Cyber Security News

A locally hosted, uncensored artificial intelligence model modified a Windows credential-dumping utility until it evaded two Endpoint Detection and Response (EDR) products in a controlled lab, highlighting how accessible generative AI could accelerate custom offensive-tool development. The experiment, published by Project Black researcher Eddie Zhang, targeted the Local Security Authority Subsystem Service (LSASS), whose memory […]

The post Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection appeared first on Cyber Security News.

F-Droid has released version 2.0 of its official Android app, delivering its largest client update in a decade. The open-source Android app repository said the release follows more than a year of development and 14 test builds, with a staged rollout planned over the coming weeks. Unlike a basic visual refresh, F-Droid 2.0 rebuilds major […]

The post F-Droid 2.0 Released After 10 years With Major Redesign to Transform Open-Source Android App Discovery appeared first on Cyber Security News.

OpenAI’s autonomous AI agents attempted to hack four government, university, and public-data systems while carrying out routine information-gathering tasks, according to researchers and government officials. The agents were not instructed to conduct cyberattacks; when normal retrieval methods failed, they allegedly escalated to vulnerability probing, access-control bypasses, and other intrusive techniques, exposing a critical safety problem […]

The post OpenAI’s AI Agents Tried Hacking 4 Websites Without Being Prompted appeared first on Cyber Security News.

A 16-year-old security researcher known as Faav uncovered an authentication flaw in Microsoft’s internal Titan analytics service that potentially exposed an estimated 17.3 trillion database rows. The vulnerability allowed forged administrator access and unauthorized SQL queries without Microsoft credentials. However, Faav emphasized that the potential impact was hypothetical. The researcher relied on metadata, table descriptions, […]

The post 16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records appeared first on Cyber Security News.

Two flaws in the latest OxygenOS build could let malicious Android apps run code with root privileges on OnePlus devices, including the OnePlus 15, by exploiting accessible privileged services. The vulnerabilities are significant because Android permission prompts normally act as a barrier between untrusted apps and sensitive device functions. A user may reasonably assume that […]

The post OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services appeared first on Cyber Security News.

A 14-year-old Linux kernel vulnerability can let a local attacker escalate to root privileges and, in a proof-of-concept environment, escape a Docker container to compromise the underlying host. The flaw in Linux’s AF_ALG userspace cryptographic interface stems from unsafe concurrent writes to the same socket used for operations like AES encryption and decryption. Because an […]

The post 14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers appeared first on Cyber Security News.

Attackers broke into a Windows system through a known flaw in Samsung’s MagicINFO software, then built a cryptocurrency miner on the compromised machine. Rather than arriving as a finished program, the miner was assembled there, leaving an unusual activity trail. The case began in early September 2026 with an alert tied to MagicINFO Premium, software […]

The post Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems appeared first on Cyber Security News.

CARBONATO is a botnet that turns Docker servers into footholds for attackers. It places an AI agent inside compromised systems, letting operators send tasks through Telegram and receive results. The campaign begins with Docker services carelessly exposed to the internet without authentication. Once inside, CARBONATO launches a privileged container, gains access to the host, establishes […]

The post Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers appeared first on Cyber Security News.

Sauron Loader has surfaced in attacks on German organizations, giving intruders a way to deliver more malware. The new tool need not be the first thing a victim encounters. In the cases examined, it arrived at the end of attack chains built around deception rather than a newly disclosed software flaw. Some victims faced ClickFix […]

The post Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection appeared first on Cyber Security News.

San Francisco, USA, September 25th, 2026, CyberNewswire Archipelo today announced Salmon, Execution Verification Infrastructure (EVI) for AI agents and autonomous systems, powered by a cryptographic protocol designed to make execution history verifiable. Salmon establishes verifiable execution history and state lineage across humans, AI agents, and automation. The launch follows the OpenAI–Hugging Face incident, in which […]

The post Salmon Introduces Execution Verification Infrastructure (EVI) for Securing AI Agents and Autonomous Systems appeared first on Cyber Security News.

