Cybersecurity Articles
495/69 Wednesday, September 9, 2026 Researchers from CloudSEK have disclosed a report on BigBear 2.0, a phishing-as-a-service tool designed to steal Microsoft 365 login information. The service can capture passwords and session data after users complete multi-factor authentication (MFA). The investigation found 5,137 stolen credential records, including plaintext passwords and a large number of session […]
494/69 Wednesday, September 9, 2026 Mathspace, an online mathematics learning platform, disclosed a data breach after attackers gained access to its internal reporting system running a self-hosted Metabase deployment and stole data belonging to students, school staff, parents or guardians, and Mathspace employees, affecting more than 1 million people in total. Mathspace was founded in […]
493/69 Wednesday, September 9, 2026 Cybersecurity researchers have disclosed a threat campaign targeting senior executives, such as directors and company vice presidents, to steal data and conduct extortion. The attackers focus on Microsoft 365 and other cloud-based software-as-a-service (SaaS) platforms. The threat actors use phone-based social engineering, or vishing, while impersonating IT staff or help […]
492/69 Tuesday, September 8, 2026 ConnectWise has issued a security advisory for ScreenConnect Remote Access related to file transfer behavior within Support and Access sessions. The issue affects both Cloud and On-Premise deployments. At this time, no CVE identifier has been assigned to the vulnerability, and an official patch is still under development. However, ConnectWise […]
491/69 Tuesday, September 8, 2026 N-able has released a hotfix to address a severe Remote Code Execution (RCE) vulnerability in N-central, a Remote Monitoring and Management (RMM) platform used by IT teams and Managed Service Providers (MSPs) to monitor, manage, and support customer networks and devices through a centralized web-based console. The vulnerability is tracked […]
490/69 Tuesday, September 8, 2026 Cybersecurity researchers have disclosed the discovery of JSCeal, an infostealer malware strain developed to target general users, particularly retail investors and cryptocurrency traders in the Asia-Pacific and Latin America regions. The malware is distributed through malvertising campaigns on social media platforms such as Facebook and Google, luring users to fake […]
489/69 Monday, September 7, 2026 Sansec has disclosed active exploitation of an unpatched vulnerability in Magento Open Source and Adobe Commerce, named StyleSmuggler. Attacks have been observed since September 4, 2026. The vulnerability could allow unauthenticated attackers to execute code on online store servers and install a backdoor to maintain system access. Sansec stated that […]
488/69 Monday, September 7, 2026 Broadcom has published security advisory VMSA-2026-0007 to address two vulnerabilities in VMware Workstation and VMware Fusion that could allow an attacker inside a virtual machine (VM) to execute code on the underlying host. One of the vulnerabilities is rated Critical, and no workaround is available to reduce the risk. The […]
487/69 Monday, September 7, 2026 CERT Polska has issued a cybersecurity warning after detecting threat actors exploiting vulnerabilities in MikroTik routers exposed to the public internet through Secure Shell (SSH). The exploitation could allow attackers to gain full administrator-level control of affected systems without authentication. Initial reports indicate that the activity has been observed since […]
486/69 Friday, September 4, 2026 Reports have disclosed a vulnerability in the All-in-One WP Migration and Backup plugin for WordPress, tracked as CVE-2026-19949, with a CVSS score of 8.8. The flaw is a Second-Order SQL Injection vulnerability affecting version 7.109 and earlier. The plugin is used on more than 5 million websites, and reports indicate […]
