CyberWatch Newsroom Live Intel

Critical CVE-2026-87902 SecurityAffairs

2026-09-23 SecurityAffairs

CVE-2026-87902: how close is your WordPress to remote code execution?

WordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution. WordPress 7.1.2 shipped on September 22 address an unauthenticated local file inclusion, tracked as CVE-2026-87902 (CVSS score of 9.2), which stems of how the CMS resolves page templates, with a real path to remote code …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical CVE-2026-93616 SecurityAffairs

2026-09-22 SecurityAffairs

Check Point Fixes a New Actively Exploited Critical Security Flaw

Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. Attackers can abuse the flaw without logging in to upload malicious scripts and exe…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical SecurityAffairs

2026-09-22 SecurityAffairs

Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day

The researcher Chaotic Eclipse released BigDiskBuster, a PoC exploit for a Windows Defender Update DoS Zero-Day vulnerability. Security researcher Chaotic Eclipse , also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender. The researcher named the exploit BigDiskBuster, it triggers a De…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical CVE-2026-32996 SecurityAffairs

2026-09-22 SecurityAffairs

Public PoC Exposes Critical Veeam Agent Privilege Escalation

A Veeam Agent flaw lets local users gain SYSTEM privileges. A public PoC is available, raising the risk of exploitation on shared Windows systems. If you’re running Veeam Agent on a Windows endpoint with more than one local user, now’s the time to check the version, not tomorrow. On September 14, 2026, public technical details and a proof-of-concept exploit …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important CVE-2026-7273 SecurityAffairs

2026-09-22 SecurityAffairs

U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zyxel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Zyxel GS1900 Series Switches flaw, tracked as CVE-2026-7273 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog . The flaw is a stack-based …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-22 SecurityAffairs

Contagious Interview: 30,000 devices infected by a fake job interview

North Korea-linked WaterPlum runs the Contagious Interview campaign, infecting over 30,000 devices using a fake job interview. On September 18, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-21 SecurityAffairs

Google Fined €403 Million Over Location Data Practices

Ireland’s DPC fined Google €403 million over GDPR violations involving location data, transparency, retention and user control. Ireland’s Data Protection Commission (DPC) just fined Google €403 million, and the case behind it goes back six years, to a set of complaints that never really went away. The DPC launched the investigation in February 2020 after rec…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important SecurityAffairs

2026-09-21 SecurityAffairs

Foreign Hackers Target Two Colorado Water Utilities

Hackers targeted two Colorado water utilities, changing OT settings and disabling alarms, but causing no impact on water services or safety. Foreign hackers targeted the operational technology (OT) systems of two small private water utilities in Colorado in late August, apparently trying to disrupt operations. Local authorities haven’t identified the affecte…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-21 SecurityAffairs

ChainScript: the RAT that hides its command server inside a blockchain contract

Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server. Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-21 SecurityAffairs

A BYD Shark 6 Hack Shows the Risks of Connected Cars

A BYD Shark 6 was remotely hacked, exposing vehicle controls, location tracking and cabin audio, raising serious connected-car security concerns. A journalist drove a BYD Shark 6 down a country road outside Canberra while a hacker sitting on the shoulder killed the headlights with a keystroke. That’s not a hypothetical. It’s what happened during a two week t…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate CVE-2025-32711 SecurityAffairs

2026-09-21 SecurityAffairs

The Target Is No Longer the Model. It’s the Agent.

AI agents are becoming the new attack surface, exposed to poisoned skills, prompt injection, jailbreaks and attacks through connected tools. I read the AI security research published in a single month, February 2026, and when you put it all together, it’s not a list of curiosities. It’s a field guide to a new attack surface. In my previous piece, I explained…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-21 SecurityAffairs

UK Police Data Faces Long-Standing Microsoft Cloud Security Concerns

A 2017 UK assessment warned that police data on Microsoft Azure could face foreign access risks. The risks may still exist. A Guardian investigation has surfaced a 2017 document signed off by then City of London police commissioner Ian Dyson, who also held the title of senior information risk owner for the entire country. That document reviewed 15 risks tied…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important CVE-2025-39682 SecurityAffairs

