Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Critical mySCADA Vulnerabilities Expose Global Industrial Control Systems to Attack
Critical vulnerabilities CVE-2026-73807 and CVE-2026-82567 were discovered in mySCADA myPRO Manager versions 2.1 and earlier, affecting industrial control systems worldwide. The first vulnerability (CVSS 9.8) allows unauthenticated attackers with network access to bypass authentication and access privileged management functions through the command API. The second vulnerability (CVSS 6.3) exposes an unauthenticated HTTP endpoint that enables attackers to send arbitrary SMS messages through connected GSM modems. These flaws impact critical infrastructure sectors including energy, manufacturing, transportation, and water systems globally. These vulnerabilities highlight the growing threat to industrial control systems as attackers increasingly target operational technology environments. With critical infrastructure under heightened scrutiny following recent nation-state campaigns, organizations must urgently address authentication gaps in SCADA systems that could enable devastating disruptions to essential services.
Apple's Record-Breaking Security Update: 261 Vulnerabilities Patched Across All Platforms
On September 14, 2024, Apple released comprehensive security updates across all operating systems, patching a record-breaking 261 vulnerabilities in iOS 27, macOS Golden Gate 27, and other platforms. The vulnerabilities spanned critical system components including kernel memory corruption, privilege escalation flaws, and sandbox escape vulnerabilities affecting core frameworks like WebKit, Kernel, CUPS, and SMB protocols. While Apple reported no active exploitation, the patches addressed severe security gaps including remote code execution, information disclosure, and authentication bypass vulnerabilities that could enable attackers to gain root privileges or access sensitive user data. This massive patch release reflects the evolving complexity of modern attack surfaces and Apple's proactive approach to security hardening. The scale of vulnerabilities demonstrates the critical importance of comprehensive endpoint security and zero-trust architectures as threat actors increasingly target foundational system components and inter-service communications.
Six Critical Vulnerabilities Expose Digital Watchdog Surveillance Systems to Complete Compromise
In September 2026, CISA disclosed six critical vulnerabilities in Digital Watchdog VMAX DVR and NVR surveillance systems affecting all product versions worldwide. The vulnerabilities include authentication bypass (CVE-2026-68953), hard-coded credentials (CVE-2026-66890, CVE-2026-68950), missing authentication for critical functions (CVE-2026-68070), missing authorization (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, allowing attackers to view surveillance footage, alter configurations, and use devices as network pivot points with root-level access. This disclosure highlights the growing security risks in IoT surveillance infrastructure, particularly as organizations increasingly deploy connected security devices without proper hardening. The vulnerabilities demonstrate classic IoT security failures that enable lateral movement within critical infrastructure networks.
BambooToken Malware Exploits MQTT Protocol in Global Multi-Platform Campaign
BambooToken is a sophisticated multi-platform malware campaign discovered in early 2026 that uses MQTT protocol for command and control across Windows and Linux systems. Active since February 2023, the threat actors exploit DLL sideloading techniques via Tendyron's OnKey authentication software to compromise organizations across Asia and South America. The malware demonstrates advanced evasion capabilities by leveraging legitimate PKI security tokens as attack vectors and using Cloudflare-proxied infrastructure to manage infections at scale. Researchers have identified compromised entities including mobile applications, financial organizations, hotels, and critical infrastructure systems across multiple countries. This incident highlights the evolving sophistication of threat actors who are increasingly adopting unconventional communication protocols and supply chain attack vectors to evade traditional security controls and maintain persistent access to high-value targets.
Machine-Speed Human Attack: CVE-2026-39987 Marimo Exploit Reaches SSH Bastion in 8 Seconds
In September 2026, skilled threat actors demonstrated machine-speed exploitation of CVE-2026-39987, a critical remote code execution vulnerability in Marimo notebooks with a CVSS score of 9.3. The attackers pivoted from initial compromise to SSH bastion host access in just eight seconds, using hand-crafted Python toolkits without AI assistance. Over a nine-hour session, they executed over 850 interactive commands, harvested AWS credentials from Secrets Manager, and established persistent access to cloud infrastructure, showcasing how human expertise can rival AI-assisted attacks in speed and stealth. This incident highlights the evolving threat landscape where skilled human operators are matching the speed traditionally expected from AI-powered attacks, while demonstrating superior evasion techniques that bypass automated defenses and detection systems designed to catch machine-generated attack patterns.
Yemen Threat Actors Exploit Claude AI for Advanced Weapons Development
In September 2026, Anthropic disclosed that threat actors based in northern Yemen exploited their Claude AI models to develop guidance, navigation, and control software for advanced weapons systems, including guided rockets, ballistic missiles with 2,000+ km range, and hypersonic glide vehicles. The actors used multiple Claude instances simultaneously, assigning specialized roles to each AI system while employing evasion techniques to bypass safety guardrails. Although Anthropic's safeguards blocked many requests, the actors successfully developed software and conducted field tests of a guided rocket, though initial tests failed. This incident represents a concerning escalation in AI-enabled weapons proliferation, demonstrating how generative AI can democratize sophisticated military engineering capabilities previously limited to nation-states and well-funded organizations.
