ls ./category/security
Breaches, vulnerabilities, malware and the patches that matter.
Revolut handed passports, verification selfies and full transaction histories for a limited number of customers to someone writing from a genuine government agency email domain. SPF, DKIM and DMARC all passed, correctly. Those checks confirm which domain sent a message. They say nothing about whether the sender has any right to ask.
Microsoft says extortion groups tied to ShinyHunters and Helix are phoning staff about urgent passkey or single sign-on updates, then steering them into relayed sign-ins or device-code approvals. Once in, they register an MFA method of their own, map the tenant through Microsoft Graph and take files at under 1,000 an hour to stay unremarkable.
Gen Threat Labs traced a China-linked intrusion to Sogou Input Method, where one click could open an embedded Chromium 80 engine running with its sandbox and same-origin policy switched off. The group used a 2021 Chrome exploit to install the GRAYRABBIT backdoor. Tencent closed the entry point in 12 days, but Gen says the browser component was not changed.
Phishing that reached 347,000 Trezor newsletter subscribers came from Trezor's genuine Brevo account, so it passed every sender check. Brevo's post-mortem says the attacker created an account, switched on single sign-on, invited real Brevo users into it, and was then let into every organisation those users could reach. Early coverage spoke of stolen login details. Brevo's account involves none.
The six RouterOS vulnerabilities behind the MikroTrick chain came out of an agent-driven laboratory running two OpenAI models. The technique that worked was modelling protocols as state machines and breaking the order of the steps, which is exactly the shape of the bugs. Meanwhile CISA's catalogue lists two of the six, and one of them is not in the chain.
CVE-2026-85706 scores a perfect 10: no authentication, low complexity, arbitrary file read through GitLab's repository commits API. GitLab patched on 10 September. watchTowr saw exploitation attempts the next day, and CISA gave federal agencies until 14 September.
CISA gave agencies until 12 September to deal with exploited flaws in Cisco's firewall manager, Citrix NetScaler and FortiOS. Talos's research shows the Qilin-linked cluster ignored the CVSS 10.0 bypass and used a hard-coded password flaw CISA had listed in July — and the federal instruction for all of it starts with evidence, not the patch.
Group-IB found GoldFactory's Gigabud trojan using a Shelter fork called Vwork to create an Android work profile and clone a banking app into it. The bank's malware check had already fired in the personal profile. The fraudulent transfer came from the other side of the wall, looking like a clean new device.
CVE-2026-85102 and CVE-2026-85103 both sit in VPN certificate handling on Check Point gateways and management servers, and both run before authentication. Check Point found them itself and has seen no exploitation. The end-of-support releases it lists as affected get no fix at all.
GreyNoise watched a likely Russian-speaking operator point hundreds of AI agents at PaperCut and compromise 440 instances across 395 organisations. The operator's exclusion list held only partly: 18 victims sit in countries the agents were told to skip, every one of them from the back half of the list.
A 7GB infostealer dump from 5,871 machines across 162 countries held 44,791 unique JSON web tokens, 555 of them for AI services. A replayed token logs an attacker in without logging in — no password, no second factor. The MFA worked. It was never in the path.
Proofpoint disclosed BlueMoon on 9 September: a kit chaining a Chrome V8 flaw, a sandbox escape with no CVE at all, and a Windows ALPC bug. APT31 used it first on 28 August. Three more espionage clusters were running it within days. The chain is not the story. The distribution is.
Researchers scanned 3,074 internet-facing LiteLLM instances and found 9.6 percent accepted the master key printed in the project's own quickstart, or required no authentication at all. Nothing here is a vulnerability. It is a placeholder that nobody replaced.
iPhone Duo is Apple's first foldable: 7.6 inches unfolded, 5.2 mm thick, 1,999 dollars. It has Touch ID in the side button and no Face ID anywhere. By Apple's own published figures that is a twenty-fold larger chance a stranger can open it — and the reason is not cost, it is what fits under a folding panel.
Apple's US page gives iPhone 18 Pro Max 45 hours of video playback. Its UK page gives the same phone 43. Same 8.75 mm chassis, same 249 grams — the difference is the SIM tray, and Apple says so in a footnote while marketing the larger number.
McKesson's 8-K describes roughly one terabyte exfiltrated between 21 and 25 August 2026, detected on the last day. The chain was vishing to Okta SSO to Salesforce and Snowflake — no CVE, no exploit, no patch. And the claimed 284 million records are database rows, by the attackers' own account.
Calif disclosed a memory corruption flaw in WeChat's VoIP stack on iOS and Android that runs during the ringing phase, before the victim accepts or declines. The one precondition — the attacker must be in the friend list — is not a limit on spread. It is the mechanism of spread.
CVE-2026-82533 lets any local process turn off DeepSeek Harness's file sandbox and approval prompts with three POST requests. The check in the way read the Host header, which the caller supplies. Browsers will not forge it. A coding agent running inside the sandbox is not a browser.
CVE-2026-67401 affects every supported version of cPanel and WHM, and lets an authenticated account holder with mail privileges reach root. There is no CVSS score, no explanation of how SQL injection becomes file creation becomes root, no detail on which privilege is required, and no workaround.
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.
Sophos documented malware that infects the Apache binary on F5 BIG-IP APM, hooks the runtime as PHP loads, and writes a web shell into memory in front of three real scripts. File integrity checks pass. The entry point, CVE-2025-53521, was published as a DoS in October 2025 and reclassified as unauthenticated RCE five months later.
ShieldBreak was CVE-2026-69414 in Defender's Malware Protection Engine, patched in engine 1.1.26080.3. Chaotic Eclipse has released ShieldCrash, a proof of concept that reaches the same bug through a path the fix did not close, giving arbitrary file read as SYSTEM on every supported Windows desktop.
CVE-2026-44756 is a CVSS 10.0 memory corruption bug in the SAP kernel's Extended Passport handling, reachable with a single malformed header. Onapsis puts the consequence plainly: SAP authorizations and Segregation of Duties will not help, because the vulnerable code runs before any authentication step.
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.