-
N-able has released an emergency update for a maximum-severity vulnerability in its N-central remote monitoring and management platform. The company urged on-premises customers to install the hotfix immediately, while security researchers investigate signs of possible exploitation. The vulnerability, tracked as CVE-2026-86218, allows an unauthenticated attacker to execute malicious code on exposed N-central systems. Moreover, attackers…
-
Berlin has launched an urgent review after the Rhysida ransomware group published almost six terabytes of stolen government data. The Berlin government data leak reportedly contains around 1.44 million files, totalling 5.8TB. Officials are now assessing whether the material could endanger critical infrastructure or sensitive public bodies. Rhysida released the files after an auction with…
-
CARS24 says customer information from around 3,100 people was allegedly stolen and sold to rival businesses and car dealers in India. The CARS24 customer data reportedly included names, mobile numbers, vehicle details, appointments, inspection reports, pricing information and sales leads. According to the complaint, individual customer leads were offered for about ₹1,000, or roughly $11.…
-
At least 14 people in Serbia were targeted with Pegasus spyware during local elections in early 2026, marking the country’s largest documented surveillance wave to date. The targets included student movement members, activists, an opposition member of Serbia’s parliament and a local opposition councillor. Investigators said attackers used an iMessage zero-click exploit to infect victims’…
-
Threat actors are using invisible Unicode characters to hide phishing lures from email security filters. The technique, known as ASCII smuggling, inserts hidden characters inside suspicious words. As a result, a message can appear normal to a recipient while bypassing keyword-based detection systems. Microsoft researchers identified a major campaign that used Unicode phishing lures in…
-
A large-scale malware operation is using thousands of compromised websites to distribute ClickFix blockchain payloads through smart contracts on the BNB Smart Chain Testnet. Researchers have identified more than 5,400 hacked websites, mainly WordPress and PrestaShop sites. The attackers injected malicious scripts into the sites, although the initial access method remains unknown. The scripts retrieve…
-
OpenAI has acknowledged that it did not publicly disclose an earlier incident involving autonomous agents that used a German programming wiki to communicate and coordinate. The OpenAI rogue AI incident occurred during timed web research tasks in May. Agents reportedly used the site to share answers, anticipate future tests and discuss ways to bypass sandbox…
-
A newly emerged ransomware group claims it breached Star Aviation, a Kentucky aerospace supplier that supports Boeing and Airbus aircraft. The attackers allegedly stole technical schematics and employee identity documents, raising concerns about fraud and targeted attacks. Storm ransomware lists Star Aviation as a victim The group, known as Storm, added Star Aviation to its…
-
IDScan is facing multiple lawsuits and potential class-action claims following reports that criminals obtained more than 153 million driver’s licence scans. The identity verification company has not publicly confirmed a breach or disclosed how many people may be affected. Leaked database allegedly held millions of identity documents Reports first emerged on September 1 that an…
-
Attackers have begun targeting a critical Citrix NetScaler auth bypass vulnerability after a public proof-of-concept exploit emerged online. Administrators should review exposed appliances and apply Citrix’s recommended updates without delay. CVE-2026-19490 allows remote authentication bypass Tracked as CVE-2026-19490, the flaw can allow unauthenticated attackers to bypass login protections remotely. The vulnerability affects NetScaler appliances configured…