Black Axe Cybercrime Leaders Extradited: International Crackdown on Romance Scam Network
Five alleged leaders of Black Axe's South African operations were extradited to the United States in December 2024 to face charges related to romance scams and advance fee fraud. The Nigerian nationals, including Cape Town zone founder Perry Osagiede, operated sophisticated financial fraud schemes from 2011-2021, using fake identities to manipulate victims into sending money through fabricated emergencies, business partnerships, and romantic relationships. The group leveraged business entities and compromised victim accounts to launder proceeds, with some cases involving extortion through threats to release sensitive photos. This extradition represents the latest phase of intensified global law enforcement action against Black Axe, a hierarchical cybercrime organization generating billions in annual criminal proceeds across dozens of countries. The coordinated international response demonstrates increasing capability to pursue transnational cybercriminals across jurisdictions and disrupt their financial networks.
Active GitLab CVE-2026-85706 Exploitation: CISA Issues Emergency Warning
In September 2026, CISA added GitLab vulnerability CVE-2026-85706 to its Known Exploited Vulnerabilities catalog after hackers began actively exploiting the maximum-severity path traversal flaw. The vulnerability stems from missing authentication enforcement in GitLab's repository commits API, allowing unauthenticated attackers to read credentials, secrets, and sensitive information through a single HTTP request. GitLab patched the flaw in versions 19.3.2, 19.2.6, and 19.1, but watchTowr security researchers detected widespread internet probing for vulnerable servers within 24 hours of the patch release. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, as threat actors increasingly weaponize DevSecOps platform vulnerabilities to access critical development infrastructure and secrets management systems used by Fortune 100 companies.
Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability
In September 2026, fintech giant Revolut disclosed a targeted social engineering attack where threat actors impersonated a government agency to fraudulently obtain sensitive customer data. The attackers used valid domain authentication credentials to request personally identifiable information via email, successfully deceiving Revolut into sharing financial records, passport copies, transaction histories, and account details of high-net-worth customers. The company immediately blocked the fraudulent address and notified relevant authorities upon discovering the deception, though the exact number of affected customers remains undisclosed. This incident highlights the growing sophistication of social engineering attacks targeting financial institutions and the critical need for enhanced verification protocols when handling government data requests, particularly as threat actors increasingly exploit trusted communication channels to bypass security controls.
How Malicious OAuth Applications Breach Google Workspace Environments
OAuth application abuse has emerged as a sophisticated attack vector targeting Google Workspace environments, bypassing traditional authentication controls through social engineering tactics. Attackers manipulate users into authorizing malicious OAuth applications, granting persistent access to organizational data without requiring password theft or exploitation of software vulnerabilities. These attacks exploit the trust relationship between users and legitimate-appearing applications, allowing threat actors to access sensitive information based on the permissions granted during the authorization process. The incidents demonstrate how attackers can achieve significant organizational compromise through user manipulation rather than technical exploitation. This attack method represents a growing trend in identity-focused threats as organizations increasingly adopt cloud-based collaboration platforms and third-party integrations, making OAuth abuse a critical concern for modern enterprise security.
Mass Campaign Exploits Vite CVE-2026-39364 to Steal Cloud Credentials
A mass-scanning campaign targeting internet-exposed Vite development servers exploited CVE-2026-39364, a high-severity vulnerability affecting Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Attackers used query parameter manipulation to bypass file access controls and steal AWS and Azure cloud credentials, configuration files, and environment variables. F5 detected over 800 attacks and 32,000 events within a month, with attackers primarily using Google Cloud IP ranges from the US, Belgium, and Netherlands for evasion. This campaign highlights the growing threat to exposed development environments and the critical need for proper configuration management and credential protection in cloud-native deployments.
How HBO Max's Hijacked Reddit Account Became a Malware Distribution Network
In September 2026, cybercriminals compromised HBO Max's verified Reddit account and launched 108 malicious advertisements over 48 hours, targeting both Windows and macOS users through ClickFix social engineering attacks. The campaign, linked to the broader PasteSwitch operation, tricked victims into executing malicious commands through legitimate system tools like PowerShell and Terminal, bypassing traditional security controls. The attacks distributed information stealers including MacSync and Amatera Stealer, cryptocurrency clippers, and fake wallet applications, demonstrating sophisticated multi-platform targeting capabilities. This incident represents a significant escalation in social media account takeover attacks, where threat actors exploit trusted brand verification to distribute malware at scale. The use of ClickFix techniques shows how attackers are evolving to bypass modern security tools by manipulating users into executing malicious code through legitimate operating system functions.