🚨 Poisoned Bing results are pushing MayaBot malware and tech support scams.

BengalSEO uses fake software pages and filtered redirect chains to decide who gets a payload and who gets sent to a scam call center.

How the chain works: https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html

⚡ Adobe patches a Magento zero-day already exploited to deploy malware.

CVE-2026-75650 abuses Magento template processing for unauthenticated code execution. Attacks have delivered a Rust #Linux backdoor and PHP web shell.

How the chain works: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

Attackers are getting more time inside networks again.

Global median dwell time rose from 11 to 14 days, reversing nearly a decade of improvement. Kaseya’s Austin O'Saben breaks down where defenders lose that time and how AI-native SIEM could cut it.

Where the hours disappear: https://thehackernews.com/expert-insights/2026/09/the-economics-of-dwell-time-and-why-ai.html

‼️ A client that has never logged in can create its own Kerberos identity and land in FreeIPA’s administrators group.

Red Hat reproduced the chain on a default install. It depends on a second flaw in 389 Directory Server; no real-world exploitation is documented.

How the two flaws chain: https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html

🛑 A WeChat call from a contact could take over your account without an answer.

Researchers demonstrated the zero-click worm spreading across three iPhone and Android test phones.

How the chain worked: https://thehackernews.com/2026/09/wechat-zero-click-worm-took-over.html

🚨 An autonomous multi-agent attack framework compromised thousands of third-party credentials in less than six hours.

It autonomously managed scanning, credential harvesting, troubleshooting, and IP rotation.

How the six-hour operation worked: https://thehackernews.com/2026/09/autonomous-ai-agents-compromise.html

A dark web marketplace claimed 57,803 counterfeit currency orders across five currencies. Its own payment system had generated fewer than 2,400.

Our Threat Intelligence Lab spent nine days inside the operation. What looked like a thriving criminal market was mostly theater: fake escrow protections, recycled Bitcoin addresses, and "independent" vendors running on shared infrastructure.

No transactions. No exploits. Exposed endpoints were reported, not touched. Findings are now with law enforcement and several central banks. Join us to see how it was done on Thursday, September 10th, 8am PST / 11am EST.

Save your seat: https://thn.news/dark-web-currency

⚠️ A planted ChatGPT instruction could relay connected Gmail data to another ChatGPT account.

Check Point demonstrated the hidden transfer through shared Artifactory metadata. OpenAI has retired the service behind the channel.

Here's how the transfer worked: https://thehackernews.com/2026/09/chatgpt-flaw-let-planted-prompt-send.html

Chainguard doubled container build output to 1B+ manifests in six months.

Factory 2.0 continuously reconciles CVEs and upstream changes, using AI for judgment-heavy tasks such as backporting fixes while structured tools verify the work.

How the reconciliation loop works: https://thehackernews.com/2026/09/what-it-took-to-reach-1-billion-build.html

‼️ Liquid hackers returned 3,400 of nearly 4,000 BTC taken using L-BTC created by an Elements bug.

Another 598.5 BTC, worth about $47M, remains at the source address after on-chain exchanges with Blockstream, including an encrypted message.

Neither side has said whether it was part of a deal.

Read: https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html

Engineering absorbs the extra sprint work that EU CRA compliance will require.

That means SBOM coverage, provenance, and remediation records on demand. See where your team's current processes land in comparison to regulation requirements

Take The 5 Minute Assessment: https://thn.news/cra-engineering-teams

⚠️ Slim Spider stole the secrets controlling crypto assets at a Brazilian financial institution.

The group also abused Azure DevOps to deploy Kubernetes implants and built tooling for bulk unauthorized Pix transfers.

Read the full story: https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html

⚠️ N-able says CVE-2026-86218 is being exploited in the wild. The CVSS 10.0 N-central flaw can enable pre-auth RCE.

CISA added it to KEV, while Huntress is probing a separate N-central compromise where the exploit used remains unconfirmed.

Read: https://thehackernews.com/2026/09/n-able-n-central-pre-auth-rce-flaw.html

‼️ Two Windows zero-days are being exploited in the wild.

Microsoft patched them alongside a record 974 vulnerabilities. Both flaws can let authorized attackers elevate privileges locally to SYSTEM, and CISA has added them to its KEV catalog.

Read: https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html

⚠️ Days after Microsoft shipped the ShieldBreak fix, a new PoC shows the flaw can still be triggered under specific conditions.

Dubbed ShieldCrash, the bypass demonstrates arbitrary file read as SYSTEM on the latest Windows version.

Read: https://thehackernews.com/2026/09/researcher-drops-new-microsoft-defender.html

🚨 Malware linked to F5 BIG-IP APM break-ins hides a PHP web shell in memory while targeted scripts can remain clean on disk.

Sophos found the implant alters what PHP sees when Apache loads those files, helping explain why file checks can miss it.

Read: https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html

‼️Warning: New CVE-2026-67401 vulnerability in cPanel lets mail-privileged hosting accounts execute code as root.

cPanel says every supported cPanel & WHM version is affected and has released fixed builds.

Read details here: https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html

⚠️ ALERT - Google patched a new actively exploited Chrome V8 zero-day.

CVE-2026-87491 lets crafted HTML execute arbitrary code inside Chrome’s sandbox. Google has not said how it’s being weaponized or who is behind it.

Read: https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html

⚡ Billions of tokens. Millions of requests.

U.S. agencies accuse China-based AI firms of using industrial-scale distillation to extract capabilities from Claude, GPT, Gemini, and Grok.

How the campaigns hid their access: https://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.html

‼️ WARNING - Take your internet-exposed Alby Bitcoin wallet off the public internet first.

A critical flaw in Alby Hub v1.7.0–v1.18.5 could let attackers take over wallets that were reachable from the internet.

Details here: https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html