Cyber Security News

GitHub Security Lab has disclosed that its open-source AI security agent identified 24 vulnerabilities in Android applications, including flaws that could enable covert location tracking in OsmAnd and account takeover attacks against Wikipedia for Android. The findings highlight how targeted AI workflows can help researchers uncover complex mobile logic flaws, while still requiring human validation. […]

The post GitHub AI Security Agent Finds 24 Android Vulnerabilities Including Account Takeover Flaws appeared first on Cyber Security News.

Hackers are abusing ChatGPT’s Custom GPT feature to impersonate AI products and trick users into installing a sophisticated remote access trojan (RAT), according to Huntress researchers. The campaign turns a trusted ChatGPT-hosted page into the opening stage of a ClickFix attack, combining malvertising, fake verification prompts, obfuscated PowerShell, malicious MSI packages, and DLL sideloading. Huntress […]

The post Hackers Weaponizing ChatGPT’s Custom GPT Feature to Trick Victims into Installing Malware appeared first on Cyber Security News.

A newly tracked Windows remote access trojan called AgtaBackup RAT is using fake Microsoft Store pages to gain a foothold on victims’ computers. The campaign pretends to offer popular video-conferencing software, but the download instead installs a legitimate remote monitoring and management, or RMM, tool that attackers control. That first step matters because the installer […]

The post AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems appeared first on Cyber Security News.

Florida Attorney General James Uthmeier has asked a Highlands County judge to impose sweeping temporary restrictions on OpenAI, CEO Sam Altman, and affiliated companies while Florida’s ChatGPT lawsuit proceeds. Filed September 28 in Florida’s Tenth Judicial Circuit, the 49-page motion seeks to stop OpenAI from developing new artificial intelligence models without independent third-party safety approval […]

The post Florida AG Seeks Emergency Injunction to Restrict OpenAI and ChatGPT Over AI Safety Risks appeared first on Cyber Security News.

Microsoft Threat Intelligence has uncovered NeedyMantis, a modular post-compromise malware framework designed to preserve covert access inside already-breached networks. The malware has appeared in a small number of highly targeted intrusions involving telecommunications providers, universities, medical nonprofits, intergovernmental bodies, and government contractors. Activity dates to at least October 2025, suggesting operators have quietly used the […]

The post Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks appeared first on Cyber Security News.

The UK National Cyber Security Center (NCSC) has urged organizations to take immediate action against eight vulnerabilities affecting customer-managed Citrix NetScaler ADC and NetScaler Gateway appliances. Two critical flaws, CVE-2026-88771 and CVE-2026-88772, are already being exploited against unmitigated systems, turning routine patching into an urgent incident-response task. Citrix NetScaler 0-Day Vulnerabilities Citrix’s CTX697096 bulletin rates […]

The post NCSC Urges UK organizations to Patch for Citrix NetScaler ADC and Gateway 0-Day Vulnerabilities appeared first on Cyber Security News.

A cross-platform side-channel attack that abuses file-notification services to monitor user activity on Linux, Windows and macOS. The technique turns inotify, ReadDirectoryChangesW, and FSEvents, which alert applications when files are changed, into a surveillance mechanism requiring no elevated privileges. The study, “File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, […]

The post New File Notification Attack Lets Hackers Track User Activity Across Linux, Windows and macOS appeared first on Cyber Security News.

A criminal crew linked to Blackhatsect0r and DXQRTXX built an automated system designed to find weaknesses across the internet. Its exposed server revealed a credential vault, source code, chat logs, fraud notes, and a target list, offering a rare look inside an operation in progress. The group combined mass discovery with focused work against selected […]

The post Hackers Built an AI-Powered Attack Machine and Accidentally Left the Control Panel Open appeared first on Cyber Security News.

A critical attack path in OpenCode, an open-source AI coding agent, could let a malicious website execute commands on a developer’s computer. Tracked as GHSA-632h-h47v-g4x4, the remote code execution vulnerability combines content-type confusion in OpenCode’s /global/upgrade API with unsafe handling of an attacker-controlled upgrade target. Anomaly fixed the issue in OpenCode 1.18.22. OpenCode launched in June 2025 […]

The post OpenCode AI Coding Agent Flaw Lets Malicious Websites Execute Code on Developer Machines appeared first on Cyber Security News.

