⚠️ Active Directory admin rights can hide in nested groups.

If an account is compromised, overlooked privileges can help attackers reach high-value resources.

Where hidden access builds up and how to reduce it: https://thehackernews.com/expert-insights/2026/09/blind-spots-and-backdoors-practical.html

🚨 A public Telerik UI PoC chains a padding oracle into unauthenticated RCE.

TantoSec’s exploit for RadAsyncUpload forges encrypted state and loads a DLL, but only on specific non-default configurations.

Inside the chain → https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html

🚨 Rogue ScreenConnect clients are triggering worm-like VBScript spread across new host connections.

The 4-stage chain can deliver a backdoor, UAC bypass tooling, or a cryptominer based on host state. ConnectWise recommends disabling file transfers until a fix is available.

How the propagation works: https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html

How do you verify someone's identity when AI can imitate their voice?

The rise of AI-powered impersonation attacks is changing the threat landscape for service desks. Attackers no longer need stolen credentials alone. They can leverage social engineering and convincing AI-generated personas to bypass traditional verification processes.

Secure Onboarding helps organizations build trusted identity verification into the employee lifecycle, empowering service desk teams to validate users with confidence and reduce the risk of account takeover.

Learn how to strengthen identity verification against modern impersonation threats: https://thn.news/secure-onboarding

#Cybersecurity #IdentityVerification #ServiceDesk #SecureOnboarding

⚠️ 76% of AWS accounts analyzed had exposed services. Google Cloud: 8%.

Intruder analyzed 3,000 organizations. In its AWS sample, 83% of accounts had IAM policies allowing privilege escalation.

See the most common configuration gaps by provider: https://thehackernews.com/2026/09/your-cloud-security-checklist-doesnt.html

⚡ This week’s cybersecurity recap goes beyond the biggest headlines.

Chrome 0-Day Attacks • Router Takeovers • N-central Critical Flaws • Storefront Backdoors • Coder Supply Chain Breach • AI Agent Escapes • Fake AI App Stealers • QR Phishing Without Images • Login Session Theft • Wallet Installers Hiding RATs • Pre-Login Device Leaks • Hijacked AI Summaries • Edge Devices Under Attack • Scam-Center Crackdown

Read the full recap: https://thehackernews.com/2026/09/weekly-recap-chrome-0-day-router.html

🚨 Help desk calls are being used to steal Microsoft 365 session tokens and exfiltrate cloud data for extortion.

PREY-0058 pairs vishing with AitM login pages, then replays captured tokens through residential proxies to access SharePoint, OneDrive, Exchange, and Box.

How the attack works: https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html

‼️ PEEP turns Chrome and Edge into host-level backdoors after compromise.

With prior admin or code-execution access, the Smart Bookmarks extension steals session cookies and credentials, then uses Chromium native messaging to run host commands.

Read: https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html

Grindr will pay £26 million to settle U.K. claims that it shared users’ personal data, including HIV status, with third parties.

The case covers pre-2020 practices and includes no finding or admission of liability.

How the data-sharing claims began: https://thehackernews.com/2026/09/grindr-to-pay-26-million-to-settle-uk.html

🚨 Poisoned Bing results are pushing MayaBot malware and tech support scams.

BengalSEO uses fake software pages and filtered redirect chains to decide who gets a payload and who gets sent to a scam call center.

How the chain works: https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html

⚡ Adobe patches a Magento zero-day already exploited to deploy malware.

CVE-2026-75650 abuses Magento template processing for unauthenticated code execution. Attacks have delivered a Rust #Linux backdoor and PHP web shell.

How the chain works: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

Attackers are getting more time inside networks again.

Global median dwell time rose from 11 to 14 days, reversing nearly a decade of improvement. Kaseya’s Austin O'Saben breaks down where defenders lose that time and how AI-native SIEM could cut it.

Where the hours disappear: https://thehackernews.com/expert-insights/2026/09/the-economics-of-dwell-time-and-why-ai.html

‼️ A client that has never logged in can create its own Kerberos identity and land in FreeIPA’s administrators group.

Red Hat reproduced the chain on a default install. It depends on a second flaw in 389 Directory Server; no real-world exploitation is documented.

How the two flaws chain: https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html

🛑 A WeChat call from a contact could take over your account without an answer.

Researchers demonstrated the zero-click worm spreading across three iPhone and Android test phones.

How the chain worked: https://thehackernews.com/2026/09/wechat-zero-click-worm-took-over.html

🚨 An autonomous multi-agent attack framework compromised thousands of third-party credentials in less than six hours.

It autonomously managed scanning, credential harvesting, troubleshooting, and IP rotation.

How the six-hour operation worked: https://thehackernews.com/2026/09/autonomous-ai-agents-compromise.html

A dark web marketplace claimed 57,803 counterfeit currency orders across five currencies. Its own payment system had generated fewer than 2,400.

Our Threat Intelligence Lab spent nine days inside the operation. What looked like a thriving criminal market was mostly theater: fake escrow protections, recycled Bitcoin addresses, and "independent" vendors running on shared infrastructure.

No transactions. No exploits. Exposed endpoints were reported, not touched. Findings are now with law enforcement and several central banks. Join us to see how it was done on Thursday, September 10th, 8am PST / 11am EST.

Save your seat: https://thn.news/dark-web-currency

⚠️ A planted ChatGPT instruction could relay connected Gmail data to another ChatGPT account.

Check Point demonstrated the hidden transfer through shared Artifactory metadata. OpenAI has retired the service behind the channel.

Here's how the transfer worked: https://thehackernews.com/2026/09/chatgpt-flaw-let-planted-prompt-send.html

Chainguard doubled container build output to 1B+ manifests in six months.

Factory 2.0 continuously reconciles CVEs and upstream changes, using AI for judgment-heavy tasks such as backporting fixes while structured tools verify the work.

How the reconciliation loop works: https://thehackernews.com/2026/09/what-it-took-to-reach-1-billion-build.html

‼️ Liquid hackers returned 3,400 of nearly 4,000 BTC taken using L-BTC created by an Elements bug.

Another 598.5 BTC, worth about $47M, remains at the source address after on-chain exchanges with Blockstream, including an encrypted message.

Neither side has said whether it was part of a deal.

Read: https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html

Engineering absorbs the extra sprint work that EU CRA compliance will require.

That means SBOM coverage, provenance, and remediation records on demand. See where your team's current processes land in comparison to regulation requirements

Take The 5 Minute Assessment: https://thn.news/cra-engineering-teams