TECHZONE™

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows - CVE-2026-65660 (CVSS score: 8.8) - A code injection vulnerability in Microsoft Office SharePoint

Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack https://thehackernews.com/2026/09/kiteworks-urges-customers-to-shut-down.html Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend after it received threat intelligence about an imminent cyber attack. "Kiteworks received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems," said Frank Balonis, Chief

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware https://thehackernews.com/2026/09/compromised-github-actions-came-back.html Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material

The SOC Doesn't Need to Start Over with Every Alert https://thehackernews.com/2026/09/the-soc-doesnt-need-to-start-over-with.html Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead end used to cost hours of documentation reading,

Been told to pay at a Bitcoin ATM? Read this first https://www.welivesecurity.com/en/scams/been-told-pay-bitcoin-atm-read-first/ Crypto ATM scams often follow a predictable script – here’s how to recognize it and what to do if you’ve already been caught out

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets.  "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace() backslash

Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company

WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in  WSO2 API Control Plane,

Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore https://thehackernews.com/2026/09/secrets-sprawl-is-identity-problem-that.html AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of human-written ones. Most of the fastest-growing categories of leaked credentials are now connected to AI

17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360 https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read

OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files https://thehackernews.com/2026/09/openai-agent-bypassed-australian.html An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords https://thehackernews.com/2026/09/teamfiltration-compromises-seven.html Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts –

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts. cPanel has released fixed versions for both,

545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent https://thehackernews.com/2026/09/545-hackers-tested-it-first-now-xranges.html Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good. Point one at a realistic target and what comes back is a report the agent wrote about itself: confident prose, a list of findings, and no way to tell which of them happened. Someone with a security background then sits down and checks every claim against the target. Which findings are real,

Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests https://thehackernews.com/2026/09/anthropic-and-openai-models-still.html Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a "major step up from Opus 5," and "achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands

Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst