> TODAY'S SUMMARY (130 articles)
Today's cyber news highlights several significant threats and trends. The largest cryptocurrency heist in history occurred as North Korean hackers stole approximately $6.3 billion from Binance by exploiting a compromised DevOps laptop. In retail, fashion retailer Resolve reported the theft of customer payment card information due to a security breach. Additionally, a malicious update to the Claude Code extension for VS Code was found to have installed persistent SSH backdoors on developers' machines. Exploits targeting critical vulnerabilities in Drupal and GitLab are actively being leveraged by attackers, raising concerns about web security. Lastly, hackers published sensitive data of over 41,000 DHS employees, emphasizing the ongoing risks to government cybersecurity.
|
// AI-powered summary generated at 20:00
Researchers disclosed the cross-account trick the same day rogue agents exploited another zero-day for admin access
Malone Lam was indicted on scamming charges in September 2024 after drawing law enforcement scrutiny for parlaying stolen crypto into lavish Hamptons vacations, cars and private jets.
A joint advisory alleges Chinese companies are using sophisticated systems to route millions of data requests to US AI models across different accounts and platforms.
The post Feds accuse China of ‘systematic’ distillation of U.S. AI models appeared first on CyberScoop.
Crypto exchange network Liquid Network lost $320 million overnight, then got most of it back after the hackers demanded a bug fix instead of a ransom Bitcoin’s Liquid Network, a sidechain built by Blockstream and used by dozens of exchanges to move funds faster and more privately than the main Bitco...
A massive operation dubbed "DoppelCart" uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. [...]
Authorities accuse the 36-year-old and co-conspirators of collecting more than 5,000 victim login credentials to various banks.
The post Russian national extradited to US for alleged involvement in bank-account takeover scheme appeared first on CyberScoop.
Qi Wang and Jianjun Chen discovered that FORT validator, a RPKI validation service, performed incomplete validation of RRDP notifications, which could result in denial of service via cache poisoning. For additional details please refer to the upstream advisory at
The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be critical to meeting th...
Designed to compete with OpenClaw and Instinct, the company says Muse can do everything from sell your car to book you a plane ticket.
A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]
The deputy director cited Operation Absolute Resolve as evidence that cyber teams have become central to CIA missions.
The post CIA’s Michael Ellis says cyber intelligence is changing how the agency operates appeared first on CyberScoop.
A "flawless" performance by the CIA's Cyber Mission Center contributed to the capture of Venezuelan President Nicolás Maduro in January, agency Deputy Director Michael Ellis says.
A Russian web developer who played a role in a multimillion-dollar bank account takeover scheme has been extradited to the U.S. to face an indictment.
This month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 set in July 2026. Two vulnerabilities are listed as exploited in the wild, while none were publicly d...
The record-breaking September security update fixes two exploited privilege-escalation zero-days and 20 potentially wormable vulnerabilities.
The post Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days appeared first on SecurityWeek.
EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new Medicare program that uses AI to evaluate prior authorization requests for certain medical services. Today, we’re releasing approximately 1,000 pages of records obtained...
An buffer overflow was discovered in the OPUS audio decoder of the GStreamer media framework, which may result in denial of service or potentially the execution of arbitrary code if a malformed audio file is processed. For the stable distribution (trixie), this problem has been fixed in
On August 26, the State Department labeled A/I an “extremist group” operating infrastructure for “far-left militants across the world” and announced that anyone engaging with the group financially risked exposure to sanctions.
Microsoft has released the Windows 10 KB5122878 extended security update, which includes this month's record-breaking September 2026 Patch Tuesday fixes, along with a few bug fixes. [...]
Tracked as CVE-2026-75650, the exploited defect allows unauthenticated attackers to execute arbitrary code.
The post Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day appeared first on SecurityWeek.