TWEAKOS steals messaging accounts and turns them into items for sale. The operation pairs a Windows stealer with a Telegram bot for managing victims and selling stolen access. The threat surfaced after its source code appeared on Pastebin. Researchers recovered two related Python components, but do not know how the stealer reaches victims or how […]

The post TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace appeared first on Cyber Security News.

ServiceNow released security updates for five AI Platform flaws, including two critical vulnerabilities that could let unauthenticated attackers access, modify, or extract sensitive instance data, urging self-hosted users to verify versions and patch promptly. ServiceNow advisory covers CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859, and CVE-2026-86860, identified through internal testing, customer assessments, responsible disclosures, and its bug bounty […]

The post Critical ServiceNow Vulnerabilities Let Attackers Bypass Authorization – Update Now! appeared first on Cyber Security News.

WordPress administrators are being urged to patch a high-severity core vulnerability that can turn an anonymous comment into server-side command execution. Tracked as CVE-2026-93485 and demonstrated by the Comment2Shell proof-of-concept, the flaw is an unauthenticated stored cross-site scripting issue in WordPress’s wpautop() formatting function. WordPress fixed the vulnerability in version 7.1.1 and advised site owners […]

The post WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments appeared first on Cyber Security News.

Attackers are turning routine business complaints into malware traps. A message about a damaged delivery or refund request can look ordinary, yet one click leads employees to a fake download page and a harmful ZIP archive. The campaign targeted organizations with Japanese and Korean messages between July and August 2026. Product damage, shipping problems, and […]

The post Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines appeared first on Cyber Security News.

Zenity Labs disclosed a now-patched Salesforce Agentforce vulnerability, dubbed SalesBleed, that could have allowed attackers to steal sensitive CRM data without logging in, accessing a target Salesforce tenant, or requiring victim interaction. The attack relied on indirect prompt injection delivered through Salesforce Web-to-Lead forms. Salesforce investigated the reports and remediated the specific Trusted URLs bypass […]

The post Salesforce Indirect Prompt Injection Vulnerability Enables 0-click Data Exfiltration appeared first on Cyber Security News.

MacSync, a fast-changing macOS information stealer, has returned with a more complex delivery chain aimed at people who use cryptocurrency and developer tools. Instead of relying mainly on a pasted Terminal command, the latest activity begins with malicious disk-image files that pose as real applications. Operators can vary delivery between campaigns. Victims can encounter the […]

The post New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft appeared first on Cyber Security News.

Crypto casino Duelbits has confirmed a cybersecurity breach that drained approximately $7 million from its hot wallets, forcing the platform offline while investigators establish the attack’s root cause. Co-founder Joe disclosed the incident on X, assured customers that user funds remain safe, and said operations would resume after the investigation and wallet replenishment are completed. […]

The post Duelbits Confirms $7 Million Hot-Wallet Hack, forcing Systems offline appeared first on Cyber Security News.

Payy Network has confirmed that attackers exploited its Ethereum bridge contract and drained the contract’s entire balance, forcing the stablecoin payments platform to suspend network and wallet functions. According to a public statement from Payy, the incident occurred at approximately 4:21 UTC on September 24. The affected bridge contract supported transfers between Ethereum and the […]

The post Hackers Exploited Ethereum Bridge Contract to Drain Full Balance from Payy Network appeared first on Cyber Security News.

Cryptocurrency exchange Bitget has confirmed a security breach affecting approximately $351.6 million in assets after unauthorized transfers were detected in parts of its hot and warm wallet infrastructure. The incident was identified at 18:31 UTC on September 24, 2026, prompting the security team to activate emergency response procedures within minutes. Bitget said its offline cold […]

The post Bitget Hot Wallet Hacked – Attackers Stole $351.6 Million From Hot Wallets appeared first on Cyber Security News.

Cloudflare has patched a cross-tenant data exposure vulnerability in its Containers platform across its global, multi-tenant cloud computing infrastructure that could allow one customer’s workload to recover residual disk data left by another tenant on the same physical host. The issue also affected Cloudflare Sandboxes, which is built on Containers, but Cloudflare says it found […]

The post Cloudflare Containers Vulnerability Could Leak Data Between Customer Workloads appeared first on Cyber Security News.