TECHZONE™

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory https://thehackernews.com/2026/10/wordpress-backdoor-rebuilds-itself.html Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC_" markers present in the injected content. Sucuri has described the malware as a "self-healing mesh" that's

This month in security with Tony Anscombe – September 2026 edition https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-september-2026/ Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace

How Financial Services Companies Can Modernize Their Software Supply Chain https://thehackernews.com/2026/10/how-financial-services-companies-can.html Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else raises the change-freeze calendar. The finding gets an exception, a compensating control, and a date

OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates https://thehackernews.com/2026/10/openai-disrupts-reasoning-extraction.html OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A "core cluster of the activity," going back to the first week of July, has been attributed to individuals associated with Moonshot AI, a Chinese AI company based in Beijing. It did not cite any

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with

Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version https://thehackernews.com/2026/10/google-rolls-out-gemini-4-argon-to.html Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program. "It delivers frontier performance in complex workflows across real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense," Koray Kavukcuoglu,

Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path https://thehackernews.com/2026/10/apple-coregraphics-poc-emerges-as.html Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. "Their investigation identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a customized tool used by the attacker

MetaMask Security Incident Prompts Exit of Affected Ethereum Validators https://thehackernews.com/2026/10/metamask-security-incident-prompts-exit.html MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors," the software cryptocurrency wallet maker said. "At this time, we have identified no immediate threat to MetaMask wallets." MetaMask

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. "Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures https://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.html Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another feature in trusted artificial intelligence (AI) platforms. Prior campaigns have weaponized shared

Timeshare exit scams: From fake buyers to recovery fraud https://www.welivesecurity.com/en/scams/timeshare-exit-scams-fake-buyers-recovery-scams/ Con artists are targeting timeshare owners who want out – and some victims are hit twice

Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler

French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks https://thehackernews.com/2026/09/french-tax-data-theft-using-stolen.html An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weak

New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses https://thehackernews.com/2026/09/new-spectre-v2-btr-attack-leaks-linux.html A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre-v2 variant has been codenamed Branch Target Reuse (BTR). "The key insight is that, while modern CPUs

Kiteworks Fixes Critical Flaw Found During Nine-Hour Precautionary Shutdown https://thehackernews.com/2026/09/kiteworks-fixes-critical-flaw-found.html Kiteworks on Monday said it worked with federal intelligence authorities over the weekend as it identified and addressed a critical security vulnerability during the scheduled precautionary shutdown. "During the shutdown, this activity led to the discovery of a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the customer base," the company

101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent https://thehackernews.com/2026/09/101-malicious-npm-packages-add.html Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub. "The malicious packages abuse the 'Baileys' WhatsApp open source project to add the victims to groups without their consent," OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko said in a technical