CyberWatch Newsroom Live Intel

Moderate Help Net Security

2026-09-24 Help Net Security

Apple’s new iOS 27 feature looks for signs you’re being scammed

Apple introduced a scam-prevention feature called Impersonation Risk Detection with iOS 27 and iPadOS 27. The feature allows supported apps to request a risk assessment when a user takes an action that could be connected to an active social engineering scam. “Impersonation Risk Detection helps protect against active social engineering scams. In these scams, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-24 Help Net Security

Claude.ai is about 3x faster after 3,000+ changes

Anthropic engineers made claude.ai and the Claude desktop app roughly three times faster during a two-week sprint in August, with Claude finding the bottlenecks and writing the fixes. The team merged more than 3,000 changes and says none of them caused a customer-facing incident or rollback. The engineers ran the whole thing out of one Slack channel, using a…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important The Hacker News

2026-09-24 The Hacker News

OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files

An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate The Hacker News

2026-09-24 The Hacker News

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate SANS Internet Storm Center

2026-09-24 SANS Internet Storm Center

One URL, Three Different Tricks, (Thu, Sep 24th)

Yesterday, we received a phishing email with an interesting link. At first sight, it looks like garbage, but every piece of it has been carefully crafted to confuse basic security controls. Here is the defanged link:

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Important SecurityAffairs

2026-09-24 SecurityAffairs

CLOSEDQUORUM, the malware that asks four AI models what to do next

Cisco Talos finds CLOSEDQUORUM, malware that lets four commercial AI models vote on its next move, with no human operator required. Cisco Talos found malware, dubbed CLOSEDQUORUM, that holds a vote before deciding what to steal from you. Four AI models vote on its next move, without any human interaction. CLOSEDQUORUM is the first Windows malware they’ve see…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical CVE-2026-87902 The Hacker News

2026-09-24 The Hacker News

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). "An unauthenticated attacker can make get_page_template() page-template resolution include…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate Help Net Security

2026-09-24 Help Net Security

What to do first when you get 90 days to secure AI agent data

In this interview with Help Net Security, Kelly Herrell, CEO at Nol8, explains where AI agents create exposure inside organizations. The first thing to examine is the data path: what an agent can reach, what enters its context, and where results go. Ticketing systems, CRM platforms and shared drives hold years of sensitive context that agents can pull togeth…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-24 Help Net Security

Your security program knows about the firewall, but does it know about the elevator?

By early August, attackers had hit water systems in at least seven U.S. states. The FBI and EPA said the intruders remotely accessed internet-facing programmable logic controllers, the small industrial computers that run pumps and valves. Operators lost monitoring or control, and in some cases water operations degraded. Federal investigators are examining po…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-24 Help Net Security

Ubuntu kernel CVE fixes are moving to a weekly release schedule

Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRUs) and its two-week cycle for security fixes into a single two-week cycle. The cycles overlap, each starting a week after the one before, which is what produces a weekly release. Admins who need a kernel…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-24 Help Net Security

Europe’s technology backbone is becoming a cyber target

Disruptive attacks on public-facing services, financially motivated cybercrime and compromises of shared technology providers are increasing cybersecurity risks across Europe. ENISA’s Threat Landscape 2026 identifies cybercrime, state-linked activity, foreign information manipulation and interference, hacktivism and vulnerability exploitation as key threats.…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate SANS Internet Storm Center

2026-09-24 SANS Internet Storm Center

ISC Stormcast For Thursday, September 24th, 2026 https://isc.sans.edu/podcastdetail/10108, (Thu, Sep 24th)

Latest threat intelligence analysis from SANS Internet Storm Center: ISC Stormcast For Thursday, September 24th, 2026 https://isc.sans.edu/podcastdetail/10108, (Thu, Sep 24th).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Moderate Graham Cluley Security

2026-09-23 Graham Cluley Security

Smashing Security podcast #486: Vibe-coded shops, and hackable Flock cameras

A store in Auckland vibe-coded itself a new website. Within hours, its inventory had somehow expanded to include a pair of crusty socks, an $850 banana, and all of New Zealand's national parks. What could possibly have gone wrong? Meanwhile, a hacker collective backed a truck into one of the license-plate-reading Flock safety cameras popping up on American s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Important BleepingComputer

2026-09-23 BleepingComputer

Placeholder domain used in dev docs now serves ClickFix attacks

The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate Dark Reading

2026-09-23 Dark Reading

SASE Converges Network & Security Into One Cloud Solution

Enterprise computing is moving to the edge. Keeping it secure requires tactics far beyond putting up firewalls. (Second in a three-part series.)

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Moderate Help Net Security

2026-09-23 Help Net Security

Americans’ views on data centers have turned more negative

American attitudes toward data centers have turned noticeably more negative over the course of 2026, according to a new Pew Research Center survey. 54% of U.S. adults now say data centers are mostly bad for the environment, up from 39% in January. Half say they hurt home energy costs (up from 38%), and 49% say they harm quality of life for people living near…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important BleepingComputer

2026-09-23 BleepingComputer

New RemControl Android banking malware targets users in Europe and Canada

A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate Dark Reading

2026-09-23 Dark Reading

EDR Evasion Stack Helps Process Injection Slip Past Defenses

A process parameter-poisoning technique evades EDR by injecting code into process initialization structures without using the Windows APIs that EDR tools typically watch out for.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Important Dark Reading

2026-09-23 Dark Reading

GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks

Incoming email addresses automatically assigned to each user on the platform contain highly privileged access tokens that attackers can use.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Important CVE-2026-85102 SecurityAffairs

2026-09-23 SecurityAffairs

U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2026-85102 Check P…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate The Record by Recorded Future

2026-09-23 The Record by Recorded Future

UK regulator to investigate Pornhub parent company for alleged age verification failings

In May, Pornhub began using a new age assurance process to verify some users’ ages, according to an Ofcom press release. The new method relies on signals from Apple that suggest under 18s in the UK “may have completed Apple’s age checks,” the press release said.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical CVE-2026-85102 BleepingComputer

2026-09-23 BleepingComputer

Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate The Record by Recorded Future

2026-09-23 The Record by Recorded Future

No evidence of successful foreign meddling in 2024 election, spy agencies found

U.S. intelligence officials found no evidence that any foreign adversary successfully interfered in the 2024 presidential election, according to sources familiar with the findings of a classified assessment.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Moderate CVE-2024-0244 Trend Micro ZDI

2026-09-23 Trend Micro ZDI

CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer

With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the Canon MF753Cdw printer featured in Pwn2Own Toronto 2023. This blog post gives an ove…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Zero Day Vulnerabilities

Advisory