Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 11:00 am
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.
Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets
Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackle the risk online ad data poses to troops, and more.
Latest
Tuesday, September 8
CVE-2025-25249 (FortiOS/FortiSwitchManager cw\_acd heap overflow) has been patched for some time. We're publishing evidence of what's been happening to instances that weren't: a purpose-built Node.js RAT, 178 confirmed victim sessions, activity since July 2026.
I have redone CyberMatch so it is now a complete toolkit for cybersecurity go to market and would love your feedback (it is 100% free)
Hey everyone, so I'd really love to get your feedback on the strategic move and the tools themselves (are they useful for you as cyber pros?). Basically, I launched CyberMatch nearly a year ago with the intent of becoming a cyber solution comparison website but I realized it wasn't enough. So now I have turned it into a hub of tools and solutions for cybersecurity go to market professionals. Everything is still 100% free. I added a tool that can help you find the right cybersecurity conference for your budget, audience, geo, and provide you with an overall score for each conference. Another tool shows which cyber attacks are trending up so you can tailor your marketing and sales materials around that, it can show what buyers are searching for and what solutions are trending up. There is also a tool that shows you which keywords related to cybersecurity are trending so you can better match your positioning to what buyers are looking for. And, finally, there is now a full vendor portal where you can edit your company profile. Check it out: [https://cybermatch.tech](https://cybermatch.tech/)
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical
Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the Indian state of Rajasthan since at least 2015, driven by two IT service providers named WeConnect
Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal information, including their HIV status, with third-parties. Grindr, which is the largest LGBTQ+ dating app, was sued in April 2024, accusing it of violating U.K. privacy laws by sharing sensitive data for commercial purposes such as advertising.
During my research into model alignment, I noticed how frequently safety guardrails cause false positive refusals on legitimate cybersecurity tasks. To address this, I applied directional abliteration to Qwen3-4B. By locating the specific internal activation pattern responsible for refusal and removing it directly from the model weights, I neutralised the refusal response entirely. \[model : [https://huggingface.co/IamLucif3r/Qwen3-4B-Instruct-2507-Abliterated](https://huggingface.co/IamLucif3r/Qwen3-4B-Instruct-2507-Abliterated) \] The process requires no fine tuning, no datasets and preserves the model's original reasoning and coding performance. You can run it using ollama : `ollama run` [`hf.co/IamLucif3r/Qwen3-4B-Instruct-2507-Abliterated:Q4_K_M`](http://hf.co/IamLucif3r/Qwen3-4B-Instruct-2507-Abliterated:Q4_K_M) What this modification provides: * Direct, unhindered analysis of exploit payloads, binaries and source code. * Complete removal of conversational lecturing and moral disclaimers * Baseline benchmark capabilities intact without catastrophic forgetting. I have documented the complete methodology, findings & technical setups in my article: [https://blog.anmolsinghyadav.com/llm-abliteration-refusal-guardrails-f227460e2c7c](https://blog.anmolsinghyadav.com/llm-abliteration-refusal-guardrails-f227460e2c7c) You can create your own abliterated model.
At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire delivered a talk on how attackers can abuse today's AI agents in ways most defenders haven't thought about yet, from tricking agents into spilling secrets to forcing them to carry out unauthorized actions on behalf of the victim. This resulted in over $50,000+ in bounties in just a few weekends, without actually poking the target with Burp Suite or any automated scanners.
BENCHMARK : Cyber Defense (WAF) Engine Built on SWI-Prolog: 100 Million Logical Inferences with < 5 MB RAM!
