September 2026

Threat actors are continuing to leverage artificial intelligence (AI) to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours.

Google Threat Intelligence Group (GTIG) said it has observed attackers with diverse motivations targeting proprietary AI

Dubbed MikroTrick, the bugs allow attackers to bypass authentication, overwrite configuration files, and take over devices.

The post MikroTik Patches Critical Flaws Chained to Hack Routers appeared first on SecurityWeek.

Hackers stole the information of students, teachers, staff, and parents/guardians from a self-hosted Metabase instance.

The post Mathspace Data Breach Exposes Over 1 Million People appeared first on SecurityWeek.

Administrators are advised to check their deployments for newly created user accounts they don’t recognize.

The post N-able Patches Critical Zero-Day in N-central appeared first on SecurityWeek.

A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says.

FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software.

The

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.

The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.

“This update resolves a critical

Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams.

The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the Indian state of Rajasthan since at least 2015, driven by two IT service providers named WeConnect

Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users’ personal information, including their HIV status, with third-parties.

Grindr, which is the largest LGBTQ+ dating app, was sued in April 2024, accusing it of violating U.K. privacy laws by sharing sensitive data for commercial purposes such as advertising.

The proof-of-concept (PoC) exploits lead to privilege escalation, spawning a shell with System privileges.

The post Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits appeared first on SecurityWeek.

The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance.

The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek.