Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 411 advisories
Page 5 of 18
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware Important The Hacker News
2026-10-20 The Hacker News

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Important The Hacker News
2026-10-19 The Hacker News

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively calle…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor Important The Hacker News
2026-10-19 The Hacker News

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be trea…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Critical The Hacker News
2026-10-19 The Hacker News

⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories Important The Hacker News
2026-10-19 The Hacker News

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modu…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software Moderate The Hacker News
2026-10-19 The Hacker News

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software

In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic Important The Hacker News
2026-10-19 The Hacker News

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for ma…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Important The Hacker News
2026-10-19 The Hacker News

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi p…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys Critical The Hacker News
2026-10-19 The Hacker News

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team mem…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants Important The Hacker News
2026-10-18 The Hacker News

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon Important The Hacker News
2026-10-17 The Hacker News

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants Important The Hacker News
2026-10-17 The Hacker News

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service buil…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug Important The Hacker News
2026-10-16 The Hacker News

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor Important The Hacker News
2026-10-16 The Hacker News

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, an…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing Important The Hacker News
2026-10-16 The Hacker News

UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract Moderate The Hacker News
2026-10-16 The Hacker News

OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract

OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, invo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
AI Decision Models and Their Impact on AI SOC Platforms Moderate The Hacker News
2026-10-16 The Hacker News

AI Decision Models and Their Impact on AI SOC Platforms

In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can r…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers Critical CVE-2026-102764 The Hacker News
2026-10-16 The Hacker News

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging compone…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing Moderate The Hacker News
2026-10-16 The Hacker News

CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing

AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose mode…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions Important CVE-2025-61624 The Hacker News
2026-10-16 The Hacker News

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwit…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory Critical CVE-2026-99999 The Hacker News
2026-10-16 The Hacker News

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cl…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More Critical The Hacker News
2026-10-16 The Hacker News

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tool…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads Critical The Hacker News
2026-10-15 The Hacker News

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in t…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks Important The Hacker News
2026-10-15 The Hacker News

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
1 ... 3 4 5 6 7 ... 18
Notification