2026-09-20 SecurityAffairs

U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [ 1 , 2 ] the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2025-39682 – Linux Kernel Improper Check for Unusual or E…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-20 SecurityAffairs

AI Hallucinations Nearly Triggered a US-China Military Confrontation

An AI-generated intelligence report falsely identified weapons on a Chinese ship, nearly triggering a US military operation during the Iran war. According to CNN, four sources familiar with the episode say an intelligence report circulated through the military claiming a Chinese vessel in the Middle East was carrying components for a nuclear weapons program.…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important SecurityAffairs

2026-09-20 SecurityAffairs

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 115

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Gray Rabbits and the Tale of a One-Click Backdoor Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Toke…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate CVE-2026-91843 SecurityAffairs

2026-09-20 SecurityAffairs

Security Affairs newsletter Round 595 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Google Gemini also Broke Out of Its Test Environment AI Helps Hackers Hijack OpenAI Staff Accounts Through a Foru…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-19 SecurityAffairs

Google Gemini also Broke Out of Its Test Environment

Google Gemini escaped a cyber test environment, reached three real companies, and exposed why AI security tests need strict isolation. Google has confirmed that one of its Gemini models broke into the systems of three real companies during a cybersecurity test in May. The incident is the first publicly known case in which a Google AI system escaped its test …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important SecurityAffairs

2026-09-19 SecurityAffairs

AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum

AI helped researchers exploit a Discourse flaw in under 72 hours, hijacking OpenAI staff accounts and exposing the risks of shared SSO. Three researchers at Hacktron just took over ChatGPT and Codex accounts belonging to OpenAI staff. The attack did not rely on phishing techniques or a leaked password. Through an image upload on OpenAI’s own help forum. The …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important SecurityAffairs

2026-09-18 SecurityAffairs

Brevo Supply-Chain Attack Infected Over 100,000 Websites

A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites. Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin. The company was first compromised on September 10, when att…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical SecurityAffairs

2026-09-18 SecurityAffairs

Gyazo Data Breach Exposes 23 Million User Records

A Gyazo breach exposed 23 million user records after attackers exploited a vulnerability in Helpfeel’s image upload server. Japanese software company Helpfeel is notifying Gyazo users about a data breach that compromised 23 million user records. Attackers gained unauthorized access by exploiting a vulnerability in the service’s image upload server. “We have …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important SecurityAffairs

2026-09-18 SecurityAffairs

RatHat Turns Android Accessibility Into an Attack Weapon

RatHat combines AI-driven screen control, Android debugging abuse and advanced credential theft to give attackers deep control of infected phones. RatHat is the new Android trojan you should know about. Zimperium researchers just published a breakdown of a strain they’ve traced to China-based operators, and what makes it different isn’t the credential theft,…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical CVE-2026-91843 SecurityAffairs

2026-09-18 SecurityAffairs

Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution

Check Point fixed CVE-2026-91843, a critical flaw that could let attackers run code as root on Security Management and Log Servers with no login needed. Check Point addressed CVE-2026-91843 (CVSS score of 9.8), a critical vulnerability in its Security Management and Log Servers. The flaw could let an attacker with no account run code as root over the network…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate SecurityAffairs

2026-09-17 SecurityAffairs

OpenAI admits its models lie to cover their own mistakes

OpenAI launches a formal framework to disclose model misalignment, publishing six reports on models that lied, faked data, or bypassed rules. Most companies don’t publish a document explaining how their product misbehaves. OpenAI just did. On September 16, it released a formal framework for tracking, investigating, and disclosing cases of model misalignment,…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical SecurityAffairs

2026-09-17 SecurityAffairs

Cyberattacks on Oil Tankers Put Maritime Critical Infrastructure at Risk

Cyberattacks on oil tankers show how connected ships can expose navigation and critical systems, threatening safety, ports and global trade. U.S. Coast Guard personnel and FBI agents boarded two Texas‑bound energy tankers last month after cyberattacks hit the vessels while they were underway, according to U.S. officials. One of the ships was the VL Prosperit…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory