#security il 2026-10-06

1. 06:23 <Cassandra> The Hacker News | ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits info@thehackernews.com (The Hacker News) · 1h ago · 8 min read Microsoft observed ClickFix attacks using browser cache smuggling to execute cached VBScript and launch a credential-targeting malware chain. Read full story
2. 06:23 <Cassandra> The Hacker News | Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account info@thehackernews.com (The Hacker News) · 23m ago · 6 min read Denmark says unauthorized parties accessed names, addresses, and CPR numbers for about 8.8 million people via a private company. Read full story
3. 07:55 <Cassandra> The Hacker News | FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach info@thehackernews.com (The Hacker News) · 59m ago · 3 min read FBI says a contractor failed to apply a security patch before a ShinyHunters breach stole personal details of thousands of employees. Read full story
4. 07:55 <Cassandra> The Hacker News | Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products info@thehackernews.com (The Hacker News) · 57m ago · 6 min read Atlassian fixes a critical path traversal in 8 Data Center products that lets unauthenticated attackers read files if exact paths are known. Read full story
5. 08:28 <Cassandra> BleepingComputer | Engineer sentenced for locking over 3,000 devices on employer network Sergiu Gatlan · 9m ago · 2 min read A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack. Read full story
6. 08:54 <Sentinel> SecurityWeek | Social Engineering Detection Moves Into the Live Conversation Kevin Townsend · 16m ago · 6 min read Security awareness training falls short against social engineering, driving adoption of real-time AI detection tools to stop deepfakes Read full story
7. 09:54 <Sentinel> SecurityWeek | 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register Ionut Arghire · 15m ago · 3 min read A company’s lawful access to Denmark’s Central Person Register was abused to steal the information of 8.8 million people. Read full story
8. 09:54 <Cassandra> The Hacker News | Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports info@thehackernews.com (The Hacker News) · 33m ago · 6 min read Google temporarily stops OSS VRP product vulnerability reports after a surge in automated submissions, most of which it says are invalid. Read full story
9. 09:58 <Cassandra> BleepingComputer | Nikkei discloses breaches of employees’ Microsoft, Google email accounts Sergiu Gatlan · 32m ago · 2 min read Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. Read full story
10. 10:54 <Sentinel> SecurityWeek | Long-Running NPM Malware Campaign Accumulates 40,000 Downloads Ionut Arghire · 20m ago · 4 min read Eight NPM packages with 40,000 downloads have been delivering malware in the MALFEX supply chain attack campaign. Read full story
11. 11:25 <Sentinel> SecurityWeek | Cybersecurity M&A Roundup: 39 Deals Announced in September 2026 Eduard Kovacs · 23m ago · 6 min read Thirty-nine cybersecurity-related merger and acquisition (M&A) deals were announced by companies in September 2026. Read full story
12. 11:53 <Sentinel> SecurityWeek | Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks Ionut Arghire · 4m ago · 4 min read Apple plans additional Full Disk Access controls in macOS amid growing risks posed by more capable and autonomous AI agents. Read full story
13. 12:01 <Cassandra> BleepingComputer | Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits Sergiu Gatlan · 29m ago · 2 min read The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage. Read full story
14. 12:25 <Cassandra> The Hacker News | Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers info@thehackernews.com (The Hacker News) · 1h ago · 4 min read OX found no marketplace vetting across 15,465 indexed MCP servers, including expired domains and hosts routed through consumer tunnels. Read full story
15. 12:25 <Cassandra> The Hacker News | Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies info@thehackernews.com (The Hacker News) · 59m ago · 8 min read Wikimedia says rogue OpenAI agents edited wikis, tried to compromise Etherpad, and sent millions of automated requests to its APIs. Read full story
16. 12:25 <Cassandra> The Hacker News | LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings info@thehackernews.com (The Hacker News) · 28m ago · 4 min read Malicious spreadsheets can make LibreOffice and OpenOffice run Java code with Java enabled; LibreOffice has fixed the flaw. Read full story
17. 12:53 <Sentinel> SecurityWeek | FBI Arrests 'Most Wanted' Developer of Ploutus ATM Malware Ionut Arghire · 5m ago · 4 min read An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. Read full story
18. 14:21 <Sentinel> SecurityWeek | FBI Blames Contractor's Missed Patch for ShinyHunters Breach Eduard Kovacs · 6m ago · 4 min read The FBI removed an Accenture contractor after a missed PeopleSoft patch enabled ShinyHunters to breach its jobs site. Read full story
19. 14:26 <Sentinel> Rapid7 | Securing Agent-to-Agent Communication: The Next Identity Frontier Rapid7 · 11m ago · 4 min read Agent-to-agent security is still evolving, but security teams can begin preparing now by extending principles they already understand across identity, access, visibility, and detection. And as agent adoption grows, organizations will also need to make these interactions visible as part of normal security operations. Get the basics in a new blog. Read full story
20. 14:31 <Cassandra> BleepingComputer | How to secure RMM software: 8 controls MSPs should test Acronis · 30m ago · 5 min read RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. Read full story
21. 15:34 <Cassandra> BleepingComputer | Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes Bill Toulas · 17m ago · 3 min read A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. Read full story
22. 16:34 <Cassandra> BleepingComputer | ASOS confirms data breach after “HACKED” in-app notifications Lawrence Abrams · 1m ago · 3 min read UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. Read full story
23. 17:32 <Sentinel> PortSwigger Research | The model isn't cooperating 17m ago · 3 min read Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In this post, I'll briefly explore this phenomenon, the Read full story
24. 17:35 <Cassandra> BleepingComputer | Atlassian warns of critical file-access flaw in Jira, Confluence Bill Toulas · 1m ago · 2 min read Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. Read full story
25. 19:56 <Cassandra> BleepingComputer | Hackers exploit 32 zero-days on first day of Pwn2Own Ireland Sergiu Gatlan · 34m ago · 2 min read On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. Read full story
26. 20:24 <Cassandra> The Hacker News | Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan info@thehackernews.com (The Hacker News) · 2h ago · 7 min read Linux backdoors targeting South Korea and Taiwan disguise processes and traffic as trusted email services to evade detection. Read full story
27. 20:24 <Cassandra> The Hacker News | Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes info@thehackernews.com (The Hacker News) · 1h ago · 5 min read A human-operated phishing platform impersonates AI ad tools to capture credentials and MFA codes through browser-in-the-browser login windows. Read full story
28. 21:15 <Cassandra> BleepingComputer | Ninja Forms plugin flaw exploited to hack WordPress sites Bill Toulas · 14m ago · 2 min read Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. Read full story

Tutti i giorni · Entra in #security