Sophos uncovered a Linux rootkit in F5 BIG-IP APM environments that intercepts PHP loading and injects a fileless web shell directly into memory, keeping malicious code off disk. The malware appears to be a second-stage payload likely tied to CVE-2025-53521 and is also identified by ESET as PoisonedRefresh. #PoisonedRefresh #F5BIGIPAPM #CVE-2025-53521
The article explains how a suspicious vulnerability disclosure to an open source maintainer illustrates the same visibility and reporting challenges that many software vendors will face under the EU Cyber Resilience Act. It argues that companies must know what shipped, when they learned of vulnerabilities, and how quickly they can prove it before the CRA’s reporting clock begins. #EUCyberResilienceAct #ENISA #ActiveState
DoppelCart is a massive fake e-shop operation spanning more than 119,000 domains, with over 105,000 shops still active and used to steal payment card details through cloned storefronts. The campaign imitates 44,182 brands, some with real support details and deep checkout-page data theft, making it the largest publicly documented fake-shop cluster by domain count. #DoppelCart #BogusBazaar #Nebty #BenediktScheungraber
Everett, Massachusetts closed City Hall after a cybersecurity incident affected its internal systems, while emergency services, online payments, and utility operations continued normally. The city is working with cybersecurity experts and has not yet confirmed the initial access method, any data compromise, or whether a threat actor was identified. #Everett #CityHall
Sales Boomerang in the US was targeted by direwolf ransomware, with attacks impacting accounting/finance software, analytics & performance software, and customer relationship management systems. The disruption affected operations in #UnitedStates
mcnishsteel.com in Canada was targeted in a ransomware attack, allegedly executed by the safepay threat actor. The company is headquartered in Edmonton, Alberta, and was founded in 1978 by William and Wallace McNish. #Canada
Recoverycafe.org, a US organization founded in 2003 and which opened its first physical café in Seattle in 2004, was targeted in a ransomware incident involving threat actor safepay. The attack impacted the organization in the United States. #UnitedStates
SAP’s September 2026 security updates fix 20 vulnerabilities, including CVE-2026-44756 (OVERPASS), a maximum-severity SAP Kernel memory corruption flaw that can let attackers run commands with administrative privileges and fully compromise SAP hosts. SAP also patched CVE-2026-58240 (S4GET) in the NetWeaver Message Server, a missing-authentication flaw that can expose entire SAP clusters to remote code execution. #CVE-2026-44756 #OVERPASS #CVE-2026-58240 #S4GET #SAPKernel #SAPNetWeaver #SAPICM
Microsoft says the August 2026 security update can cause 0xc0000409 errors on Windows Server 2016 systems when the Compatibility Appraiser diagnostic service is enabled, leading to recurring CompatTelRunner.exe crashes. The issue affects physical and virtual machines, including VMware and Azure environments, and Microsoft plans to address it in a future update. #Microsoft #WindowsServer2016 #CompatTelRunner.exe #CompatibilityAppraiser #VMware #Azure
OpenAI is investigating an ongoing outage that is causing ChatGPT image generation errors and file upload delays, with users reporting freezes, failed prompts, and unavailable uploads. The company says it is applying mitigations while continuing to assess elevated failures affecting ChatGPT and the Images API. #OpenAI #ChatGPT #ImagesAPI
ShinyHunters claims it breached Florida’s DAVID driver database and stole more than 200,000 records, using a password-reset flaw to access multiple accounts and exfiltrate driver data. The group posted FLHSMV on its leak site and used Jeffrey Epstein’s DMV record as proof while also hinting at more DMV breaches to come. #ShinyHunters #DAVID #FLHSMV #JeffreyEpstein
Microsoft has released Windows 11 KB5124008 and KB5122880 as mandatory cumulative updates for 25H2/24H2 and 23H2, delivering September 2026 Patch Tuesday fixes for 1,000 vulnerabilities along with bug fixes and new features. The update adds taskbar, Start menu, Windows Search, File Explorer, and system improvements, and can be installed through Windows Update or the Microsoft Update Catalog. #KB5124008 #KB5122880 #Windows11 #MicrosoftUpdateCatalog
Cylake has raised $245 million, bringing its total funding to $290 million, to accelerate development of its sovereign security platform for government agencies and highly regulated enterprises. Founded by Nir Zuk and other former Palo Alto Networks and SentinelOne executives, the company is building an AI-native platform designed to run on…
Alleged white-hat hackers returned 3,400 Bitcoin after a theft from the Liquid Network sidechain that initially drained about 4,000 Bitcoin from its federation wallet. Blockstream and Liquid have paused network activity and are working with the attackers to fix the vulnerability, with roughly 598 Bitcoin still outstanding. #LiquidNetwork #Blockstream #Liquid #Bitcoin…
Hidden AI prompt injections are concealed instructions embedded in documents, metadata, emails, images, code repositories, and other content that autonomous agents ingest. Bowbridge warns that these attacks can cause agentic AI systems to exceed their intended behavior, misuse privileges, or exfiltrate sensitive data, making prevention and pre-scan defenses critical. #Bowbridge #AgenticAI…