September 2026

The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations’ networks.

OpenAI’s Hugging Face attack postmortem shows agents don’t care about rules — they need strong controls.

Kaspersky told SecurityWeek that it patched the vulnerability affecting its Endpoint Security product.

The post Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit appeared first on SecurityWeek.

Attackers could exploit the security defects to execute arbitrary code and access or tamper with data.

The post ServiceNow Patches 3 Critical Code Injection Vulnerabilities appeared first on SecurityWeek.

The ShinyHunters extortion group has claimed the theft of 284 million records from the company’s systems.

The post McKesson Confirms Data Breach as Attacker Deadline Looms appeared first on SecurityWeek.

Federal law enforcement continued to warn about ATM jackpotting gangs as it announced guilty pleas from five Venezuelan nationals.

At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend.

Governing Mayor Kai Wegner said that Berlin had received an extortion demand following the cyberattack, which was discovered in mid-August.

The pharmaceutical and healthcare technology company McKesson informed regulators it is in the early stages of investigating a cybersecurity incident involving an unnamed third-party application.

Threat actors with ties to the Democratic People’s Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession.

The ongoing insider threat is part of what has been described as the IT worker scheme,