CyberSecurity News

Source: SecurityWeek

953 Online Stores Infected in Long-Lasting Malware Campaign

<p>Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.</p> <p>The post <a href="https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/">953 Online Stores Infected in Long-Lasting Malware Campaign</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

Source: Security Affairs

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof [&#8230;]

Source: SecurityWeek

Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

<p>The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts.</p> <p>The post <a href="https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000/">Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Source: The Hacker News

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion

Source: SecurityWeek

Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

<p>An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.</p> <p>The post <a href="https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/">Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

Source: Security Affairs

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates [&#8230;]

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
Source: The Hacker News

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor

Source: SecurityWeek

Mythos 5 Ignored Real-World Harm in July Attack

<p>The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.</p> <p>The post <a href="https://www.securityweek.com/mythos-5-ignored-real-world-harm-in-july-attack/">Mythos 5 Ignored Real-World Harm in July Attack</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Source: The Hacker News

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across

Source: Security Affairs

Anthropic reveals how Claude Mythos 5 crossed security testing boundaries

Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and [&#8230;]

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Source: The Hacker News

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to&nbsp;an analysis&nbsp;by cloud security company Wiz. A&nbsp;GitHub safeguard&nbsp;that pauses

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
Source: The Hacker News

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm&nbsp;Forever Security said&nbsp;in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file

Source: Security Affairs

SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At [&#8230;]

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
Source: The Hacker News

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Source: The Hacker News

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor

Source: Security Affairs

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users&#160;&#160; &#160;&#160;&#160; Plex vulnerabilities being exploited in the wild to drop a cryptominer&#160;&#160; WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable [&#8230;]

Source: Security Affairs

Security Affairs newsletter Round 601 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Addresses U.S. CISA adds Arista VeloCloud Orchestrator&#160;flaw to its Known [&#8230;]

Source: SecurityWeek

Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave

<p>Founded in 2025 by Unit 8200 alumni, Tel Aviv-based Mave uses AI agents to investigate alerts across existing security stacks.</p> <p>The post <a href="https://www.securityweek.com/former-unit-8200-officers-raise-34-million-for-agentic-secops-startup-mave/">Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

Source: Security Affairs

OpenAI Paused Frontier AI Training After a Security Incident

OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents [&#8230;]