Threat Intel Hub

September 21, 2026 By Bill Toulas The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical.The three security issues were added separately last week and have severity ratings ranging from medium to critical. One of them, tracked as CVE-2025-39964, existed in the Linux kernel for 14 years.CISA marked all three flaws with the highest priority for federal agencies, ordering them to apply available security updates and mitigations by the end of today.The three vulnerabilities are:CVE-2025-39964: a race condition in the kernel’s AF_ALG cryptographic socket interface that allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results. CVE-2026-53266: an out-of-bounds write vulnerability in the Linux kernel’s ebtables SNAT implementation that can cause an ARP address rewrite to modify shared file-backed memory without first making the

The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware. September 21, 2026 By Ionut Arghire A fake LastPass Authenticator distributed via GitHub has led to the discovery of a broad impersonation campaign delivering infostealer malware, LastPass reports.As part of the campaign, the attackers impersonated at least 40 organizations to push a Microsoft-attested kernel driver designed to terminate 145 security tools and open the door to information-stealing malware called Rapuncel.Discovered on August 13, the fake LastPass lure represents opportunistic brand spoofing — with no internal LastPass systems compromised — and forms part of a campaign active for several months.Using SEO optimization, the attackers’ GitHub page serving the fraudulent LastPass Authenticator was shown among the top results to users searching for the legitimate application. Another page was offering a fake macOS LastPass application. >>Full Article<<

Document IDSB26-264 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is comp

September 21, 2026 By Pieter Arntz  Google says one of its Gemini models accessed systems belonging to three real companies during a cybersecurity evaluation in May.The model reportedly guessed credentials in one case, while finding exposed credentials in public repositories in two others. Google says Gemini stopped once it recognized that it had reached real infrastructure and that the affected organizations were notified.Gemini was participating in an evaluation run by Irregular, a third-party AI cybersecurity testing firm. Similar incidents involving models from Anthropic, OpenAI, and Meta have also been linked to the same underlying problems with evaluation environments that allowed the models to reach the public internet.But the news arrives at a particularly interesting moment. >>Full Article<<

September 21, 2026 By Pierluigi Paganini Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server.Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain.The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify. Inside that installer sits a full Node.js runtime and a JavaScript agent ready to launch.Once it runs, the installer scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime. None of this needs admin rights, since the installer is set to run entirely wit

September 21, 2026 By Mirko Zorz Researchers have taken apart TASK#STOMP, a Windows backdoor that searches a victim’s drives for business documents, uploads them to attacker servers, and then stays put to grab each new or edited document. The same malware steals saved Wi-Fi passwords and clipboard text, takes screenshots, and runs whatever command its operators send.Akshay Gaikwad and Aaron Beardslee of Securonix Threat Research built their analysis from one infected machine, so Securonix cannot say how many organizations are affected. The malware plants at least five footholds, four scheduled tasks and a copy of itself in the Startup folder, and researchers warn that removing only one may leave the others able to rebuild the infection. TASK#STOMP process flow reconstructed from observed process telemetry (Source: Securonix)Five ways back inThe infection starts with a VBScript file, a Windows script, sitting on the user’s desktop. The script creates four scheduled tasks with names that

Google’s threat intelligence group said it had a mole inside TeamPCP’s inner circle.Andy Greenberg, WIRED.com – 20 Sept 2026 Before two of its alleged members were arrested and charged in Australia last month, the hacker group known as TeamPCP carried out a hacking spree unlike any other in history. It tainted hundreds of open-source programs with its malware, stole developer accounts to perpetuate that software supply-chain hacking, and even released a Dune-themed self-spreading worm to automate the process, ultimately breaching more than a thousand companies.Now Google’s threat intelligence group has revealed that during a key moment of TeamPCP’s rampage, the company’s own undercover researcher had infiltrated the group—allowing Google to monitor the hacking spree from the inside, warn breach targets, and even help disrupt the group’s attempts to exploit those victims. >>Full Article<< 

September 21, 2026 By Bill Toulas Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform’s Core component.The security problem does not have an official identifier but was addressed last week with the release of WordPress version 7.1.1.It is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run an arbitrary PHP file.Security researcher Paulos Yibelo of the autonomous penetration testing platform pwn.ai discovered Click2Shell and reported it to WordPress on August 22.The researchers explain that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser."This enables an attacker to add a WordPress theme to a target website without the administrator explicitly installin

