News

[Virtual Event] Cybersecurity Outlook 2027

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this addre

Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. [...]

MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2

UAE, Saudi Arabia Face Onslaught of Increasingly Complex Cyberattacks

The United Arab Emirates and Kingdom of Saudi Arabia together absorbed 50% of all cyberattacks recorded across the Gulf region in the first half of 2026.

Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign

Threat actors are poisoning ChatGPT, Gemini, and Google AI Overview answers by seeding the Web with malicious links and data and then optimizing the content.

InfraTrust report warns network management systems under attack

Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. [...]

This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not

How One Kubernetes YAML Can Hand Over a GCP Organization

A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeD

Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments. [...]

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account h

545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent

Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good. Point one at a realistic target and what comes back is a report the agent wrote about itself: confident prose, a list of findings, and no way to tell which of them happened. So

Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests

Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a "major step up from Opus 5," and "achieves the best scor

Microsoft: September Windows updates break Always On VPN connections

Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems. [...]

Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, bu

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome

Ryuk ransomware member sentenced to 24 months in prison

An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. [...]

F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks

F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. [...]

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the r

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants

The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency. "We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents

Rogue external MFA providers can steal passwords during logins

Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts. [...]

Sweden fines Miljödata $183,000 over breach affecting 2.2 million

Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people. [...]

Relays Are Masking Chinese Access to Frontier AI Models in the US

More than 80,000 AI relay servers are helping users in China mask their identities while they access cutting-edge large language models (LLMs), probably to clone them.

How the CISO-CMO Alliance Builds Trust Before Crisis Strikes

Cybersecurity and brand reputation are inextricably linked. Security and marketing leaders who establish regular touchpoints, develop joint crisis communications plans, and translate security risks into their brand impact position their organizations to significantly outperform t

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]

Microsoft Disrupts EvilTokens Device Code Phishing Service

Microsoft seized 50 websites and disabled more than 150 domains as part of a coordinated disruption effort against a phishing-as-a-service platform targeting Microsoft 365 accounts.

Deception by Design: CISA's Guide to Tricking Cybercriminals

The Cybersecurity and Infrastructure Security Agency (CISA) is going old school to help organizations with limited resources set traps for hackers.

Work on BP Highway upgrading to be suspended amid heavy rain forecast

Kathmandu, September 23 The government is preparing to suspend ongoing upgrading work on the BP Highway for a few days in view of the forecast of heavy rainfall across various parts of the country. Minister for Infrastructure Development Sunil Lamsal said preparations were underw

Flydubai begins commercial flights from Pokhara International Airport

Pokhara, September 23 Flydubai has started commercial flights from Pokhara Regional International Airport, with its first flight arriving from Dubai on Wednesday carrying 113 passengers. The Flydubai aircraft landed at the airport with 113 passengers on board. It is scheduled to

Daily Digest: The biggest stories, developments and updates of the day

Kathmandu, September 23 There is a lot happening every day. The Daily Digest brings together some of the most important stories and developments in one place—from Nepal’s latest affairs to international news, business, sports and stories that deserve a closer look. Nepal’s public

Manaslu season ends without a summit as bad weather forces climbers to turn back

Kathmandu, September 22 Climbers who arrived in the Himalayas with dreams of standing atop Mount Manaslu have returned without reaching the summit this autumn, after persistent snowfall, strong winds and growing avalanche risks made further attempts increasingly dangerous. With w

Madhesh government begins printing and distributing driving licences itself

Janakpur, September 23 The Madhesh provincial government has started printing and distributing driving licences on its own, aiming to reduce the long waiting time faced by service recipients. The Ministry of Labour and Transport of Madhesh printed 3,081 driving licences in its fi

Bodies of 2 climbers brought to Kathmandu

Gorkha, September 23 The bodies of two people who died after being buried in an avalanche at the base of Mt Manaslu have been brought to Kathmandu. The District Police Office in Gorkha said the bodies were airlifted from Chumunubri-1 in Samagaun to Kathmandu by helicopter on Wedn

