Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 2,629 advisories
Page 69 of 110
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware Important The Hacker News
2026-09-25 The Hacker News

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer Moderate SecurityAffairs
2026-09-25 SecurityAffairs

ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer

Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials. Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Crime & Data Breaches
Advisory
PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence Important The Hacker News
2026-09-25 The Hacker News

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embed…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Agents can now set up your website’s security with Turnstile Spin Moderate Cloudflare Security
2026-09-25 Cloudflare Security

Agents can now set up your website’s security with Turnstile Spin

In 2023, Cloudflare declared itself free from CAPTCHAs with the launch of Turnstile, our privacy-first client-side challenge. Turnstile is free to use, works on any site (no need to proxy traffic through Cloudflare), and never asks a visitor to solve a puzzle. Now, we are launching Turnstile Spin, an agent-mediated end-to-end implementation of Turnstile. Ini…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
DDoS, Botnets & Edge Security
Advisory
Criminals turn placeholder domain into ClickFix trap Moderate Malwarebytes Labs
2026-09-25 Malwarebytes Labs

Criminals turn placeholder domain into ClickFix trap

A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com . Another, third-party[.]com , has often been used in documentation to represent an external…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Malware Outbreaks & Analysis
Advisory
Microsoft plans to deprecate Windows Deployment Services Moderate BleepingComputer
2026-09-25 BleepingComputer

Microsoft plans to deprecate Windows Deployment Services

Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role starting with the next Windows Server release. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
CISA Unveils Election Security Plan Ahead of 2026 Midterms Moderate Infosecurity Magazine
2026-09-25 Infosecurity Magazine

CISA Unveils Election Security Plan Ahead of 2026 Midterms

The CISA plan provides guidance and resources for election officials to secure systems such as voter registration databases and voting machines

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Global Cybersecurity News
Advisory
Threat detection dashboards are masking security coverage gaps Moderate Help Net Security
2026-09-25 Help Net Security

Threat detection dashboards are masking security coverage gaps

A detection rule can show up as deployed on a coverage dashboard and still never fire when an attacker uses the technique it was built to catch. Conifers assessed 14,652 detections in its customer base, including rules written by customers and detections managed by vendors in SIEM, endpoint, cloud, identity, email and network tools. The research found that 4…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Doubts grow over claims OpenAI agent hacked Australian Medicare portal Moderate The Record by Recorded Future
2026-09-25 The Record by Recorded Future

Doubts grow over claims OpenAI agent hacked Australian Medicare portal

Researchers are questioning whether an OpenAI agent needed to hack an Australian government health portal to access it, after a review of the website’s archived code found it explicitly directed visitors to an unauthenticated endpoint.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
State-Sponsored Cyber Warfare
Advisory
Rydox marketplace admin pleads guilty, faces 22 years in prison Moderate BleepingComputer
2026-09-25 BleepingComputer

Rydox marketplace admin pleads guilty, faces 22 years in prison

A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
The SOC Doesn't Need to Start Over with Every Alert Important The Hacker News
2026-09-25 The Hacker News

The SOC Doesn't Need to Start Over with Every Alert

Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead end used to cost h…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise Important The Hacker News
2026-09-25 The Hacker News

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," Bitget said in a post shared on X. "Bitget's cold wallets and the overwhelming majority …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Microsoft: Recent Windows updates cause desktop loading issues Moderate BleepingComputer
2026-09-25 BleepingComputer

Microsoft: Recent Windows updates cause desktop loading issues

Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild Critical CVE-2026-48842 The Hacker News
2026-09-25 The Hacker News

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue ste…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway Important SecurityAffairs
2026-09-25 SecurityAffairs

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution. CARBONATO is a Docker-based botnet that has been active since at least October 2024. ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet. The registry conta…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Crime & Data Breaches
Advisory
That shipping rebate offer may come with a monthly charge Moderate Malwarebytes Labs
2026-09-25 Malwarebytes Labs

That shipping rebate offer may come with a monthly charge

Thanks to Malwarebytes research engineer Stefan Dasic for his help with this article. A name like ShipmentsFree suggests a way to save on shipping. The service does offer shipping rebates, but its Better Business Bureau (BBB) complaint r ecord shows that some customers did not realize they had also signed up for recurring charges. We found a number of very s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Malware Outbreaks & Analysis
Advisory
MacSync info-stealing malware hides malicious commands in an iCloud calendar Important Help Net Security
2026-09-25 Help Net Security

MacSync info-stealing malware hides malicious commands in an iCloud calendar

A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky. Researchers found the malware spreading through a crypto wallet app called Toria, which had its own website and was promoted on X and Telegram. MacSync is a family of Mac malware that emerge…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Hackers steal $351.6 million in Bitget crypto exchange hack Important BleepingComputer
2026-09-25 BleepingComputer

Hackers steal $351.6 million in Bitget crypto exchange hack

​Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog Important CVE-2026-5430 SecurityAffairs
2026-09-25 SecurityAffairs

U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Crime & Data Breaches
Advisory
1 ... 67 68 69 70 71 ... 110
Notification