WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
Ravie LakshmananSep 18, 2026Malware / Web Security Cybersecurity researchers have discovered a cluster of 13 npm packages that have been...
Hacking
Category Added in a WPeMatico Campaign
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
Ravie LakshmananSep 18, 2026Malware / Cybercrime A financially motivated threat actor has been linked to the development and distribution of...
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Ravie LakshmananSep 18, 2026Mobile Security / Malware Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to...
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run...
ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Ravie LakshmananSep 17, 2026Hacking News / Cybersecurity News Attackers keep finding new keys. The funny part is that defenders keep...
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Swati KhandelwalSep 17, 2026Vulnerability / Artificial Intelligence Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape...
Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a...
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Swati KhandelwalSep 17, 2026Vulnerability / DNS Security Every release of the Unbound DNS resolver before 1.26.1 has a critical heap...
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
The Hacker NewsSep 17, 2026Security Operations / Artificial Intelligence A new CVE drops. Your scanner finds it. The severity score...
CISO’s Expert Guide to Agentic Pentesting for Websites
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days...
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
Ravie LakshmananSep 17, 2026Malware / Cyber Espionage The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a...
OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads
Ravie LakshmananSep 17, 2026Artificial Intelligence / Vulnerability OpenAI on Wednesday disclosed six new instances of "unexpected or concerning model behavior"...
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Ravie LakshmananSep 16, 2026Vulnerability / Web Security A critical security flaw in Issabel Framework, a web-based framework for the open-source...
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy...
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five...
