1. ShinyHunters is conducting a renewed mass exploitation campaign targeting Oracle PeopleSoft via CVE-2026-35273 across multiple global sectors (https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/).
2. Suspected North Korean threat actors compromised Bitget cryptocurrency exchange, resulting in the theft of 351.6 million dollars from hot and warm wallets (https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html).
3. Roundcube Webmail is under active exploitation due to a pre-authentication SQL injection vulnerability tracked as CVE-2026-48842 (https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html).
4. Kiteworks has urged customers to perform a six-hour server shutdown to mitigate potential zero-day attacks (https://www.bleepingcomputer.com/news/security/kiteworks-urges-6-hour-server-shutdown-over-potential-zero-day-attacks/).
5. The Clop ransomware leak site was compromised and defaced by ShinyHunters using an unauthenticated path traversal flaw in Grav CMS (https://www.bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/).
6. CISA issued a warning regarding active exploitation of vulnerabilities in SharePoint, Adobe Commerce, and a critical authentication bypass in WSO2 products (https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/).
7. WordPress attackers are actively exploiting CVE-2026-87902 within hours of its public disclosure (https://www.reddit.com/r/cybersecurity/comments/1woyw5u/attackers_exploit_wordpress_cve202687902_within/).
8. A CSRF vulnerability in the Elementor WordPress plugin allows unauthenticated attackers to create unauthorized administrator accounts (https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/).
9. Compromised GitHub Actions from the actions-cool repository were reactivated to resume execution of the Mini Shai-Hulud malware (https://thehackernews.com/2026/09/compromised-github-actions-came-back.html).
10. The PamStealer macOS malware has been updated to include live C2 payload decryption and enhanced multi-layer persistence mechanisms (https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html).
11. Microsoft successfully took down over 200 sites and domains used by hackers who utilized AI to select victims from stolen email databases (https://www.reddit.com/r/cybersecurity/comments/1wpaorq/hackers_used_ai_to_pick_victims_from_stolen/).
12. A proof of concept named LocalStranger demonstrates privilege escalation to NT AUTHORITY by exploiting a vulnerable Microsoft Windows Hardware Compatibility Publisher signed driver (https://www.reddit.com/r/cybersecurity/comments/1wqm4ig/localstranger_is_a_poc_for_vulnerable_microsoft/).
13. Atlassian Rovo is affected by a critical cross-user and cross-tenant compromise vulnerability (https://www.reddit.com/r/cybersecurity/comments/1wpc02r/critical_crossuser_and_crosstenant_compromise_in/).
14. The FBI is investigating claims that hackers have stolen sensitive personnel records belonging to its agents (https://www.reddit.com/r/cybersecurity/comments/1wp77qb/fbi_investigating_claim_hackers_have_stolen/).
Be First to Comment