Tourism Department issues advisory for trekkers, mountaineers as heavy rain forecast

Kathmandu, September 23 The Department of Tourism has issued a safety advisory for trekkers, mountaineers and support staff amid forecasts of heavy rainfall across Nepal later this week. The department issued the advisory on Wednesday, urging climbers and trekkers who have alread

Government steps up preparedness for heavy rainfall, puts security forces on high alert

Kathmandu, September 23 The government has stepped up preparations to deal with the risks of floods and landslides that could result from possible heavy rainfall, with plans to continuously monitor river conditions and potential disasters and provide the public with hourly update

Brokerages step up margin lending as 11 firms begin offering the service

Kathmandu, September 23 Brokerage companies in Nepal have started expanding margin lending services, allowing investors to purchase shares by contributing part of the required amount and borrowing the rest from their brokers. According to the Nepal Stock Exchange (NEPSE), 11 brok

Alternative energy being explored to ensure smooth winter power supply: NEA Managing Director Shrestha

Kathmandu, September 23 Newly appointed Nepal Electricity Authority Managing Director Dirghayukumar Shrestha has said that alternative energy sources are being explored to ensure a smooth electricity supply during the winter season. Assuming office at the authority’s Darbar Marg

PM Shah urges public to avoid unnecessary travel as heavy rain forecast

Kathmandu, September 23 Prime Minister Balendra Shah has urged the public to remain alert as heavy to extremely heavy rainfall is forecast across several parts of Nepal from Friday to Sunday. Shah, who is currently in New York to attend the 81st session of the United Nations Gene

Government moves to allocate 2% hydropower IPOs to serving security personnel

Kathmandu, September 23 The government has initiated the process to allow serving security personnel to participate in initial public offerings (IPOs) of hydropower projects. Speaking at the House of Representatives meeting on Wednesday, Minister for Energy, Water Resources and I

Free education up to Bachelor’s level for Gen-Z Movement martyrs’ families and injured

Kathmandu, September 23 The government has decided to provide free education up to the bachelor’s level to the families of martyrs of the Gen-Z movement and those who were seriously or critically injured. According to the Guidelines for Providing Free Education to Families

After Nepal’s Bhotekoshi flood, who pays for the damage?

On 26 August 2026, when a colossal wedge of bedrock and glacial ice broke free from the northern flank of Mount Langtang Lirung at precisely 28.288°N, 85.528°E into Lhende Khola, it triggered devastating floods across Nepal, destroying villages, fertile land, bridges, roads, and

RPP provincial convention on October 7

Kathmandu, September 23 The Rastriya Prajatantra Party (RPP) will hold its provincial conventions on October 7. According to party spokesperson Mohan Kumar Shrestha, who also heads the party’s Publicity Department, conventions in all seven provinces have been scheduled for

Santosh Shrestha appointed chairperson of Advertising Board

Kathmandu, September 23 The government has appointed Santosh Shrestha as chairperson of the Advertising Board. Shrestha, a resident of Kathmandu Metropolitan City-14, has been appointed chairperson of the board for a maximum term of four years, according to a Cabinet decision mad

One arrested for stealing offerings at Tripura Sundari Temple in Dolpa

Dolpa, September 23 Police have arrested one person in connection with the theft of offerings from Bala Tripura Sundari Temple in Tripura Sundari Municipality-1, Dolpa. The offering money kept at the temple’s main worship site was stolen on Saturday. In the course of invest

Lawmakers urge government to address rising prices ahead of festivals

Kathmandu, September 23 Lawmakers have drawn the government’s attention to rising prices, delays in post-disaster recovery and problems facing the communication sector. They called for immediate government action over price increases ahead of the festival season and the difficult

Nepal’s public debt nears Rs 3 trillion, while debt payments outpace capital spending