Many still view logic programming languages like Prolog as purely academic or limited to classic AI. However, in my latest "Hyper Chaos Stress Test (v7.0 God Mode)" benchmarking a custom web application firewall (WAF) engine, this architecture proved to be an absolute powerhouse for high-throughput cyber defense. When hit with 40,000 Active Hyper Chaos Waves against an intelligence feed database containing 276,717 clauses, the engine maintained a flawless "100% METAL LOCKED SECURE! SHIELD IS IMPENETRABLE" verdict, bypassing exactly 0 unique payloads. Here is the raw performance data extracted directly from the SWI-Prolog virtual machine execution: * Total Inferences Executed: 100,201,875 logical reasoning steps inside the main memory. * Peak Induction Speed: 7,024,009 LIPS (Logical Inferences Per Second). * Volatile RAM Footprint: \~4.2 MB (4,270 KB allocated, 3,754 KB in use), running ultra-lightweight on a standard 8.0 GB system. * Garbage Collection Overhead: 7 core and 24 clause garbage collections completed in 0.000 pure seconds. * JIT Hashing Performance: Scaled automatically to 276,717 JITI Rules across 4,096 memory buckets, locking in an absolute 2,538.4x Speedup Factor. The Secret? Just-In-Time Indexing (JITI). Instead of checking criteria sequentially (linear scanning), SWI-Prolog dynamically constructs deep hash tables for the active rule sets. The engine instantly jumps to the exact memory location matching the payload signature, yielding a massive 2,538x speedup. This proves that declarative logic programming isn't just mathematically sound—it is highly production-viable, offering incredible protection while slashing cloud compute infrastructure costs down to the absolute bare minimum. check detail hure : [**https://github.com/lokinpendawa/aethel\_core**](https://github.com/lokinpendawa/aethel_core) What are your thoughts on utilizing declarative logic programming for modern, low-footprint cybersecurity perimeters? Let's discuss in the comments below!
*A cyber incident forced Springfield Public Schools to close its 64 schools Tuesday, disrupting instruction for more than 23,000 students across Springfield, Massachusetts.* *The district also canceled after-school activities and told staff and students to avoid its network and district-issued laptops while officials investigate and restore systems.*
Monday, September 7
Bose Sleepbuds II: Reverse-engineered the full BLE file-transfer protocol (TUMBLE) — audio codec still unidentified
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences
macOS ClickFix campaign resolving C2 through a Polygon smart contract - full on-chain rotation history
Write-up of a macOS ClickFix chain that reads its C2 address from a Polygon contract at runtime instead of hardcoding a domain. Covers a delivery path I haven't seen documented (a compromised legitimate site serving the lure to a subset of its own visitors), the full 25-entry on-chain rotation history including the operator's pre-launch testing, and the cost side — under three dollars has funded four months of takedown-proof infrastructure. Two of the rotations don't appear in any public reporting I could find, including the one that's currently live. Scripts to reproduce all of it are linked in the post. [https://bugrasahinoglu.com/posts/clickfix-etherhiding-macos/](https://bugrasahinoglu.com/posts/clickfix-etherhiding-macos/) Disclosure: my own write-up. Builds heavily on prior work by Have I Been Squatted, UnderDefense, Prophet Security and fab0, all credited in the post.
Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff
AI changed the economics of finding vulnerabilities The post AI Can Find Vulnerabilities. Building a System That Proves Risk Is the Hard Part. appeared first on Synack .
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management
If managing security across multiple cloud providers wasn't hard enough, each one fails in a different way. For the 2026 Cloud Security Index, Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have almost nothing in common. Here’s what the data looks like. How risk differs across cloud providers
Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake
A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities
Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a
Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers," Check Point Research said in a
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Sunday, September 6
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite I've started playing around with YouTube's "create video thumbnail", which hopefully will give me back a bit of time in my day (it used to be a manual job in Photoshop) and be a bit more interesting. And on that note, the imagery it's chosen this week is spot on: that Lockwood ES2100 electric strike looks like the perfect solution for my first fully installed Ubiquiti Access door lock. Having the door position sensor built in really simplifies things, and hopefully Ubiquiti will later add support to their hubs for the latch position and strike lock status. Once I'm back from this next round of travel, I should be able to do a full review of what it's like to actually live with.
Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and
Saturday, September 5
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. "A
Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets
FF-16-Web is a browser-based, interactive static pattern discovery tool that finds frequently occurring local 16-bit patterns across the entire file. It can run offline in a web browser. FF-16-Web is hosted on GitHub and it works in the same way like as the CLI and TUI versions.
Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackle the risk online ad data poses to troops, and more.
Friday, September 4
Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The
Homeland Security Investigations agents hit the outdoor retailer with a controversial subpoena as part of a dragnet search for the identities of protesters who entered a Minnesota church in March.
Thursday, September 3
ChatGPT, Claude, and Grok all suffered outages at nearly the exact same time for reasons that remain murky.
This week on Uncanny Valley, we dig into the latest prediction market buzz, Flock’s AI-powered police search tool, and how tech bros don’t know how to talk about “rouge” AI agents
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? To answer that question, Cloudflare is announcing early access to Vulnerability Discovery and Remediation, now part of Cloudflare Managed Defense . Vulnerability Discovery and Remediation is a new, invitation-only Cloudflare service that helps customers detect and mitigate vulnerabilities in their codebases. Through the OpenAI Daybreak Defense Network , we use OpenAI Daybreak models, including GPT-5.6 Cyber, for reconnaissance, hunting, and validation against codebases that you authorize us to access. If we detect a vulnerability, we will then propose solutions to you, automatically checking each proposed patch and any accompanying proposed mitigation before presenting them for review. Importantly, you are in the driver’s seat: while we may propose code patches and other mitigations, you decide whether they are implemented. Choosing what to fix first has always been hard. It's getting harder. Large language models can now surface weaknesses across a codebase in minutes , which means the number of findings keeps climbing. But the real problem is speed. Attackers can use AI to accelerate parts of vulnerability discovery and exploitation, giving security teams and developers less time to decide what matters and act on it. Imagine that your scanner tells you there's a vulnerability in a handler. It doesn't tell you whether that code is deployed. It doesn't tell you whether anyone is actually hitting that route, what security activity surrounds it, or what controls you already have
Overview Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.115.0 and earlier. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against arbitrary organizations by exploiting inconsistent object resolution between the authorization layer and downstream controllers. In multi-tenant deployments, an attacker with administrative privileges within a single organization can bypass tenant isolation and perform administrative operations against other organizations. Description CVE-2026-15630. The vulnerability stems from a desynchronization between authorization and action in multiple POST /api/{add,delete}- endpoints (e.g., /api/add-user, /api/delete-user, /api/add-permission) . While the global authorization filter ( routers/authzfilter.go ) correctly uses the ?id= URL query parameter as the authoritative target for authorization decisions, the affected controllers ( controllers/user.go , controllers/permission.go , etc.) ignore ?id= and operate solely on the owner and name fields in the JSON request body. As a result, authorization is evaluated against one object while the requested operation is executed against another, allowing an authenticated organization administrator ( IsAdmin=true ) to perform unauthorized administrative actions across tenant boundaries. Impact An attacker with administrative privileges in a single organization can compromise the isolation guarantees of a multi-tenant Casdoor deployment. Depending on the exposed endpoints and de
You know what you spent on penetration testing last year. But can you explain what that investment covered between engagements? For many organizations the honest answer is that it covered the weeks the testers were working against a scope agreed before they started. That was a reasonable arrangement when systems changed a few times a year. It is worth revisiting, now that many of them change weekly. The post Offensive Security Is Becoming a Program, Not a Purchase appeared first on Synack .
Heimdal’s MXDR team flagged a surge in detections tied to a program called Shift Browser on 2 September 2026. Our team confirmed activity on more than 50 client environments in a single day. The installers we captured trace to a malvertising lure. Shift Browser also runs a documented paid creator and affiliate marketing operation, though […] The post Shift Browser is signed adware that fingerprints your endpoint before it drops payload appeared first on Heimdal Security Blog .
WIRED rebuilt Flock’s latest search tool from code the company sends to a police officer’s browser. Its AI can keep watch across multiple cameras for anyone fitting a written description.
