⚠️ Russia-linked Star Blizzard has targeted 100+ Ukraine-linked organizations this year, often with fake event invites.

If a target replies, the group may send a password-protected archive containing an LNK disguised as a PDF. Opening it can start a chain that installs the CosmicPulse backdoor.

How it gets in: https://thehackernews.com/2026/09/russias-star-blizzard-targets-100.html

‼️ French tax data theft stayed undetected for seven weeks, until the attacker claimed it online.

Stolen staff passwords opened the door. DGFIP wasn’t monitoring ADER, and one password reset left an active session alive as E-Contact scraping continued for nearly 16 hours.

Read about this: https://thehackernews.com/2026/09/french-tax-data-theft-using-stolen.html

🛑 Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.

watchTowr’s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.

The flaw is already exploited in the wild.

Inside the exploit chain: https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html

🚨 A High-severity OpenSSL bug can leak heap memory to a DTLS peer or crash the process, OpenSSL says.

It can happen when the resend timer fires while a larger handshake message is stuck mid-send.

Latest releases fix 13 other flaws: 1 Moderate, 12 Low.

Read: https://thehackernews.com/2026/09/openssl-fixes-high-severity-dtls-flaw.html

⚡ Attackers are exploiting a Citrix NetScaler flaw to gain root access and hide PHP web shells behind .deb and .sig files.

The attacks also deploy SLAPSHOT, a Python tunneler. In at least one case, attackers used it for internal reconnaissance and credential theft.

Inside the attack chain: https://thehackernews.com/2026/09/attackers-exploit-netscaler-flaw-for.html

🚨 CSuite phishing can turn one phish into both Microsoft 365 session theft and remote endpoint access.

ANYRUN traced 351 related sandbox analyses. Some chains deployed ScreenConnect or Action1, and 51% of submissions came from the U.S.

🔗 How the chain works → https://thehackernews.com/2026/09/us-focused-csuite-phishing-steals.html

AI coding agents asked for review screenshots put internal images in public GitHub repos, researchers say.

Researchers counted 13,000+ images at 300+ orgs, including customer billing records. In 93% of cases, they sat in personal accounts.

Read → https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html

🚨 ClickFix now accounts for 52% of Push Security detections.

Four in five intercepted ClickFix payloads are reached through search engines, using compromised sites, malvertising, and SEO poisoning to get users to run malicious commands themselves.

🔗 Inside the six browser attack techniques shaping 2026 → https://thehackernews.com/2026/09/know-your-enemy-browser-based-attack.html

🚨 Attackers are abusing ChatGPT Custom GPTs to infect users with RAT malware.

Sponsored Google results lead to attacker-created GPTs, then to Google Sites pages with fake Cloudflare CAPTCHAs. Huntress says at least 40 users were infected.

Learn how this ClickFix chain works: https://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.html

‼️ WARNING - Cisco says attackers are exploiting a critical SD-WAN Manager authentication bypass.

CVE-2026-76504 lets a remote attacker access the Manager API as admin without credentials. Cisco has fixes, no workaround, and log checks for suspicious activity.

Read: https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html

⚠️ Attackers are using phishing emails to turn legitimate MSP360 installs into a path for ScreenConnect.


Microsoft says the dual-RMM setup gives them redundant remote access, then supports tool delivery, information collection, and credential-access activity.


Read: https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html

🚨 Attackers exploited a Zimbra flaw to plant web shells and harvest authentication secrets.

CVE-2026-73570 can be triggered by a crafted SMTP request when SNMP notifications are enabled and zimbra-snmp is installed.

Read: https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html

⚠️ Citrix NetScaler attackers are using a second-stage payload that creates a superuser and disguises a PHP web shell behind CSS-like URLs.

The same Perl script stages configuration data for upload, changes /bin/sh permissions, and erases itself after execution.

Details: https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html

One “Continue” click can give a malicious OAuth app access to your entire mailbox.

Material Security VP Rajan Kapoor demonstrates email exfiltration, lateral movement, and covert deletion, no password or malware required.

How the OAuth abuse works: https://thehackernews.com/videos/2026/09/one-click-on-continue-can-hand.html

🚨 MetaMask is exiting affected Ethereum validators as it deals with an ongoing security incident.

It says there’s no immediate threat to MetaMask wallets. Lido says the exits will likely mean foregone rewards and could bring downtime penalties.

What MetaMask has disclosed so far: https://thehackernews.com/2026/10/metamask-security-incident-prompts-exit.html

⚡ Attackers exploited a zero-day in a third-party security product to steal $387.5 million from Bitget.

Mandiant found the intruders compromised security appliances, moved laterally into Bitget’s wallet environment, and deployed malicious packages on the wallet job server.

Read: https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html

‼️ Warning: A malicious PDF can trigger controlled memory corruption in Apple CoreGraphics.

Apple says CVE-2026-86950 may have been used in targeted attacks.

The first public PoC is now out, while WhatsApp PDF checks hint at a possible delivery path that remains unconfirmed.

Details → https://thehackernews.com/2026/10/apple-coregraphics-poc-emerges-as.html

⚡ Google is rolling out Gemini 4 Argon to trusted cyber defenders.

The model can autonomously find, validate, and patch critical software flaws. Google says Argon also found an undisclosed healthcare vulnerability exposing sensitive personal data.

Read: https://thehackernews.com/2026/10/google-rolls-out-gemini-4-argon-to.html

🛑 An actively exploited Cisco SD-WAN flaw can give unauthenticated attackers admin-level API access.

CISA has added CVE-2026-76504 to its KEV catalog. Federal agencies have until Oct. 3 to apply the fix.

What defenders should hunt for: https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html

⚡ OpenAI says it disrupted a coordinated campaign tied to Moonshot AI associates that tried to extract protected model reasoning.

The activity peaked at 16,000 attempted extraction-pattern requests from 4,000+ users in two days.

Read: https://thehackernews.com/2026/10/openai-disrupts-reasoning-extraction.html