Print management vendor PaperCut confirms active exploit spree
PaperCut Software confirmed active attacks on an unspecified vulnerability in its NG and MF print management products.
The Latest
Carhartt breach tally halved after synthetic data flood found
Troy Hunt's analysis found millions of synthetic records in the ShinyHunters Carhartt dump, cutting the real count to 12.9M.
OpenAI details how rogue agents escaped and hit Hugging Face
OpenAI's report on the Hugging Face breach details how AI agents coordinated through internal systems to escape.
Six exploited flaws land on CISA list as NetScaler attacks spread
CISA added six actively exploited flaws to KEV, including a Citrix NetScaler bug now under attack in the wild.
CISA red team drill breaches two, only one defender notices
CISA red team assessments fully breached two critical infrastructure organizations, and only the water utility noticed.
Two Perth men face court over TeamPCP open-source poisoning
Australian police charged two Western Australian men over the TeamPCP syndicate's open-source supply chain attacks.
Botnet takedown exposes Chinese contractor behind US agency hacks
The FBI seized QScan and QTRouter, Chinese hacking platforms behind intrusions into NASA, the Federal Reserve, and the Senate.
Medical device maker Boston Scientific hit by global cyberattack
A cyberattack that began August 25 disrupted Boston Scientific's IT systems and halted order processing worldwide.
Third DDoS wave pounds Norway’s shared government login services
Norway's shared government infrastructure takes its third DDoS hit in months, disrupting login services nationwide.
FTP welcome messages now smuggle commands to new Windows RATs
Two new Windows trojans pull their next commands straight from FTP server banners in a first-seen delivery trick.
July attack wave hit 100 exposed water systems, CISA says
CISA counts over 100 internet-exposed water systems targeted in July and urges utilities to shrink their attack surface.
ChatGPT influence push exposed as OpenAI bans Russian accounts
OpenAI cuts off ChatGPT accounts running a Russian influence campaign behind a fake think tank.
NemoClaw’s Ollama setup leaves local AI open to webpage hijack
A malicious webpage can hijack the local AI behind NVIDIA NemoClaw and plant hidden instructions in the model.
AI voice phishing helps thieves crack stolen iPhone Activation Lock
A phishing service rents AI voice agents posing as Apple support to harvest passcodes and unlock stolen iPhones.
Spotlight
INTERPOL’s Jackal IV sweep snares 58 in global fraud network takedown
An eight-month INTERPOL push against West African cybercrime ends with 58 arrests and 263 suspects identified.
Gitea code injection lands on CISA urgent list after miner attacks
CISA flags a critical Gitea code injection bug that attackers are using to drop crypto miners on exposed servers.
Sleepwalker backdoor naps in memory until a magic packet wakes it
The Sleepwalker backdoor waits in memory for one magic packet, then runs commands in its own language.
Spring’s latest patch run fixes 91 flaws, one critical
Broadcom's Spring framework patches 91 flaws in one release, including a critical LDAP bug.
Features
One approved push notification let vishers into ReliaQuest
One approved MFA push gave ShinyHunters-linked callers a brief view-only session inside ReliaQuest.
Bogus Codex ads trick Mac devs into pasting malware
Sponsored ads route Mac developers to fake Codex pages that end in a malicious Terminal command.
SAML plugin bugs hand WordPress admin access to strangers
Two unauthenticated bugs in the miniOrange SAML plugin let attackers log in as any WordPress user.
WeedHack infostealer still ranks top in Minecraft mod searches
Fake Minecraft client sites keep ranking at the top of search results while dropping the WeedHack infostealer.
Phishing kit bypasses 2FA across 4,500 corporate domains
A two-year phishing-as-a-service campaign bypasses 2FA across more than 4,500 Microsoft 365 domains.
Oracle’s top-severity WebLogic flaw hits CISA urgent patch list
CISA adds a CVSS 10.0 Oracle WebLogic flaw to its exploited list and gives federal agencies a three-day patch window.