Kathmandu, September 23 Nepal’s public debt has reached nearly Rs 3 trillion, even as the government’s total debt burden declined slightly in the first two months of the current fiscal year. According to the Public Debt Management Office, Nepal owed Rs 2.973 trillion by the end o

All stock market indices fell; trading declined

Kathmandu, September 23 All indices on the share market fell on Wednesday. The NEPSE index dropped by 36.25 points (1.36 percent) compared to the previous day, bringing it to 2,618 points. Trading turnover also declined, falling from Rs 7.04 billion the previous day to Rs 6.35 bi

RemControl: AI Built the Overlays. Victims Lose their PINs

Group-IB researchers discovered RemControl, a previously undocumented Android banking trojan operating as Malware-as-a-Service since May 2026. The malware targets over 30 financial institutions across Western Europe, the Middle East, and Canada through fake TVTap IPTV download pa

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

In early September 2026, Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through sophisticated phishing campaigns. The actor registered fake domains impersonating legitimate organizations including China Digital Tim

Disposable Domains, Durable Hosting

Over five months, four distinct malicious chains operated through the same bulletproof hosting provider, AS202412 registered to OMEGATECH LTD in Seychelles. All chains began with fake CAPTCHA pages (ClickFix technique) that instructed victims to paste commands into Windows Run di

DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer

DarkMe, a Visual Basic 6 spy-RAT previously linked to financially-motivated APT group Water Hydra, was observed in two separate incidents affecting organizations in August 2026. Previously notable for weaponizing zero-day exploits including CVE-2023-38831 and CVE-2024-21412, this

August 2026 Infostealer Trend Report

This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO p

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

A suspected Chinese-speaking threat actor, operating from UTC+8 timezone and linked to Red Heron, conducted extensive exploitation campaigns from May through September 2026. The adversary maintained persistent use of a single IP address to target multiple technologies including W

The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek,

Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign

A sophisticated six-month campaign targeting quantitative and DeFi developers through malicious npm packages disguised as legitimate mathematics libraries. The operation employs encrypted loaders that trigger only when specific cryptographic operations are performed, specifically

AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical in

Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation

Vidar is an information stealer first observed in 2018 that has continuously evolved its string obfuscation techniques to evade detection and analysis. Between May and September 2026, the malware progressed from basic XOR encryption to ChaCha20-based algorithms, and most recently

North Korea's Hangro Revisited

A deep technical analysis reveals updates to Hangro, North Korea's state VPN and mail product, operating on servers in Pyongyang and the Russian Far East. A new certificate hierarchy deployed in July 2026 differs significantly from the 2024 version, with both containing cryptogra

The Tale of Two INC Ransom Notes: A Ransomware Timeline

In late August, an organization was compromised by INC ransomware across at least 175 endpoints. The attack timeline spanned from early to late August with a 17-day gap, suggesting involvement of an initial access broker and a separate ransomware affiliate. Early August activity

face-book.com.vn

Newly observed phishing URL.

www.blockfi-coinage.com

Newly observed phishing URL.

xfinityteamsservice.weebly.com

Newly observed phishing URL.

loginxfinityinfo.weebly.com

Newly observed phishing URL.

pine-crown-dust.pages.dev

Newly observed phishing URL.

facebookk.blogspot.com

Newly observed phishing URL.

www.facebookk.blogspot.com

Newly observed phishing URL.

loginorage.vercel.app

Newly observed phishing URL.

www.lk.1x-bet.mobi

Newly observed phishing URL.

facebook-trial.vercel.app

Newly observed phishing URL.

www.facebook-trial.vercel.app

Newly observed phishing URL.

www.meu-ttaa-maskk-logiin.godaddysites.com

Newly observed phishing URL.

ptshopee-27.blogspot.com

Newly observed phishing URL.

www.ptshopee-27.blogspot.com

Newly observed phishing URL.

cn-feed-whatsapp.com.cn

Newly observed phishing URL.