September 2026

A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users.

The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations’ networks.

OpenAI’s Hugging Face attack postmortem shows agents don’t care about rules — they need strong controls.

Kaspersky told SecurityWeek that it patched the vulnerability affecting its Endpoint Security product.

The post Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit appeared first on SecurityWeek.

Attackers could exploit the security defects to execute arbitrary code and access or tamper with data.

The post ServiceNow Patches 3 Critical Code Injection Vulnerabilities appeared first on SecurityWeek.

The ShinyHunters extortion group has claimed the theft of 284 million records from the company’s systems.

The post McKesson Confirms Data Breach as Attacker Deadline Looms appeared first on SecurityWeek.

Federal law enforcement continued to warn about ATM jackpotting gangs as it announced guilty pleas from five Venezuelan nationals.

At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend.

Governing Mayor Kai Wegner said that Berlin had received an extortion demand following the cyberattack, which was discovered in mid-August.

The pharmaceutical and healthcare technology company McKesson informed regulators it is in the early stages of investigating a cybersecurity incident involving an unnamed third-party application.