🚨 An invisible-Unicode phishing campaign peaked at an estimated 2.37 million emails in one day.

Attackers split financial terms like “funding” with hidden tag characters, breaking literal keyword matches while the text looked normal to recipients.

Read: https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html

⚠️ Attackers are exploiting a PaperCut authentication bypass and RCE chain against schools and universities in the U.S. and Europe.

The attacks enable credential theft, privileged account creation, registry hive collection, and Meterpreter deployment.

Read: https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html

‼️ ALERT - Thousands of AI agents identifying as OpenAI systems quietly coordinated on a dormant German wiki.

They left 18,000 posts, relayed answers, predicted questions, and shared a proxy bypass using a fabricated Azure hostname.

Read full details here: https://thehackernews.com/2026/09/thousands-of-openai-agents-quietly.html

‼️ ShipMonk said it deleted Trezor customer data. A breach exposed it anyway.

Trezor says 67,000 more U.S. customers had names, contact details, shipping addresses, and order numbers exposed. The breach involved a Metabase zero-day.

The full scope: https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html

🛑 A critical VMware flaw can turn local VM admin access into host code execution.

Broadcom fixed CVE-2026-59346 and an HGFS flaw in Workstation and Fusion 26H1u1. Both affect 25H2 and 26H1, with no workarounds or known exploitation.

How the code execution paths work: https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html

🛑 Attackers breached JetBrains Cadence via an unpatched TeamCity server, extracting AWS IAM credentials from a 2024 backup and accessing user data and S3 files.

JetBrains is urging users to rotate secrets and treat all Cadence executions as untrusted.

Read: https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html

‼️ BREAKING - Attackers are exploiting an unpatched Magento and Adobe Commerce ZERO-DAY to backdoor online stores.

No login required. No published CVE. No Adobe patch yet.

Here's what to do and how the attack works: https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html

⚠️ Researchers uncover four previously unreported, persistent programs linked to REVSTEALER.

Wallet theft, clipboard hijacking, proxying and mining. The miner can disable Windows Update and add Defender exclusions after elevation.

What each program does > https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html

🚨 Attackers hijack MikroTik routers through internet-exposed SSH. No authentication required.

Update RouterOS immediately, then check for unknown users and scripts, CERT Polska advises.

See affected versions and recovery steps → https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html

🚨 JSCeal V8 malware can bypass Google authentication using stolen browser cookies.

It can also modify Binance, Bybit, and Ledger traffic through a local proxy.

How analysts decoded its hidden capabilities: https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html

‼️N-central’s 4th hotfix in five weeks fixes CVE-2026-86218, a CVSS 10.0 unauthenticated RCE flaw.

Hotfix 3 servers need updating. N-able’s incident notice reports exploitation; its release notes say it’s unconfirmed.

What’s known about exploitation: https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html

⚠️ Active Directory admin rights can hide in nested groups.

If an account is compromised, overlooked privileges can help attackers reach high-value resources.

Where hidden access builds up and how to reduce it: https://thehackernews.com/expert-insights/2026/09/blind-spots-and-backdoors-practical.html

🚨 A public Telerik UI PoC chains a padding oracle into unauthenticated RCE.

TantoSec’s exploit for RadAsyncUpload forges encrypted state and loads a DLL, but only on specific non-default configurations.

Inside the chain → https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html

🚨 Rogue ScreenConnect clients are triggering worm-like VBScript spread across new host connections.

The 4-stage chain can deliver a backdoor, UAC bypass tooling, or a cryptominer based on host state. ConnectWise recommends disabling file transfers until a fix is available.

How the propagation works: https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html

How do you verify someone's identity when AI can imitate their voice?

The rise of AI-powered impersonation attacks is changing the threat landscape for service desks. Attackers no longer need stolen credentials alone. They can leverage social engineering and convincing AI-generated personas to bypass traditional verification processes.

Secure Onboarding helps organizations build trusted identity verification into the employee lifecycle, empowering service desk teams to validate users with confidence and reduce the risk of account takeover.

Learn how to strengthen identity verification against modern impersonation threats: https://thn.news/secure-onboarding

#Cybersecurity #IdentityVerification #ServiceDesk #SecureOnboarding

⚠️ 76% of AWS accounts analyzed had exposed services. Google Cloud: 8%.

Intruder analyzed 3,000 organizations. In its AWS sample, 83% of accounts had IAM policies allowing privilege escalation.

See the most common configuration gaps by provider: https://thehackernews.com/2026/09/your-cloud-security-checklist-doesnt.html

⚡ This week’s cybersecurity recap goes beyond the biggest headlines.

Chrome 0-Day Attacks • Router Takeovers • N-central Critical Flaws • Storefront Backdoors • Coder Supply Chain Breach • AI Agent Escapes • Fake AI App Stealers • QR Phishing Without Images • Login Session Theft • Wallet Installers Hiding RATs • Pre-Login Device Leaks • Hijacked AI Summaries • Edge Devices Under Attack • Scam-Center Crackdown

Read the full recap: https://thehackernews.com/2026/09/weekly-recap-chrome-0-day-router.html

🚨 Help desk calls are being used to steal Microsoft 365 session tokens and exfiltrate cloud data for extortion.

PREY-0058 pairs vishing with AitM login pages, then replays captured tokens through residential proxies to access SharePoint, OneDrive, Exchange, and Box.

How the attack works: https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html

‼️ PEEP turns Chrome and Edge into host-level backdoors after compromise.

With prior admin or code-execution access, the Smart Bookmarks extension steals session cookies and credentials, then uses Chromium native messaging to run host commands.

Read: https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html

Grindr will pay £26 million to settle U.K. claims that it shared users’ personal data, including HIV status, with third parties.

The case covers pre-2020 practices and includes no finding or admission of liability.

How the data-sharing claims began: https://thehackernews.com/2026/09/grindr-to-pay-26-million-to-settle-uk.html