TECHZONE™

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean. Those three scripts are

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed https://thehackernews.com/2026/09/researcher-drops-new-microsoft-defender.html The security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month. "Microsoft has failed to properly patch ShieldBreak CVE-2026-69414," Chaotic

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution https://thehackernews.com/2026/09/sap-patches-cvss-100-kernel-flaw.html SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical severity rating.

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild https://thehackernews.com/2026/09/n-able-n-central-pre-auth-rce-flaw.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026. The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says. FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software. The

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the Indian state of Rajasthan since at least 2015, driven by two IT service providers named WeConnect

Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing https://thehackernews.com/2026/09/grindr-to-pay-26-million-to-settle-uk.html Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal information, including their HIV status, with third-parties. Grindr, which is the largest LGBTQ+ dating app, was sued in April 2024, accusing it of violating U.K. privacy laws by sharing sensitive data for commercial purposes such as advertising.

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More https://thehackernews.com/2026/09/weekly-recap-chrome-0-day-router.html Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management

Your Cloud Security Checklist Doesn't Work the Way You Think It Does https://thehackernews.com/2026/09/your-cloud-security-checklist-doesnt.html If managing security across multiple cloud providers wasn't hard enough, each one fails in a different way. For the 2026 Cloud Security Index, Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have almost nothing in common. Here’s what the data looks like. How risk differs across cloud providers

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers," Check Point Research said in a

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and