September 19, 2026 By Lawrence Abrams The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.The attack began Friday night when ShinyHunters exploited what they claim is an unauthenticated file upload vulnerability in Grav CMS, which they used to upload a small text file to Clop's site.File downloaded from Clop's data leak siteSource: BleepingComputerThe small text file contained a message from the threat actors to the Clop ransomware gang, warning not to threaten them and including a link to ShinyHunter's own data leak site."THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time," read the uploaded file.File uploaded to Clop's data leak siteSource: BleepingComputerThe file also contained a link to the ShinyHunters data leak site. >>Full Article<<

September 19, 2026 By Bill Toulas A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea.The figures came from a joint advisory by Japanese, US, Australian, and German authorities that collectively traced the threat group's activity.WaterPlum is linked to a multi-year campaign known as "Contagious Interview," which has previously targeted job seekers with malicious npm packages hat infect their devices with malware.The attackers impersonate legitimate AI, cryptocurrency, and NFT companies or use recruiting and freelance platforms to approach job seekers.During fake interviews and coding tests, victims are instructed to download projects, troubleshoot supposed video-conferencing problems, or execute malicious code.Source: FBIWaterPlum is part of a broader ecosystem of North Korean threat actors th

September 18, 2026Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide.Note: CVE's will be added as soon as available https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#september-18-2026 Webroot SecureAnywhere users make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!  

Thursday, September 17, 2026 The Stable channel has been updated to 153.0.8010.52/.53 for Windows and Mac and 153.0.8010.52 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 16 security fixes. Please see the Chrome Security Page for more information. https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html Webroot SecureAnywhere users make sure to re-add back to Privacy Protection! 

September 18, 2026 By Bill Toulas  An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies.Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.The attack chain begins when victims search for LastPass Authenticator or other popular software and follow links to fake GitHub repos.There, clicking download buttons triggers a series of redirections before reaching payload-delivery servers, where victims receive ZIP archives with their size inflated to up to 148MB to evade security scans. >>Full Article<<

Image: Unsplash/Photomosh September 18, 2026 By Jonathan Greig More than $10.5 million has been stolen by North Korean hackers targeting job seekers as part of a long-running cyber campaign to infiltrate tech companies and fill Pyongyang’s coffers with illicitly gained funds. The FBI and Defense Department partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealing cryptocurrency from job applicants by posing as AI or blockchain companies. The report said that between December 2025 and July 2026, WaterPlum hackers infected at least 30,000 devices across 100 countries and stole funds or credentials from about 7,000 cryptocurrency wallets. The primary targets of the campaign are web designers, engineers and cryptocurrency specialists. Friday’s advisory said the WaterPlum scheme is specifically victimizing IT professionals in Japan and other countries. Job seekers are c

September 18, 2026 By Pierluigi Paganini RatHat combines AI-driven screen control, Android debugging abuse and advanced credential theft to give attackers deep control of infected phones.RatHat is the new Android trojan you should know about. Zimperium researchers just published a breakdown of a strain they’ve traced to China-based operators, and what makes it different isn’t the credential theft, which is standard fare by now. It’s what it does to get there.It starts the way most mobile fraud does: a text message or a shady ad pointing to a fake app store. Once someone installs the APK, the malware doesn’t just ask for permissions and hope.“RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, smishing campaigns, and third-party forums, luring victims into manually downloading malicious APKs that appear to be legitimate apps” reads the report published by Zimperium. >>Full Article<<

September 18, 2026 By Bill Toulas The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records.Gyazo is a cloud-based screenshot and screen-recording tool operated by Helpfeel that automatically uploads user screen captures to the cloud and gives them a shareable link to share on chats, forums, social media, etc.It's especially popular in gaming communities and claims 23 million users worldwide, who have submitted 3.1 billion media items.According to an announcement by the company, the incident occurred on September 11, 2026, allowing attackers to access its database and obtain approximately 23.62 million user records.The company has now taken the platform offline while it conducts maintenance."Currently, the Gyazo service is temporarily suspended for maintenance as a preventive measure. We sincerely apologize for any inconvenience caused. Please wait a little longer until re

Version 153.0.4234.46: September 17, 2026 (Stable) - Update 1Release Summary Category Description Fixes Fixed various bugs and performance issues. Security Stable channel security updates are listed here. FixesFixed an issue which caused some web applications to become unresponsive during user interaction. When the issue occurred, the affected browser window froze and stopped responding to mouse or keyboard input. Customers who continue to experience similar symptoms after updating to the latest Stable version should contact Microsoft Support to confirm if additional fixes are necessary. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel#version-1530423446-september-17-2026-stable Webroot SecureAnywhere users make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!  

