TECHZONE™

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses

Beware the SparroWock: The backdoor that bites, the commands that catch https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/ ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root https://thehackernews.com/2026/09/critical-check-point-management-server.html A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories https://thehackernews.com/2026/09/threatsday-self-rewriting-agents-800.html Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner. It is just

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS https://thehackernews.com/2026/09/bind-9-update-fixes-14-flaws-including.html The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG

Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html A security breach at Gyazo, Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday. It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links. Helpfeel said

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker

U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks https://thehackernews.com/2026/09/us-seizes-nightmarestresser-domains.html The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service (DDoS)-for-hire service known as NightmareStresser. The domains in question are: nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to the site are now greeted by a seizure banner that states - "This domain has been seized by the

Cyberthreats are moving faster than SMBs: Readiness must accelerate https://www.welivesecurity.com/en/business-security/cyberthreats-moving-faster-smbs-readiness-must-accelerate/ As AI adoption expands the attack surface and adds to the security workload, businesses need automation backed by experts

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers https://thehackernews.com/2026/09/three-threat-groups-target-russian.html Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.

One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge,

Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 (CVSS score: 7.8), is described as a case of local privilege escalation due to insecure file permissions. It affects the following versions - Acronis Backup plugin for cPanel & WHM (Linux

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress security company said it has blocked over

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens https://thehackernews.com/2026/09/active-exploitation-attempts-target.html A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw. "JWT authentication

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and