TECHZONE™

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat

When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted https://thehackernews.com/2026/08/when-vibe-hacking-turns-ai-into-junior.html The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise. That assumption is starting to break. Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat at one end. Organized criminal groups followed. Inexperienced attackers, dismissed as "script kiddies," sat at the other end, running public

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries. The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second

CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-18577 (CVSS score: 8.2), is a case of incomplete patching for CVE-2026-18556 (CVSS score: 8.2) that allows

18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. One of the packages in question is "lib-mtop," an unscoped package with the same name as a private Alibaba package

PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web https://thehackernews.com/2026/08/pnld-breach-exposes-uk-police-and.html The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. The incident, identified on July 26, also exposed some names

Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them. The vendor's July 31 security bulletin says nearly undetectable changes to .fsa and .hid outputs could occur if laboratory controls are circumvented. Thermo Fisher tracks the issue as CVE-2026-17583 and rates it

N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers. Its first fix was incomplete. CVE-2026-18577 affects N-central builds prior to 2026.3.1.7. N-able shipped build 2026.3.1.7 on August 2 as the first unaffected version. N-central is the remote monitoring and management platform

Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk. "These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG

Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities. Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin,

Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in

Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to Storm-2945. It assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard, also known as

This month in security with Tony Anscombe – July 2026 edition https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-july-2026/ OpenAI models going rogue, the first documented agentic ransomware operation, and an emergent AI-driven supply chain threat made for a packed July roundup

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk https://thehackernews.com/2026/08/suspected-chinese-speaking-hackers.html A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted organizations operate across several sectors, such as healthcare, research, government offices,

HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm https://thehackernews.com/2026/07/hollowframe-loader-deploys-matryoshka.html Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). Executing the file triggers a multi-stage chain that

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies https://thehackernews.com/2026/07/cheap-android-tv-boxes-pose-as-phones.html Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators. Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland China company founded in 2019. The same apps have a second job. When a box

Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined https://thehackernews.com/2026/07/three-recent-chrome-releases-fix-1442.html Google on Thursday announced that it fixed a whopping 1,072 security bugs in Chrome versions 149 and 150, surpassing the total number of flaws the company fixed across the prior 23 milestones combined. Both versions were released last month. In its latest patch for Chrome 151, released Wednesday, the tech giant resolved 370 flaws, out of which 349 were reported by Google itself. Seven of the