2026-09-22 05:31 UTC
Security Journalism
The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-22 06:55 UTC
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating
P35
2026-09-22 05:00 UTC
Other
Zero Day Initiative · indexed 2026-09-22 21:10 UTC
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco ThousandEyes Virtual Appliance. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20350.
P20
2026-09-22 03:50 UTC
Community
SANS Internet Storm Center · indexed 2026-09-22 04:10 UTC
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
P0
2026-09-22 02:01 UTC
Security Journalism
Security Week · Associated Press · indexed 2026-09-22 02:10 UTC
Trump has resisted calls to slow down AI development, saying that would help China catch up to U.S. companies. The post US Proposes AI Incident Alert System in Talks With China, Bessent Says appeared first on SecurityWeek.
P0
2026-09-21 23:13 UTC
Other
Check Point Research · urias@checkpoint.com · indexed 2026-09-21 23:20 UTC
For the latest discoveries in cyber research for the week of 21st September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance. Approximately 246,000 records were exposed, […] The post 21st September – Threat Intelligence Report appeared first on Check Point Research.
P0
2026-09-21 21:39 UTC
Security Journalism
Dark Reading · Jai Vijayan · indexed 2026-09-21 22:00 UTC
Unbounded consumption is an issue that OWASP currently ranks sixth in its Top 10 for LLM Applications, and it could be an extremely costly one.
P0
2026-09-21 21:18 UTC
Security Journalism
BleepingComputer · Bill Toulas · indexed 2026-09-21 21:20 UTC
Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. [...]
P0
2026-09-21 20:20 UTC
Other
Security Affairs · Pierluigi Paganini · indexed 2026-09-21 21:20 UTC
Ireland’s DPC fined Google €403 million over GDPR violations involving location data, transparency, retention and user control. Ireland’s Data Protection Commission (DPC) just fined Google €403 million, and the case behind it goes back six years, to a set of complaints that never really went away. The DPC launched the investigation in February 2020 after […]
P0
2026-09-21 20:12 UTC
Security Journalism
BleepingComputer · Bill Toulas · indexed 2026-09-21 20:20 UTC
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. [...]
P0
2026-09-21 20:07 UTC
Security Journalism
Dark Reading · Alexander Culafi · indexed 2026-09-21 20:30 UTC
ShinyHunters defaced Cl0p's Dark Web site and claims to have stolen victim data, potentially exposing organizations that paid ransoms to renewed extortion attempts.
P0
2026-09-21 19:15 UTC
Security Journalism
The Record · indexed 2026-09-21 19:30 UTC
Ireland’s Data Protection Commission will fine Google more than €403 million ($462 million) over the tech giant’s processing of location data, concluding an inquiry into the company that began in early 2020.
P0
2026-09-21 19:11 UTC
Security Journalism
Dark Reading · indexed 2026-09-21 19:45 UTC
Victims have been identified in Africa, including in Kenya and Uganda.
P0
2026-09-21 18:23 UTC
Security Journalism
BleepingComputer · Bill Toulas · indexed 2026-09-21 18:30 UTC
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. [...]
P0
2026-09-21 18:09 UTC
Other
Security Affairs · Pierluigi Paganini · indexed 2026-09-21 19:10 UTC
Hackers targeted two Colorado water utilities, changing OT settings and disabling alarms, but causing no impact on water services or safety. Foreign hackers targeted the operational technology (OT) systems of two small private water utilities in Colorado in late August, apparently trying to disrupt operations. Local authorities haven’t identified the affected utilities or the attackers. […]
P0
2026-09-21 17:54 UTC
Security Journalism
BleepingComputer · Sergiu Gatlan · indexed 2026-09-21 18:05 UTC
Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove them from managed devices. [...]
P0
2026-09-21 17:31 UTC
Security Journalism
The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 18:15 UTC
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers
P0
2026-09-21 17:19 UTC
Security Journalism
Security Week · Associated Press · indexed 2026-09-21 17:30 UTC
Google has been fined 403 million euros ($463 million) for breaching the European Union’s strict privacy rules because it mishandled users’ location data. The post Google Hit With $463 Million Fine for EU Location Data Rule Breach appeared first on SecurityWeek.
P0
2026-09-21 17:19 UTC
Security Journalism
The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 18:15 UTC
The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,
P0
2026-09-21 16:57 UTC
Security Journalism
The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 18:15 UTC
Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Google's lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months. The DPC has not said publicly which
P0
2026-09-21 15:46 UTC
Security Journalism
Security Week · Ionut Arghire · indexed 2026-09-21 15:50 UTC
The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware. The post Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer appeared first on SecurityWeek.
P0
2026-09-21 15:41 UTC
Security Journalism
BleepingComputer · Bill Toulas · indexed 2026-09-21 15:55 UTC
Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users' location data. [...]
P0
2026-09-21 15:33 UTC
Vendor Research
AWS Security Blog · Dhananjay Karanjkar · indexed 2026-09-21 16:00 UTC
Security teams investigating possible AI-related security events need guardrail intervention data alongside their existing security telemetry. When a guardrail identifies or blocks a prompt injection attempt or redacts sensitive data, that intervention carries additional investigative value comparable to a failed sign-in or a network intrusion alert. AWS Bedrock publishes this telemetry to AWS CloudWatch metrics […]
P0
2026-09-21 15:00 UTC
Security Journalism
The Record · indexed 2026-09-21 15:30 UTC
Belgium’s national table tennis federation is investigating a cyberattack after a hacker claimed to have stolen data on tens of thousands of members.
P0
2026-09-21 14:47 UTC
Security Journalism
Dark Reading · Elizabeth Montalbano · indexed 2026-09-21 15:15 UTC
The AI giant disclosed six examples of concerning model activity and published a new framework for investigating and disclosing such incidents.
P0
2026-09-21 14:42 UTC
Security Journalism
BleepingComputer · Sergiu Gatlan · indexed 2026-09-21 14:45 UTC
Microsoft has fixed a known issue that causes copy-and-paste failures for Excel users after installing the September 2026 security updates. [...]
P5
2026-09-21 14:30 UTC
Security Journalism
Security Week · Kevin Townsend · indexed 2026-09-21 14:35 UTC
Noopur Davis never planned a career in cybersecurity. She was a developer at Intergraph, and for many years that was all she wanted to be. The post CISO Conversations: Noopur Davis – The Accidental Global CISO at Comcast appeared first on SecurityWeek.
P0
2026-09-21 14:24 UTC
Security Journalism
The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 14:45 UTC
A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more findings, more automation, and not
P25
2026-09-21 14:15 UTC
Security Journalism
The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 14:45 UTC
Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary
P0
2026-09-21 14:02 UTC
Security Journalism
BleepingComputer · Sponsored by Specops Software · indexed 2026-09-21 14:15 UTC
The FBI's CJIS Security Policy v6.1 strengthens requirements around encryption and vulnerability scanning while continuing the shift toward more continuous security assessment. Specops explains what changed and how agencies can address password, MFA, and identity requirements as they prepare for upcoming audits. [...]
P0
2026-09-21 14:01 UTC
Security Journalism
The Record · indexed 2026-09-21 14:30 UTC
The university, commonly known as LMU Munich, said Saturday that an attacker accessed enrollment data stored on one of its IT systems.
P0
