TECHZONE™

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight

Your Critical Vulnerabilities Might Not Be Your Biggest Risk https://thehackernews.com/2026/09/your-critical-vulnerabilities-might-not.html Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise. A critical vulnerability may look alarming on a scanner report, but if it sits behind strong segmentation, identity controls, and other defenses that prevent an attacker

GuardBreaker: Derailing AI-assisted malware analysis with a code comment https://www.welivesecurity.com/en/business-security/guardbreaker-derailing-ai-assisted-malware-analysis-code-comment/ LLM-based code scanners won’t help attackers build a nuclear weapon, but that refusal could work in their favor

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report. Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them.

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns

PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to download. "These are Regular Maintenance Releases (MR) that

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories https://thehackernews.com/2026/09/threatsday-200-android-flaws-browser.html A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?” An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps https://thehackernews.com/2026/09/google-play-early-access-abused-to-push.html Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their

Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 https://thehackernews.com/2026/09/anthropic-ai-models-breached-real.html Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident dates back to January 2026 and involved an early version of Claude Opus 4.6 that breached "

Safe word: What is it and why do you need one? https://www.welivesecurity.com/en/cybersecurity/safe-word-what-why-need-one/ AI scams are now hyper-realistic. But there’s one simple way to see through them.

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto https://thehackernews.com/2026/09/us-disrupts-xinbi-guarantee-scam.html The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others.  Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API

Webinar: Learn How to Answer “Are We Exposed?” Faster After a New CVE https://thehackernews.com/2026/09/webinar-learn-how-to-answer-are-we.html A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed? For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build enough context to act. As AI accelerates vulnerability discovery and research, that delay matters more

DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own computer or server, and it holds their bitcoin. The flaw affects versions v1.7.0 through

U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok https://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.html U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks. The activity has been described as occurring at an industrial-scale and one that forms the "core" of their AI development strategy, according to

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write in V8 in Google Chrome prior to

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.