🚨 DoJ says 255 fake freelance accounts sent malicious Excel files to about 80,000 users.

Thousands were infected with TVRAT, giving operators remote control. An extradited Russian man now faces federal charges.

Details here: https://thehackernews.com/2026/09/extradited-russian-hacker-faces-charges.html

‼️ GeoNetwork flaws can enable unauthenticated RCE in government geoportal backends.

Ethiack found 121 exposed deployments running affected versions across 39 countries; 89% were government, military, or national-agency related. Fixes are in 4.4.12 and 4.2.17.

Read: https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html

🚨 Attackers are exploiting two SonicWall SMA 1000 zero-days.

One is a pre-auth SSRF flaw. The other allows an authenticated administrator to inject OS commands under specific conditions. SonicWall says attackers may have chained them to execute code.

Find details here: https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html

67% of executives believe unapproved AI tools have already caused a breach.

Yet only 38% of organizations report a comprehensive AI policy. Shadow AI, ad hoc integrations, and over-permissioned agents multiply enterprise entry points.

How to close the control gap: https://thehackernews.com/2026/09/how-to-secure-enterprise-ai-from.html

🚨 A fake streaming ad reached an estimated 570,950 EU Meta accounts.

It promoted StreamRat, an Android trojan that can gain near-complete device control after a user sideloads the APK and grants system permissions.

How the takeover chain works: https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html

🛑 A BGP hijack delivered a malicious Virtualizor update that established persistent root access.

A valid certificate prevented connection warnings. One provider found 5 of 34 checked hypervisors compromised.

Virtualizor says check every server.

Read: https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html

🚨 Gambling Goblin is hijacking traffic on compromised Brazilian government sites.

Malicious Apache modules strip security headers and proxy visitors to betting pages disguised as Google Play, Microsoft Store, and Amazon.

How the traffic diversion works: https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html

‼️ A malicious repo can run attacker code before some AI agents ask for trust.

Seven agents are affected, including Claude Code, Codex, and Cursor. The repo must arrive as files with .git intact; four were unpatched at publication.

Read how: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html

🚨 AI-powered phishing is here — and it's more convincing than ever.

The 2026 Kaseya Email Security Report breaks down the latest threats and what you can do about them. 🛡️

📥 Get the report → https://thn.news/sec-trust-insights

⚠️ OpenAI says Astra found and used two zero-days in an evaluation exploit chain.

Google’s Gemini 3.8 Flash Cyber and Anthropic’s Claude 5.1 models also arrived with tiered access and safeguards.

What each company disclosed: https://thehackernews.com/2026/09/google-anthropic-and-openai-unveil.html

⚠️ Attackers are exploiting LiteLLM, Artifactory, and Switchvox flaws.

The attacks deploy crypto miners and reverse shells, mint admin tokens, and harvest API keys. CISA added seven exploited vulnerabilities to its KEV catalog.

Inside the attack chains: https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html

‼️ A public PoC shows how CrowdStrike Falcon’s macro remediation can be abused for privilege escalation.

FalconFlank works on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike has not yet commented.

Read: https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html

🚨 Pegasus infected a Serbian student movement member’s iPhone through a zero-click iMessage exploit.

At least 14 people in Serbia have faced advanced spyware targeting in 2026.

Read: https://thehackernews.com/2026/09/pegasus-zero-click-spyware-exploit.html

Shai-Hulud now checks 469 locations for credentials.

Earlier variants checked 189. The worm now scans developer environments, CI/CD tooling, cloud configs, and AI tool settings. Stolen publishing tokens can provide a path into trusted package distribution.

Inside the expanded credential hunt: https://thehackernews.com/2026/09/shai-huluds-reach-just-grew-to-469.html

⚠️ Attackers are abusing signed Node.js binaries to run malware.

Observed activity targeted government departments, tech companies, and hotels. In one intrusion, attackers used ClickFix for initial access and EtherHiding to retrieve commands.

How the attacks work: https://thehackernews.com/2026/09/attackers-turn-trusted-nodejs-runtime.html

🚨 US SOCs face a persistent risk: attackers move faster than detection rules.

Close the blind spots with live threat intel from 16K companies worldwide.

Get fresh IOCs in your SIEM within 24h after threats appear.

Integrate actionable TI: https://thn.news/threat-feeds

Organizations are increasingly relying on AI-generated and third-party code across the software supply chain. But once that code is compiled into a stripped binary, much of the original source context disappears, leaving security teams with limited visibility into what’s actually running and unable to detect malicious code entering production systems.

RevEng.AI is bridging that gap with Mega Bite, a suite of specialized AI models purpose-built for binary analysis. It includes two new proprietary models, WilBERT and Ventris, designed to analyze binary software without requiring access to source code while uncovering context that traditional decompilers and general-purpose LLMs can miss.

Check out the blog and watch this video to see how AI-powered binary analysis can give security teams deeper visibility into the software they run, with the speed and reliability to match real-world security operations.

https://thn.news/binary-analysis

‼️ ALERT - Thomson Reuters’ C-Track court software breach may have exposed SSNs and sealed court data.

An unauthorized party obtained files tied to courts across the U.S. and Ontario. Some courts say backup data was involved; Ohio says its production platform was accessed.

Details: https://thehackernews.com/2026/09/thomson-reuters-court-software-breach.html

⚠️ Criminals can buy access to Windows hosts compromised by BraZetsu.

The Python malware uses AI to prioritize high-value systems, collects browser and financial data, and lets buyers deploy their own payloads through purchased access.

Read: https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html

🚨 An RMM phishing campaign first tied to Canada spans 46 countries.

ANYRUN linked 601 cases to the operation, with 45% of observed activity associated with the U.S. Fake tax, shipping, and invoice lures trick targets into installing legitimate RMM software.

How the chain works: https://thehackernews.com/2026/09/us-becomes-top-target-in-rmm-phishing.html