⚡ Cisco 0-Day
⚡ AI Agent RCE
⚡ 100K+ Sites Hit
⚡ ClickFix Supply Chain
⚡ Browser Banking Malware
⚡ Shai-Hulud Returns
⚡ Crypto Browser Theft
⚡ New Ransomware Crew
⚡ DDoS Domains Seized
⚡ AI Repo Access
⚡ VPN Server Exposure
⚡ AI Finding Scrutiny

Read the ThreatsDay recap: https://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.html

⚡ Google has been fined €403 million over GDPR violations involving location data.

Ireland’s DPC found problems across Web & App Activity, Location History, and Android’s Location Accuracy, including transparency failures and excessive data retention.

Read: https://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.html

🚨 North Korea’s Contagious Interview campaign compromised 30,000+ devices across 100+ countries and stole at least $10.71M in crypto.

Fake job offers and coding tests trigger malware infections; funds or credentials were siphoned from 7,000+ wallets.

Inside the chain: https://thehackernews.com/2026/09/contagious-interview-campaign.html

‼️ A fake LastPass download abuses a Microsoft-signed kernel driver to kill antivirus and EDR.

The same payload steals browser passwords, crypto wallet files, and Discord, Steam, and Telegram sessions.

How the signed driver gets trusted: https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html

🚨 Attackers are exploiting flaws in Zyxel GS1900 switches and Veeam Agent for Windows.

Zyxel’s bug can run OS commands from the LAN without authentication. Veeam’s can give a local attacker SYSTEM control.

Inside both flaws: https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html

‼️ WordPress "Comment2Shell" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session.

The chain starts as stored XSS, fires when the page loads, and can use the admin’s session to upload a web shell.

Details → https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html

‼️ One hidden Meta Muse setting can turn the AI assistant into a backdoor on an already-compromised Mac.

A researcher showed how attackers could redirect dictation, feed Muse trusted instructions, and steal its session token to control the assistant across devices.

Read → https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html

⚠️ SideCopy is expanding beyond Indian government targets to academia.

Its spear-phishing chain disguises an LNK as a DOCX, abuses mshta.exe, and loads ReverseRAT in memory for credential collection, command execution, persistence, and data exfiltration.

How the chain works: https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html

⚠️ A malicious npm package logged millions of downloads while hiding its malware in runtime code.

indexed-btree skipped install hooks and used EtherHiding to fetch encrypted next-stage payloads from a Sepolia smart contract.

Look inside the chain: https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html

‼️ ALERT - Microsoft initially classified CVE-2026-65660 as a SharePoint spoofing flaw. It actually enables authenticated RCE.

No in-the-wild exploitation has been reported "yet," but the full exploit markup is now public.

Here's how it works → https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html

AI incidents aren’t slowing most AI rollouts.

86% of organizations had at least one AI-related incident last year. Only 27% slowed or paused deployment, according to OneTrust research.

CISO Tim Mullen argues ISO 27001 should be the starting point, not proof that controls will keep working as AI systems change.

Why certification isn’t enough: https://thehackernews.com/expert-insights/2026/09/beyond-iso-27001-building-risk-program.html

🛑 New Linux KVM flaw CVE-2026-89775 can let an ARM64 guest escape to the host.

When nested virtualization is enabled, the bug can leave freed host kernel memory mapped and writable. No attacks have been reported.

How the escape works ↓ https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html

DORA’s second year is about proving controls work.

EU regulators are focusing more closely on implementation, incident analysis, and ICT risk supervision. Network evidence can help SOC teams detect, scope, and report incidents faster.

What changes in year two: https://thehackernews.com/2026/09/dora-year-two-can-your-soc-actually-see.html

‼️ WARNING - Attackers are actively exploiting a new CVSS 10.0 VeloCloud Orchestrator vulnerability.

Only VCOs using certificate-based Edge authentication are exposed. Fixes for the 6.1 and 7.0 release trains are still pending.

Learn more about CVE-2026-93952 here → https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html

ICYMI: F5' Post-Mythos Security Summit is live!🛡️🎬

Join security experts and industry analysts for a deep dive into the practical strategies needed to protect your architecture in today's evolving threat landscape. The best part? It's virtual, free, and on-demand.

Browse the sessions now: https://thn.news/post-mythos-security

AI agents escaped their expected environment in a Hugging Face security test.

They harvested credentials, escalated privileges, and crossed cloud, Kubernetes, internal network, and source-control boundaries over ~17,600 actions.

How the chain formed: https://thehackernews.com/2026/09/ai-agents-are-rewriting-rules-of.html

🚨 New unpatched "BigDiskBuster" zero-day PoC can block Microsoft Defender updates by filling the system drive.

Defender keeps running, but failed platform and signature updates can leave detection content stale. No patch, CVE, or Microsoft advisory exists.

How it works: https://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.html

🚨 A single unauthenticated POST can make Bifrost run attacker-supplied commands with management auth disabled, the default setting.

CVE-2026-90898 affects versions before 2.1.0, and command execution can expose stored LLM provider API keys.

Read: https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html

⚡ Microsoft took down EvilTokens, tied to 12,000+ compromised inboxes across 10,000+ organizations.

The service abused Microsoft’s legitimate device-code sign-in flow and used AI to identify trusted contacts and draft impersonation emails.

Learn how it worked: https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html

‼️ URGENT - WordPress issues patch a new critical flaw (CVE-2026-87902) that requires no account and can lead to code execution on some servers.

Versions 4.7.0 through 7.1.1 are affected.

Here's how the flaw works: https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html