Category: Cyber Security News

Drupal says it is already seeing exploitation attempts against CVE-2026-9082, a highly critical flaw affecting an API used to prevent SQL injection in PostgreSQL-backed sites. Imperva has observed more than 15,000 attempts targeting nearly 6,000 sites worldwide, with the activity focused largely on reconnaissance and validation. #Drupal #CVE-2026-9082 #Imperva #PostgreSQL…

Ubiquiti has released fixes for five UniFi OS vulnerabilities, including three maximum-severity flaws that could let remote attackers make unauthorized changes, read files, or execute commands without privileges. The issues affect Internet-exposed UniFi OS devices and were reported through Ubiquiti’s HackerOne bug bounty program. #UniFiOS #CVE-2026-34908 #CVE-2026-34909 #CVE-2026-34910 #CVE-2026-33000 #CVE-2026-34911

Fraud performance is often judged only by chargeback rate, but this misses hidden losses from false positives, manual reviews, account takeovers, and brand damage. IPQS argues that teams should measure fraud through broader metrics like good customer approval rate, abuse volumes, and operational impact to better support growth and trust. #IPQS #AlexanderHall #AccountTakeovers #SyntheticIdentityFraud

Drupal says hackers are already trying to exploit CVE-2026-9082, a highly critical SQL injection flaw affecting its database abstraction API and PostgreSQL sites. The company urges immediate updates after confirming real-world exploitation attempts, while warning that older Drupal 8 and 9 branches remain risky even with best-effort patches. #Drupal #CVE-2026-9082 #GoogleMandiant #MichaelMaturi #PostgreSQL #Symfony #Twig

Trend Micro has patched an actively exploited Apex One zero-day, CVE-2026-34926, that could let a local attacker with admin access inject malicious code into on-premises Windows deployments. CISA added the flaw to its known exploited vulnerabilities list and ordered federal agencies to patch quickly, while Trend Micro also fixed seven privilege escalation bugs in the Apex One SEP agent. #TrendMicro #ApexOne #CVE-2026-34926 #CISA

This article analyzes how Windows kernel mode drivers can sometimes be reached from user mode even when their intended hardware is absent, with a focus on device objects, PnP initialization, and driver deployment paths. It shows how software-emulated devices, spoofed hardware IDs, and forced driver binding can make hardware-gated driver code…

Researchers uncovered Megalodon, an automated supply-chain campaign that injected malicious GitHub Actions workflows into thousands of repositories to steal CI secrets, cloud credentials, SSH keys, and other sensitive data. The report also links related ecosystem abuse to TeamPCP and a set of fake Polymarket npm packages used to steal Ethereum/Polygon private…

The US Justice Department says Canadian national Jacob Butler, known as “Dort,” has been arrested and charged for allegedly operating the Kimwolf DDoS botnet. Authorities tied him to the botnet through multiple records and said the case is connected to the broader disruption of Kimwolf, Aisuru, and related DDoS-for-hire services. #Kimwolf…

U.S. and Canadian authorities arrested Jacob Butler for allegedly running the KimWolf DDoS botnet, a service that infected nearly two million devices and powered attacks at massive scale. The botnet targeted computers and servers worldwide, while parallel seizures disrupted 45 DDoS-for-hire platforms and related infrastructure. #KimWolf #JacobButler #Dort #Synthient #Aisuru #JackSkid #Mossad

Grafana confirmed that the unauthorized access to its GitHub repositories was caused by the TanStack supply chain attack, which followed the Mini Shai-Hulud campaign targeting NPM and PyPI projects. The company said its codebase and internal repository data were accessed, but production systems and Grafana Cloud were not affected, and no…

TrendAI has patched CVE-2026-34926, a zero-day in Apex One that was exploited in the wild and could let an attacker modify a server key table to inject malicious code to agents. The issue affects only the on-premises version, has been added to CISA’s KEV catalog, and follows several other high-severity Apex…

Authorities in North America and Europe disrupted First VPN, a cybercrime service used by at least 25 ransomware groups for reconnaissance, intrusions, and other attacks. The operation dismantled infrastructure, led to the arrest of the alleged administrator in Ukraine, and exposed users tied to criminal activity. #FirstVPN #Europol #FBI…

Cisco has released fixes for CVE-2026-20223, a maximum-severity flaw in Secure Workload that could let an unauthenticated remote attacker access sensitive data and alter configurations across tenant boundaries. The disclosure follows Cisco’s report of another critical authentication bypass in Catalyst SD-WAN Controller, which was exploited by UAT-8616. #CiscoSecureWorkload #CVE-2026-20223 #CatalystSDWANController #CVE-2026-20182…

Adam Young and Harrison Gevirtz pleaded guilty for helping an India-based tech-support fraud scheme that used fake malware pop-ups and routed victims to call centers to steal money from Americans. The case also prompted renewed pressure on AT&T, T-Mobile, and Verizon as U.S. lawmakers pushed telecom companies to do more to…