuster) that block Defender updates and affect endpoint protections.
EvilTokens Service Disrupted After Massive Microsoft Account Breach
Microsoft and partners disrupted EvilTokens PhaaS that had compromised over 12,000 Microsoft accounts and automated token theft.
Monday, September 21
Google Gemini's AI Test Leads to Unintentional Company System Breach
PremiumGoogle Gemini escaped a test environment due to a domain mix-up and accessed systems of three real companies during evaluation.
CrowdSec's GitHub Breach Highlights Risks of Supply Chain Attacks
PremiumCrowdSec says TanStack npm supply-chain attack enabled theft of about 170 private GitHub repositories from CrowdSec.
Critical Click2Shell Vulnerability in WordPress Demands Immediate Update
PremiumClick2Shell allows a crafted link to force a WordPress admin to install an attacker-chosen theme, chaining to server RCE.
BragJack Exploit Threatens AI Assistants Across Major Browsers
PremiumBragJack PoC lets a malicious browser extension hijack AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude-in-Chrome.
Malicious npm Packages Bypass Security by Activating at Runtime
PremiumAn npm campaign hides malicious runtime code to avoid install-script defenses, persisting by executing during normal package usage.
Ransomware Groups Shift Focus to AI Models: A New Era of Digital Extortion
PremiumAnalysis of JADEPUFFER shows ransomware groups now target AI/ML models and model recovery chains for extortion and disruption.
Critical Flaw in Cisco Identity Services Engine Poses Severe Security Risks
PremiumCVE-2026-76460 authentication bypass in Cisco ISE scored 10/10 CVSS, exposing API endpoints to unauthenticated access.
Get these articles delivered to your inbox.
Subscribe free