522/69 Tuesday, September 22, 2026 Security researchers have disclosed a campaign involving fake GitHub pages impersonating LastPass Authenticator and software from at least 40 organizations to trick users into downloading malicious installers. The attackers use SEO techniques to make the fake pages appear prominently in search results. Once the installer is executed, it deploys an […]
521/69 Tuesday, September 22, 2026 The extortion group ShinyHunters was observed compromising and defacing the Tor-based leak site operated by the Clop ransomware group, replacing its original content with ShinyHunters branding and a message for visitors. The incident was discovered by Hackread.com on September 19, 2026. Clop’s website displayed ASCII artwork associated with ShinyHunters, a […]
520/69 Tuesday, September 22, 2026 Researchers from Blackpoint have discovered a new Remote Access Trojan (RAT) named ChainScript, developed in Node.js. The malware is being distributed through a ClickFix campaign that tricks users into copying and running malicious commands. A notable feature of this malware is its use of blockchain technology to hide its command-and-control […]
519/69 Monday, September 21, 2026 SolarWinds has released a security update to address CVE-2026-28326 in its Access Rights Manager (ARM) product. The vulnerability has a CVSS score of 8.8 and could allow an unauthenticated attacker to execute commands on affected systems. The flaw affects Access Rights Manager version 2026.2 and earlier, and SolarWinds has already […]
518/69 Monday, September 21, 2026 Researchers from Hacktron disclosed the results of a security test in which they were able to take over ChatGPT and Codex accounts belonging to OpenAI staff through a vulnerability in a forum system running Discourse. The attack did not rely on phishing or leaked passwords, but stemmed from the image […]
517/69 Monday, September 21, 2026 Security researchers from Forever Security have disclosed a new attack technique named “BragJack,” which allows threat actors to take control of artificial intelligence assistants installed in popular web browsers by using malicious extensions already present on a victim’s system. The attack primarily affects browsers or tools based on Chromium, including […]
516/69 Friday, September 18, 2026 Internet Systems Consortium (ISC) has released security updates for BIND 9 to address 14 vulnerabilities covering issues that may affect the availability and integrity of DNS services. Some of the vulnerabilities can be exploited without authentication and may cause the named process to crash or consume excessive system resources, resulting […]
515/69 Friday, September 18, 2026 The U.S. Federal Bureau of Investigation (FBI), in cooperation with the Royal Canadian Mounted Police (RCMP), has seized internet domains associated with NightmareStresser, a DDoS-for-hire service accused of allowing customers to pay for access to infrastructure used to attack targets worldwide. The U.S. Department of Justice stated that NightmareStresser had […]
514/69 Friday, September 18, 2026 Security researchers from Lumen have discovered a new malware family named BambooToken, which has been used to target Windows and Linux systems from February 2023 through July 2026. The malware hides its activity by using the MQTT protocol, a messaging protocol commonly used in smart home devices and industrial systems, […]
513/69 Thursday, September 17, 2026 Wordfence disclosed two Critical vulnerabilities in The Events Calendar plugin for WordPress, tracked as CVE-2026-78159 and CVE-2026-78006. Both vulnerabilities have CVSS scores of 9.8 and could allow unauthenticated attackers to execute commands on the server and take control of affected websites. The plugin has more than 600,000 installations, while data […]
