Category: Cyber Security News

Acronis has disclosed CVE-2026-87886, a high-severity Linux local privilege escalation flaw in its backup plugins for cPanel & WHM and Plesk. The company says the issue has been exploited in limited, targeted attacks in the wild, and urges affected users to patch immediately. #CVE-2026-87886 #Acronis #cPanel #WHM #Plesk

Researchers uncovered BambooToken, a multi-platform malware campaign that uses MQTT for command-and-control to target Windows and Linux systems across Asia and South America. The campaign appears to rely on DLL sideloading through Tendyron OnKey software, with infrastructure and targeting suggesting extensive data collection and possible China-linked activity. #BambooToken #Tendyron #OnKey #MQTT…

U.S., U.K., and Dutch agencies say an Iran-linked Windows malware campaign known as HEAVYGRAM and CHOSEN BRICK is used to spy on dissidents, journalists, and activists by stealing messages, screenshots, passwords, and audio. The malware spreads through deceptive files, uses Telegram for command and data theft, and has indicators tied to…

Researchers uncovered KREMLIN, a previously undocumented Brazilian banking malware operation tracked as REF9334 that uses fake bank lures, malicious browser extensions, and multi-stage loaders to steal credentials and session data. The campaign hides its infrastructure with Ethereum smart contracts, and Elastic observed 1,515 infected systems checking into a network canary domain,…

F5 has enhanced Distributed Cloud Bot Defense with persistent device intelligence and agentic AI protections to help organizations distinguish trusted users and AI agents from malicious automation. The updates use continuous risk decisioning and multi-signal telemetry to stop fraud, account abuse, and disruptive bot activity without blocking legitimate digital interactions. #F5 #DistributedCloudBotDefense #F5ADSP #AgenticAI

Attackers are exploiting CVE-2026-76461, a critical zero-day in Cisco Secure Email Gateway that allows unauthenticated remote command execution with root privileges. Cisco says it has seen active exploitation and has contacted affected cloud customers, while CISA quickly added the flaw to its Known Exploited Vulnerabilities catalog. #Cisco #CVE-2026-76461 #CiscoSecureEmailGateway #CiscoAsyncOS #CISA

CISA’s Continuous Diagnostics and Mitigation (CDM) program is being pushed to move faster by expanding automation, improving unification, and strengthening data-driven risk management across federal agencies. Officials also said CDM’s evolution has been shaped by the SolarWinds breach, which exposed the need for a common operating picture and better government-wide visibility. #CISA #ContinuousDiagnosticsAndMitigation #SolarWinds

BambooToken is a previously unknown malware framework active since at least 2023 that now uses MQTT for command-and-control on Windows and Linux systems. Black Lotus Labs found it in campaigns targeting enterprise servers and infrastructure used by mobile apps, legal and financial services, with signs of possible China-aligned operations. #BambooToken #MQTT #BlackLotusLabs #TendyronOnKey #KingsoftOffice #GitLab

CenterPoint Energy disclosed that an unauthorized third party accessed personal information tied to some customers after a threat actor claimed to have stolen and leaked 7.49 million records. The company says its electric and gas services were not affected, while it continues investigating the scope of the incident and notifying impacted parties. #CenterPointEnergy #4d722e4d656f77

A compromised Admin Menu Editor Pro website pushed malicious plugin updates to WordPress customers, creating hidden user accounts and deploying a web shell on affected sites. The incident impacted at least 230 customers across about 1,500 sites, and users of versions 2.35 and 2.36 are urged to check for signs of compromise and restore from a safe backup if possible. #AdminMenuEditorPro #JanisElsts #WordPress

Vercel’s two-week sandbox bug-bounty challenge generated 1,285 reports, but none of the findings allowed access to customer data. The most significant issues were two Linux kernel networking flaws, and Vercel also used the event to improve its sandbox and automate triage with an agentic system. #Vercel #LinuxKernel #Firecracker #HackerOne #TrailofBits…

Security, risk, and control assessments are no longer enough when boards, customers, and regulators want proof that controls are working right now. The article argues for continuous control monitoring to replace point-in-time checks, using live evidence to keep pace with changing environments and reduce real risk. #NIST #CybersecurityFramework #GRC…

Microsoft and the American Federation of Teachers have reached a binding agreement that limits how student data can be used in AI tools, including a ban on using school data to train models and restrictions on emotionally manipulative AI companions. New York City and Los Angeles are also pausing student AI…

CISA warned that ransomware gangs are now abusing the critical VMware vCenter vulnerability CVE-2026-59310, which Broadcom patched in July as an urgent directory traversal flaw. Security teams were urged to patch immediately after reports showed the bug was already being used for persistence and remote access across hundreds of exposed vCenter systems. #CVE-2026-59310 #VMwarevCenter #Broadcom #CISA #QUIRSO #Shadowserver