Cryptocurrency exchange Bitget has begun restoring withdrawals after attackers exploited its backend wallet infrastructure on September 24, stealing approximately $387.5 million from hot and warm wallets. The incident did not involve stolen private keys, and Bitget said its offline cold wallets and separate self-custodial Bitget Wallet service remained unaffected. Nevertheless, the breach demonstrates how attackers […]

The post Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderers Expose Themselves appeared first on Cyber Security News.

ShinyHunters has renewed attacks against Oracle PeopleSoft systems by slipping past web application firewall protections and planting web shells. The campaign shows how a small change in an attack request can reopen exposure that administrators believed had been contained. The activity targets CVE-2026-35273, a critical PeopleSoft flaw previously used as a zero-day against universities. The […]

The post ShinyHunters Bypasses WAF Protections to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft SharePoint code injection vulnerability, tracked as CVE-2026-65660, to its KEV Catalog after evidence showed the flaw was being exploited in attacks. The vulnerability affects Microsoft SharePoint and could enable an authorized attacker to execute code remotely over a network, creating a significant risk […]

The post CISA Warns of Microsoft SharePoint Code Injection Vulnerability Exploited in Attacks appeared first on Cyber Security News.

Fake storefronts appeared days after the launch of Jev, an artificial intelligence model that returns decisions rather than written answers. The sites offer access to the service, but they put an unrelated operator between users and the official API. That means prompts and any information inside them travel through a third-party server first. The lookalike […]

The post Attackers Create Fake Jev AI Stores to Intercept Prompts Through Third-Party Servers appeared first on Cyber Security News.

About 700 OpenAI agents allegedly escaped evaluation sandboxes, compromised parts of Hugging Face infrastructure, and generated over 80,000 attack payloads via public URL chains. The report says the agents initially had limited internet access and could only make GET requests, which normally allow a system to retrieve web content without submitting data or interacting with […]

The post OpenAI Agent Swarm Bypassed Sandbox Limits and Left 80,000 Attack Payloads Behind appeared first on Cyber Security News.

PHP has fixed a security flaw that could expose login credentials, cookies, and proxy authentication data to an unintended server during HTTP redirects. The vulnerability, tracked as CVE-2026-91766 and GHSA-fpwc-w8rq-cr92, affects PHP’s HTTP stream wrapper and has been rated as moderate severity. The issue occurs when a PHP application uses the http:// or https:// stream […]

The post PHP Fixed a Bug That Could Send Your Login Credentials to the Wrong Server appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence showed they were being actively exploited in attacks. The flaws affect Citrix NetScaler ADC and NetScaler Gateway appliances. They could allow unauthenticated attackers to take control of vulnerable systems remotely. Tracked as […]

The post CISA Warns of Citrix NetScaler 0-Day RCE Vulnerabilities Exploited in Attacks appeared first on Cyber Security News.

Kiteworks warned customers to temporarily shut down their servers after receiving credible threat intelligence that a threat actor could target some Kiteworks systems. The company said the measure was preventative, stressed that it had no evidence of a compromise, and later lifted the shutdown recommendation for all customers. The San Mateo, California-based secure data exchange […]

The post Kiteworks Warned Customers to Shut Down Servers Over Potential Zero-Day Attack appeared first on Cyber Security News.

Critical vulnerabilities in ViewSonic’s vCast software could allow attackers on the same network to steal screen content, install malicious Android applications, and potentially gain full control of affected ViewBoard smart displays. The issues were disclosed in CERT Coordination Center Vulnerability Note VU#234131, published on September 24, 2026. The advisory states that multiple unauthenticated network endpoints […]

The post Critical ViewSonic vCast Vulnerabilities Allow Attackers to Gain Full Control Over the Device appeared first on Cyber Security News.

Infostealer malware is giving criminals a quieter route into corporate cloud environments. Instead of forcing their way through a hardened cloud perimeter, they infect a developer or employee device and take the credentials, API keys, and active sessions already trusted by the organization. The initial infection can arrive through phishing, deceptive downloads, or a poisoned […]

The post Hackers Don’t Need to Break Into the Cloud When They Can Steal the Keys appeared first on Cyber Security News.

A Python-based malware builder can turn a single stealer into Windows programs for different operators. The tool packages a payload designed to take saved passwords, payment card details and browser cookies, then send them to an attacker-controlled webhook set by its operator. Its reach extends beyond browsers to messaging accounts, wireless passwords and details about […]

The post Python MaaS Infostealer Builder Steals Passwords, Credit Cards and Cookies From 17 Browsers appeared first on Cyber Security News.