Clop moved its data leak site to a new Tor address after its old server was defaced by ShinyHunters through an unpatched Grav CMS path traversal flaw. Grav confirmed the issue as CVE-2026-42608 and released a fix for the older 1.7 branch in version 1.7.53.4. #Clop #ShinyHunters #Grav #CVE202642608
Category: Cyber Security News
Kiteworks has warned customers worldwide to shut down their servers for a six-hour window after receiving credible threat intelligence from law enforcement about a potentially imminent attack. The company says this is a precautionary measure, not a response to a confirmed breach, while concerns remain about possible zero-day targeting and the Clop extortion gang. #Kiteworks #Clop #BleepingComputer #Heise
Bitget said hackers stole at least $387.5 million from its exchange after a breach of its wallet services backend, with evidence pointing to North Korea-linked actors. The company has suspended withdrawals, brought in Mandiant and SlowMist, and plans to use its User Protection Fund to cover losses while recovery efforts continue….
A bipartisan coalition of 44 state attorneys general settled a lawsuit against Labcorp for $2.3 million after a 2019 data breach tied to its vendor American Medical Collection Agency exposed the personal information of 10.2 million customers. The agreement requires Labcorp to overhaul vendor oversight, strengthen security controls, and improve incident…
Kiteworks warned customers to shut down its platform for a six-hour window over the weekend after receiving credible threat intelligence about a possible attempt to target some customer systems. The advisory is precautionary, with the company saying it is not aware of any compromise and noting its latest release, 9.5.1, addresses…
The U.S. Supreme Court ruled that states may use the federal SAVE database to verify voter citizenship, reversing lower court decisions that questioned its accuracy and privacy implications. The decision could aid election officials, though critics say the system is outdated and could wrongly remove eligible voters from registration rolls. #SAVE #U.S.SupremeCourt #DepartmentofHomelandSecurity #LeagueofWomenVoters #ElectronicPrivacyInformationCenter
CISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS. Federal agencies must patch the critical KEV entries by September 27, while SharePoint and RouterOS fixes are due by September 28. #WSO2 #AdobeCommerce #MicrosoftSharePoint #MikrotikRouterOS #CVE-2026-5430 #CVE-2026-71362 #CVE-2026-65660 #CVE-2026-67279
A CSRF vulnerability in the Elementor WordPress plugin can let an attacker trick a logged-in administrator into creating a new attacker-controlled admin account through a crafted link. The flaw affects Elementor versions 4.3.0 and 4.3.1, and users are urged to upgrade to 4.3.2 to block the REST API bypass. #Elementor #Patchstack #WordPress
AI is making cyberattacks cheaper to retry by reducing the time, skill, and cost needed to debug failed intrusion attempts, helping attackers move faster through reconnaissance, escalation, and exploitation. The article argues that defenders need a stateful SOC that preserves identity, evidence, hypotheses, constraints, and learning across handoffs so incidents do…
PamStealer has appeared in a new macOS variant that uses a server-side decryption chain, making the payload impossible to recover statically without live C2 cooperation. The campaign lures victims through a fake Wavel cryptocurrency wallet site and ultimately steals passwords, keychain items, browser credentials, and system data from compromised Macs. #PamStealer…
Two GitHub Actions from the actions-cool project were disabled again after becoming accessible and reactivating malicious payloads tied to the May 2026 Mini Shai-Hulud campaign. The incident highlights how mutable version tags can silently reintroduce supply chain risk, and why SHA pinning is critical for protection. #actions-cool #MiniShaiHulud #GitHubActions…
A Conifers study found that many deployed detections in security tools look healthy on dashboards but fail in practice because of logic bugs, missing telemetry, wrong data sources, duplicates, or excessive noise. The research also showed major coverage gaps, with organizations averaging 63% coverage for threats from their own intelligence and 64% protection against relevant MITRE ATT&CK techniques. #Conifers #MITREATTACK
Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role in the next Windows Server release and eventually remove it completely. Organizations that still rely on WDS-backed PXE or WDS-dependent multicast should begin migrating to alternatives such as Microsoft Configuration Manager. #WindowsDeploymentServices #WindowsServer #MicrosoftConfigurationManager
SOC 2 remains valuable for proving that controls operate as intended, but it can miss AI agents that use borrowed credentials, lack clear ownership, and create risk without failing any audit check. The article argues that organizations need intent-based security and agent-aware controls so they can identify what is running, who authorized it, and whether access still matches purpose. #SOC2 #TokenSecurity #AIagents #MCPservers
CISA has released its 2026 Election Infrastructure Security Plan, outlining cyber and physical risks to election systems and offering free tools and services to help election officials protect them. The plan highlights patching challenges tied to certification rules, voter registration database threats, insider risks, and bomb threats, while promoting stronger authentication,…