threat-intel AI Speeds Up Malware Development, Not Its Success Rate: Analysis A Palo Alto Networks Unit 42 analysis of 405 AI-linked malware samples revealed that while AI is accelerating malware development, it hasn't significantly improved the malware's ability to evade detection. The majority o… SecurityWeek · 4d ago Medium CHUNaimalwaresandbox
data-breach Carhartt data breach affects 12.9M, half of what ShinyHunters claimed A data breach affecting Carhartt exposed the personal information of 12.9 million customers, with the attackers claiming a larger initial target size. The breach highlights ongoing risks associated with exploiting vulner… The Register · 4d ago High data breachvulnerabilityextension
vulnerability Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code Two unpatched vulnerabilities in Kaltura's HTML5 video player library (mwEmbed) allow remote attackers to read arbitrary files and execute code on a server, without requiring authentication. These flaws stem from unsafe… The Hacker News · 4d ago High CVE-2026-19913CVE-2026-19912unpatcheddeserializationremote code execution
threat-intel 'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month A new adversary-in-the-middle (AitM) phishing service called ‘NovaCookies’ is offering a turnkey solution for attackers to steal Microsoft 365 sessions for $320 a month, bypassing MFA protections. The service provides lu… Dark Reading · 4d ago High USphishingaitmmicrosoft 365
threat-intel The MFA Identity Trap: When Authentication Creates a False Sense of Security Multi-factor authentication (MFA) is increasingly relied upon, but organizations are mistakenly assuming that successful MFA automatically verifies a user’s identity. Attackers are exploiting vulnerabilities in the proce… SecurityWeek · 4d ago High mfaidentity-proofingauthentication
vulnerability Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload A critical remote code execution vulnerability (CVE-2026-60004) in Gitea is actively being exploited to deploy cryptocurrency miners. The vulnerability, stemming from default open registration, allows attackers to gain r… The Hacker News · 4d ago Critical CVE-2026-60004remote code executioncryptojackinggit hook
threat-intel Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes A sophisticated phishing-as-a-service platform, dubbed AnonyMousKIT, is being used to target stolen Apple devices and trick owners into providing their passcodes and 2FA codes, enabling Activation Lock removal. Operated… The Hacker News · 4d ago High ZABRUSphishingactivation lock2fa
vulnerability Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw A vulnerability in NVIDIA's NemoClaw tool, used for deploying AI agents with OpenClaw, allows unauthenticated attackers to poison a large language model's chat template and corrupt the AI agents using it. The issue stems… Dark Reading · 5d ago High aiagentdns rebinding
vulnerability You could've applied all 1,449 Oracle patches and still been hit by this attack A zero-day vulnerability in on-prem SharePoint, stemming from improperly applied patches, is being exploited by attackers. Despite applying 1,449 Oracle patches, attackers successfully leveraged this flaw to gain unautho… The Register · 5d ago High UNzero-dayvulnerabilitysharepoint
vulnerability A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw A vulnerability in NVIDIA NemoClaw allows an attacker to poison an AI model by serving a malicious webpage that can inject hidden instructions into every conversation. The vulnerability stems from a misconfigured Ollama… The Hacker News · 5d ago High CVE-2024-28224aimodel poisoningdns rebinding
vulnerability WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities Threat actors are actively exploiting two recently patched vulnerabilities within the MiniOrange SAML 2.0 Single Sign-On plugin for WordPress websites. These vulnerabilities allow attackers to bypass authentication and g… SecurityWeek · 5d ago High CVE-2026-61979CVE-2026-15981wordpressvulnerabilityauthentication
threat-intel A Tale of Two SOCs: Insights From Two Red Team Assessments Two separate red team assessments at a Government Services and Facilities Sector organization (Organization A) and a Water and Wastewater Systems Sector organization (Organization B) revealed significant vulnerabilities… CISA Advisories · 5d ago High credential abuseactive directorymicrosoft
threat-intel 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages Researchers at OX Security discovered a campaign utilizing 24 npm packages to host fake Cloudflare CAPTCHA pages via unpkg mirrors, redirecting users to phishing infrastructure. The threat actors are leveraging npm's inf… The Hacker News · 5d ago High npmphishingmalware
threat-intel E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands Threat actors are utilizing FTP banner responses as dead drop resolvers to deliver two new remote access trojans, E4del and PINHOLE RAT. E4del, a Node.js-based RAT, employs a dynamic beaconing system to blend in with net… The Hacker News · 5d ago High UNdvrftpremote access trojan
vulnerability CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw CISA has issued a critical three-day patch deadline for a vulnerability in the Perfect 10 plugin for Joomla, which is being actively exploited by attackers. This plugin flaw allows attackers to gain unauthorized access t… The Register · 5d ago Critical CVE-2026-21962joomlavulnerabilityplugin
threat-intel The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution A recent analysis by Palo Alto Unit 42 found that while a significant number of AI-enabled malware samples exist in research and testing environments, only a small fraction (around 12) reached production endpoints across… Palo Alto Unit 42 · 5d ago Medium USCNGBaimalwarethreat intelligence
threat-intel You don't want this Sleepwalker backdoor on your Windows machine A previously unknown backdoor, dubbed ‘Sleepwalker,’ has been discovered in Nvidia’s drivers for Windows machines. This backdoor allows attackers to remotely execute code on vulnerable systems, potentially leading to ful… The Register · 5d ago High backdoorvulnerabilitynvidia
threat-intel ToxicPanda Banking Trojan Matures into Enterprise Threat ToxicPanda, a banking Trojan, has evolved into a more sophisticated enterprise threat, expanding its reach beyond individual banking apps to compromise entire Android devices and potentially access corporate resources. T… Dark Reading · 6d ago High LAITPObankingmobileenterprise
threat-intel The Vulnerability Gap: Why Discovery Is Outrunning Repair The increasing speed of AI-powered vulnerability discovery is outpacing the ability of open-source software maintainers to address those vulnerabilities, creating a significant gap in the cybersecurity landscape. This is… Dark Reading · 6d ago High vulnerabilityaiopen-source
threat-intel WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords Two new malware families, WordlistLoader and SynkLoader, are being used to deliver the Amatera Stealer via ClickFix phishing campaigns. WordlistLoader reconstructs shellcode for Amatera, utilizing techniques to evade det… The Hacker News · 6d ago High phishingransomwaremalware