While the full implementation of the Cyber Resilience Act (CRA) won’t take effect until December 2027, another critical milestone is already approaching much sooner. Starting from 11 September 2026 , all manufacturers selling products with digital elements in countries of the European Union will be required to report actively exploited vulnerabilities in their digital products, as well as related security incidents, as well as security incidents that affect or compromise products already placed on the market. Incidents or vulnerabilities limited to development or internal environments are therefore only relevant if they result in (or could result in) a compromise of production devices. Although the platform itself is not yet available, the landmark legislation has already established a detailed framework and set of requirements. This article aims to summarize the most important aspects of the reporting process in order to help you prepare for these upcoming changes. Additionally, it provides clear guidelines for determining when a vulnerability or incident becomes mandatory to report. Overview In Chapter I, Article 14, §1, the Cyber Resilience Act states the following: A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. In the context of the CRA, an “ actively exploited vulnerability ” is defined as a “vulnerability for whic
Wednesday, September 2
Expert judgment is the scarcest resource in offensive security. Making it accessible to more of the world, continuously, is an engineering problem. The post Putting Experts on the Problems Only Experts Can Solve appeared first on Synack .
Why we merged NetSPI and Synack to bet against the loudest idea in security. The post Autonomy Was Never the Goal appeared first on Synack .
A new 13Cubed episode is out! 🍎 Windows forensics on a Mac usually means firing up a VM first. Not anymore. IRFlow Timeline is a free, open-source DF/IR timeline tool built natively for macOS. Feed it EVTX, Plaso, $MFT, or $J and go straight to process inspection, lateral movement, persistence, and VirusTotal enrichment. Featuring the tool's author, Renzon Cruz 👇 [https://www.youtube.com/watch?v=W9xHbNgZuT0](https://www.youtube.com/watch?v=W9xHbNgZuT0)
Tuesday, September 1
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images. A record available at this identity theft service that includes the drivers license for U.S. Defense Secretary Pete Hegseth, one of several high-ranking U.S. government officials whose drivers licenses can be found for sale. On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit , offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit. The service, dubbed Nexus , claims to have more than 153 million dri
Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. Description Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047 , affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent by resolve_trust_remote_code() . Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back. An attacker may p
This new fork includes strong ransomware detection with low fp rate. You can write a rule to detect any type of malware with this fork. Note: I don't recommend you install this on main machine because it requires to disable secure boot. Topic: [https://forum.xcitium.com/t/i-forked-comodo-openedr-to-improve-zero-day-ransomware-detection-via-behavior-detection/21302/1](https://forum.xcitium.com/t/i-forked-comodo-openedr-to-improve-zero-day-ransomware-detection-via-behavior-detection/21302/1) Video: Look repo Repo (Only install on VM): [http://github.com/hydraDragonAntivirus/HydraDragonAntivirus/](http://github.com/hydraDragonAntivirus/HydraDragonAntivirus/)
Memory costs are increasing dramatically. Both RAM and hard disk drive prices have exploded over the past year. At Cloudflare, we run several massively distributed storage products (including our famous CDN) that rely on making efficient use of the memory we have deployed so we can continue to serve all of our customers. With this in mind, we prototyped a way to expand effective cache capacity. By encoding eligible assets with Zstandard inside Pingora , the architecture trades a minor CPU increase for significant storage and cross-data center bandwidth savings. We have been prototyping a system called Cache Transcoding, which I built during my internship at Cloudflare as part of the 1.1.1.1 Intern Program . When an eligible response enters the cache, we encode it using Zstandard, or zstd, before writing it to disk. We keep that compressed form while the asset lives in the cache and moves between data centers via Tiered Cache , then decode it before serving the response to the client. In our initial testing, this encoding shrunk eligible assets to ⅓ of their original on-disk size on average. The estimated extra CPU cost in our origin-facing proxy was small, but that is the trade. A small increase in CPU gives Cloudflare petabytes of effective cache capacity and reduces the data transferred between our data centers. The encoding cost is paid once when an asset enters the cache. The storage and bandwidth savings continue every single time that asset is
The US Army’s laser system is part of a new generation of directed-energy weapons capable of detecting, tracking, and destroying drones with a concentrated beam of light.