Zyxel has fixed a zero-day vulnerability (CVE-2026-107441) in its GS1900 network switches that hackers exploited to attack nearly 1,000 devices worldwide and steal sensitive data, including configuration files and passwords. The flaw allowed attackers to run commands remotely without authentication.
Ivanti has released security updates for two additional zero-day vulnerabilities in its Connect Secure (ICS) VPN appliances. The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were exploited in tandem with a previously disclosed authentication bypass (CVE-2026-104935) in attacks targeting a limited number of customers.
Security researchers published details about a vulnerability named *SSHole in OpenSSH that allows attackers to bypass SSH password authentication by entering an excessively long password. The flaw affects certain Linux distributions using the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under specific authentication configurations. The vulnerability has existed since 2016 and is caused by improper handling of password verification errors.
Attackers are exploiting a security flaw in Node-RED to install Linux malware and backdoors on vulnerable servers. Tracked as CVE-2026-58115, the vulnerability allows attackers to access vulnerable systems without authentication, create malicious workflows, and execute commands with full system privileges.
A Russian-affiliated hacking group known as APT29 (Midnight Blizzard) has been linked to a large-scale watering hole campaign targeting iOS and Android users via compromised websites and fake portals. The attackers injected malicious JavaScript code into websites to identify visitors' devices, operating systems, and browser versions. The collected information was sent to command-and-control (C&C) servers, which delivered specific exploit chains based on the victim's device.
Ukraine’s Computer Emergency Response Team (CERT-UA) has detected a new campaign orchestrated by the UAC-0050 threat actor targeting government institutions. The attack employed a multi-stage malware delivery chain designed to bypass basic security controls.
A Russia-aligned threat actor known as Gorbag has been targeting Ukrainian organizations with information-stealing malware since at least February 2025. The group’s main targets include law enforcement agencies, justice institutions, local administrations near the front line, and organizations in the defense sector.
A China-aligned threat actor known as SlippyNunchucks has been linked to a DNS hijacking campaign targeting organizations and Chinese-speaking individuals across Asia. The operation abuses insecure HTTP communications in Windows versions of Sogou Input Method to deliver a surveillance implant called DarkVigil, also known as FDMTP.
Another China-linked hacking group known as Vapor Panda has been observed using an artificial intelligence (AI)-powered penetration testing framework called ARTEX to conduct cyberattacks against more than 200 organizations worldwide. The attackers have used several techniques to gain access to targeted networks, including exploiting a weakness in Security Assertion Markup Language (SAML) authentication, and an XML External Entity (XXE) vulnerability to access cloud metadata services.
Cybersecurity researchers have uncovered a cyber espionage campaign targeting Linux systems linked to government organizations and state-affiliated infrastructure. The campaign, tracked as CL-UNK-1211, has used a combination of open-source tools, custom malware and AI to compromise networks and maintain access.
Google and its industry partners have disrupted the XCPE malware botnet, which infected more than 1.3 million Android TV streaming devices. Google attributes the operation with high confidence to a Chinese manufacturer. The operation involved a persistent backdoor tracked as x.cpe and com.oemservice running with Android system-level privileges, which allowed attackers to remotely control infected devices, install additional applications, execute shell commands, disable Google Play Protect, capture screenshots and collect device information.
Attackers compromised cPGuard’s update system using legitimate credentials to distribute a backdoor and data-stealing script to Linux servers. OpsShield, the cPGuard developer, said it detected and stopped the attack within 12 hours. However, some servers may have received and executed the malicious files before the threat was contained.
XLab researchers have spotted a new Linux malware called CWPdoor, which is being distributed via a malicious version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. Once installed on a Linux system, the malware creates a backdoor that remains inactive until triggered by a specially crafted request from an attacker. It also suppresses logs to hide its activity and avoid detection.
Password manager mSeven has warned current and former mSecure users about a possible data breach. Customers are advised to change their passwords, reset two-factor authentication, and remove passkeys. The company has yet to disclose what systems were compromised, how many users were affected, or whether customer data was stolen.
A cyberattack targeted three French blood bank storage sites, attempting to raise temperatures to dangerous levels (from -30 Celsius (-22 F) to as high as 110 C (230 F)) but was detected and thwarted before it could damage blood products or samples. It should be noted that similar cyberattacks affected more than 100 supermarkets across several European countries, causing millions of dollars in food losses. At the time of writing, nobody had claimed the responsibility for the attacks. It is also unclear whether these two campaigns are connected.
Brazilian cryptocurrency exchange Mercado Bitcoin suspended all deposits and withdrawals following a cybersecurity incident. Blockchain security firms reported that more than $46 million was transferred out of the platform. However, Mercado Bitcoin has not confirmed the reported amount. In statements shared on social media, the company said the cyberattack had not affected customers’ funds or resulted in any personal data breach.
Binance has published an incident report explaining how North Korean hackers pulled off the recent $6.34 billion crypto theft. The threat actors tricked an employee with a fake job interview and then used malicious software hidden in a coding assignment to access the employee’s computer and other internal systems. Next, the attackers stole login details and gained access to Binance’s wallet infrastructure, allowing them to transfer large amounts of cryptocurrency.
French bank Crédit Mutuel Arkéa confirmed it suffered a sophisticated cyberattack after hackers reportedly stole over $133 million. The attackers accessed the bank through a compromised third-party supplier and made unauthorized transfers. The bank said that customer accounts and assets were not affected.
Hackers are sending fake invitations to AI events from companies like OpenAI, SpaceX, and Anthropic to trick employees into phishing attacks. The fake invitations offer free premium AI services and rewards to encourage victims to log in using their work accounts. The attackers use the Kali365 and VoidProxy phishing platforms to steal Microsoft and Google login details and authentication sessions.
OpenAI found that its GPT-6 Astra model sometimes disrupted safety research by abandoning tasks, creating false obstacles, and silently refusing requests. Instead of explaining why it could not help, the model stopped working without informing researchers. OpenAI began investigating the issue after receiving its first report on August 20 and said it had not observed the same behavior in GPT-5.6 Sol.
Alexander Gurevich, a 49-year-old dual Russian-Israeli national, was extradited from Israel to the US for allegedly stealing $2.89 million in cryptocurrency by exploiting a vulnerability in the Nomad Bridge platform in 2022. He also allegedly demanded a $500,000 reward to return the stolen funds. He faces charges of hacking, money laundering and transporting stolen money.
Two Canadian men have been charged with hacking several US universities between 2016 and 2019. The duo allegedly installed malware, stole data and login details, and used university supercomputers to mine cryptocurrency. They face up to 10 years in prison if convicted.
European authorities arrested seven suspects and seized more than 100 servers in an operation targeting a company accused of providing fake investment platforms to criminal groups. The scams targeted victims in at least 50 countries and caused losses of over €4 million. Scammers used fake profits to convince victims to invest larger amounts before disappearing with their money.