A buyer using the handle “caustic” is seeking corporate network access across the U.S., Canada, Australia, the UK, the EU, and LATAM, while excluding government targets. The post requests privileged access such as Local Admin, Domain User, or Domain Admin, and asks for details on host count, EDR/AV coverage, and any…
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor
SC is a WordPress backdoor ecosystem that survives by regenerating itself across files, the database, shared memory, and scheduled tasks, making simple file deletion ineffective. Its payload hides from admin views, communicates through public Ethereum RPC gateways, and can recreate privileged access, security changes, and even checkout-skimming code on demand. #SC #WordPress #EthereumRPC
Eclipse ransomware targeted The Japan Times, a leading English-language news outlet in Japan, disrupting access to its business, politics, culture, sports, and entertainment reporting. The attack impacted services and subscriptions, affecting the availability of digital and archival content in #Japan
Software Answers, a Banyan Software Company and US-based provider for the long-term stay accommodation industry (including corporate housing and serviced apartments), reported a ransomware claim by the threat actor pear. The incident impacted the United States. #UnitedStates
N0n ransomware targeted Houston Thyroid & Endocrine Specialists in the US, stealing and threatening to leak 14,441 patient document scans, including lab results, medical summaries, diagnoses, insurance records, and day sheets. The exposed Protected Health Information includes SSNs, dates of birth, and clinical data, along with billing and claims records containing financial information, #UnitedStates.
The Dutch Institute for Vulnerability Disclosure (DIVD) says its network breach was caused by chaining two zero-day flaws in the open-source Zammad ticketing system, leading to session hijacking, remote code execution, and root privilege escalation. DIVD and Merlon Security notified Zammad and advised users to upgrade to version 7 or take vulnerable instances offline immediately. #DIVD #Zammad #CVE-2026-102489 #CVE-2026-102490
Microsoft says Star Blizzard is using a new delivery method called RedFlick to automate attacks and deploy its CosmicPulse backdoor with less victim interaction. The campaign uses phishing emails, malicious archives, and staged payloads to target organizations supporting Ukraine, as well as NGOs, think tanks, governments, and financial institutions. #StarBlizzard #RedFlick #CosmicPulse #NOROBOT #BAITSWITCH
Zscaler ThreatLabz tracked 2CLoader, a new Windows loader that uses extensive anti-analysis, evasion, and configuration-based execution features to deliver Vidar, Remus, and XWorm. The loader decrypts and launches payloads through multiple paths, uses HTTP-based C2 with XOR-encrypted JSON, and is associated with indicators such as aware-cr1.com, 62.60.226.185, and the threat name Win64.Loader.2CLoader. #2CLoader #Vidar #Remus #XWorm #aware-cr1.com #62.60.226.185
Attackers compromised a self-hosted JFrog Artifactory instance operated by OpenInfra Europe by exploiting CVE-2026-82329, an authentication bypass flaw that granted admin-level access. OpenInfra Europe warned anyone who downloaded artifacts from artifactory.nordix.org between August 28 and September 15, 2026 to stop using them immediately and treat them as potentially compromised. #OpenInfraEurope #JFrogArtifactory #CVE-2026-82329
The Cybersecurity Pulse highlights major developments in AI security, SIEM innovation, and incident response, including NVIDIA’s Open Agent Safety Platform, Cribl’s Detect, Microsoft’s Defender ISOC preview, and OpenAI’s agent safety work. It also covers active threat activity from ShinyHunters, JADEPUFFER, and Citrix NetScaler exploitation, along with new defenses from ZeroDrift, Vega, Reco, and Rig Security. #ShinyHunters #JADEPUFFER #OpenAgentSafetyPlatform #CriblDetect #DefenderISOC #CitrixNetScaler #OpenAI
The 2025 IDSA identity security report shows improvement across many identity-risk metrics, with identity-related incidents plateauing or declining and phishing still the most common threat. It also highlights the growing impact of AI and non-human identities on identity management, alongside continued adoption of Zero Trust and strong interest in digital wallets. #IDSA #ArtificialIntelligence #ZeroTrust #DigitalWallets #NonHumanIdentities
Google Threat Intelligence Group reports that AI is accelerating vulnerability disclosure and exploitation, with CVE disclosures, in-the-wild exploitation, and zero-day activity all rising through 2026. The report also shows AI is helping discover more high-impact flaws and that attackers are increasingly targeting AI/LLM infrastructure and exposed enterprise middleware. #CVE #GTIG #BeyondTrustPRA #Langflow #LiteLLM #Flowise #LangChain
Microsoft says Entra ID will gain stronger protection against external script injection attacks, with new Content Security Policy rules starting in mid-October 2026. The update will block unauthorized scripts during browser-based sign-ins to reduce risks like XSS, and Microsoft advises customers to stop using code-injecting browser tools before the change takes effect. #EntraID #Microsoft #CSP #XSS
Persistent AI coworkers are emerging, but most current platforms still run on borrowed human credentials, creating standing privileges, weak attribution, and access creep. Security teams must identify every agent, give it its own identity, and manage its lifecycle before the third wave of agentic workflows takes hold. #OpenAI #Microsoft #Anthropic #Google #EntraAgentID #Okta #SailPoint #CyberArk #TokenSecurity
Truffle Security found more than 543,000 valid credentials still exposed in public GitHub repositories in July, with some secrets remaining public for years despite GitHub’s safeguards. The study shows that Push Protection reduced some exposures, but many live secrets still fall outside its coverage, including database strings and Google API keys. #GitHub #TruffleSecurity #PushProtection