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.CVE-2025-39964 Linux Kernel Race Condition Vulnerability CVE-2026-53266 Linux Kernel Out-of-Bounds Write VulnerabilityThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further estab

Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads. September 17, 2026 By Karlo Zanki  Socket researchers identified malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads, as the PolinRider campaign continues to spread through compromised developer accounts and Git repositories. The Socket Threat Research Team continues to track malicious activity associated with PolinRider. In our July research post, we provided initial technical details about this persistent campaign, which distributes malware across npm, PyPI, Go modules, Packagist, and Chrome extensions. We also documented its expansion into the Packagist ecosystem. Among the latest affected projects is visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads. The malicious code is present in the unstable dev-* version

September 17, 2026 By Sergiu Gatlan On Tuesday, the U.S. Federal Bureau of Investigation (FBI) seized the domains used by NightmareStresser, one of the world's longest-running distributed denial-of-service (DDoS) platforms."Booter services" like NightmareStresser are DDoS-for-hire services that let anyone rent large botnets of compromised routers and a wide range of IoT devices to launch massive DDoS attacks targeting online platforms and services.Before the nightmare-stresser[.]com and nightmarestresser[.]org were taken down, the stresser service described itself as the "#1 online IP booter" and "the only DDoS tool available 24/7."As cybersecurity firm Searchlight Cyber reported in 2023, NightmareStresser had over 566,000 registered users and 52 dedicated servers that could launch DDoS attacks of up to 200 Gbps targeting multiple layers of a network (including Layer 7 application protocols and Layer 4 TCP/UDP protocols). >>Full Article<<

The decision follows BOD 26-04, which directs federal organizations to prioritize vulnerabilities based on real-world risk. September 17, 2026 By Eduard KovacsThe US Cybersecurity and Infrastructure Security Agency (CISA) announced on Wednesday that it’s retiring its weekly vulnerability bulletin.The vulnerability bulletin will be discontinued on September 28 as part of a shift to a risk-based approach in vulnerability management. The bulletin provides a summary of new vulnerabilities recorded each week. It includes information such as product name, description of the flaw, the date of publication, severity, CVSS score, CVE identifier, and patch information (when available).Each bulletin contains entries for thousands of vulnerabilities, sorted alphabetically by affected product name and severity, but it does not provide guidance on prioritizing the security holes. Without threat intelligence or context on active exploitation, the sheer volume of flaws can lead to alert fatigue for def

September 17, 2026 By Pierluigi Paganini Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report. The work doesn’t dissect malware samples; it maps the network side of the operation with enough precision to tie three of SilkParasite’s seven RAT families (SpiceRAT, NodeEdgeRAT, and NomadRAT) through shared certificates, domains, and hosting patterns.“Shared parent domains and an identical TLS certificate connect this infrastructure to hosts Bitdefender attributed to SpiceRAT, NodeEdgeRAT, and NomadRAT, three of the seven malware families documented in the SilkParasite report.” reads the report published by Hunt.io.“The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CA

SynthID can cause models to follow harmful instructions they would otherwise refuse. Dan Goodin – 17 Sept 2026 AI generated content warning watermark isolated on white background Credit: Getty Images  In response to a new European Union law, AI platforms are implementing new schemes for watermarking the content they generate. Anthropic recently disclosed its future Claude models will use SynthID-Text, an approach Google created and released as open source. It uses a secret key that subtly changes the process a model uses for choosing the next word in a sentence. Whereas a top next word choice might be “cloudy,” the key might change it to “overcast.” Anyone who knows the key can determine if it was generated by the platform using it.New research shows that SynthID-Text can change not just word selection but also the tools a model invokes and the chances it will adhere to or disregard safety guardrails it has been trained to follow. The threat can become greater in the face of an adversa

September 17, 2026 By Bill Toulas Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware.The customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours on September 14.The attack affected pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The Cloudflare worker also modified the Brevo forms script, Brevo Conversations widget, and the Brevo SDK loader scripts that customers embed on their websites.In a post-mortem published today, Brevo explained that attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes, and DNS records