TECHZONE™

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency. "We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark

Looking for free Robux? Here’s what’s real, and what’s a scam https://www.welivesecurity.com/en/kids-online/looking-for-free-robux-heres-whats-real-whats-scam/ Fake giveaways, free Robux generators and lookalike login pages all target the same thing – your Roblox account

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks https://thehackernews.com/2026/09/check-point-warns-of-management-server.html Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders. On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.1.2, with fixes for every branch the project still supports, back to 4.7, and WordPress is telling site owners

Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731."

DORA Year Two: Can Your SOC Actually See the Attack? https://thehackernews.com/2026/09/dora-year-two-can-your-soc-actually-see.html When the Digital Operational Resilience Act (DORA) became enforceable across the European Union in January 2025, it triggered an administrative sprint. Financial entities spent the first year establishing risk governance, assessing third-party service providers, updating contract clauses, and documenting incident escalation workflows. Now in its second year, the harder part of DORA is

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine.

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition. Patches have been

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers

The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive https://www.welivesecurity.com/en/business-security/smb-cybersecurity-squeeze-ai-agents-work-old-attacks-overdrive/ As AI opens new paths to company data while making familiar attacks faster and cheaper, SMBs need protection designed around the time and expertise available to operate it

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. The flaw is in

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There is

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto https://thehackernews.com/2026/09/contagious-interview-campaign.html The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,

Google Fined €403 Million Over GDPR Violations Tied to Location Data https://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.html Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Google's lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months. The DPC has not said publicly which