Cyber Security News
57K subscribers
209 photos
3 videos
114K links
Be Cyber Aware. Subscribe.

Our chat: t.me/cybersecuritynewschat

Our vacancies channel: @CyberSecurityJobs

LinkedIn: https://www.linkedin.com/company/securitynews/

๐Ÿ“ฉ Collab: cybersecnewsinfo@gmail.com

Paid Ads: @cybersecadmin
Download Telegram
N-able Discloses Actively Exploited N-central Zero-Day

N-able disclosed a maximum-severity, pre-authentication remote code execution flaw in its N-central remote monitoring platform used by managed service providers.

Tracked as CVE-2026-86218 with a CVSS score of 10.0, it lets unauthenticated attackers run arbitrary code on exposed servers.

Huntress observed active exploitation attempts against N-central appliances starting September 4.

N-able released Hotfix 4, urging all on-premises customers to upgrade immediately.

@Cyber_Security_Channel
โค5
Hacker Steals $340M in Bitcoin From Liquid Network, Returns Most After Bug Fix

A hacker stole roughly 4,000 bitcoin, worth about $340 million, from Liquid Network, a Bitcoin settlement system used by several crypto exchanges.

Blockstream confirmed the theft in a weekend post and paused operations while it investigates.

The attacker, calling themselves a "white hat," exploited a bug to drain the wallet and offered to return the funds once patched.

Blockstream fixed the flaw and recovered about 3,400 of the stolen coins, with roughly 600 (about $47 million) still held by the hacker.

@Cyber_Security_Channel
๐Ÿ‘€7โค3๐Ÿ”ฅ3๐Ÿ˜1
Join the Upcoming ImmuniWeb Webinar: โ€œAI in Penetration Testing: The Good, The Bad and The Uglyโ€.

โ†’ Explore how AI is transforming penetration testing, discover real-world benefits & risks, earn CPE credits, learn about latest AI application testing approaches.

โ„น๏ธ Key Insights:

โœ” Use of AI in pen testing: pitfalls, best practices
โœ” Risks & benefits of AI-driven pen testing
โœ” Testing LLMs for AI-specific vulnerabilities
โœ” OWASP Top 10 for LLM applications and emerging attack vectors
โœ” OWASP Top 10 for Agentic Applications
โœ” Red teaming and Continuous Breach & Attack Simulation (CBAS)
โœ” Legal and regulatory landscape of pen testing in 2026
โœ” Leveraging the MITRE ATT&CK Matrix for pen testing
โœ” Continuous vs. one-time pen testing
โœ” External vs. in-house pen testing
โœ” ImmuniWeb pen testing products

๐Ÿ“… Date: September 24, 2026

๐ŸŽค Host: Dr. Ilia Kolochenko, Founder & Chief Architect at ImmuniWeb

โœ… Registration โ†’ click here for personal access.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel
โค6๐Ÿ”ฅ2๐Ÿ˜1
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks

On Wednesday, the US cybersecurity agency CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, in line with BOD 26-04โ€™s requirements.

Cyber_Security_Channel
๐Ÿ‘3โค1๐Ÿ‘€1
๐Ÿ“Š 15 Cyber Threat Trends Security Leaders Need to Watch in 2026

SOC teams are under pressure to move faster, but more attacks now hide inside trusted platforms, legitimate login flows, and everyday business processes.

ANY.RUNโ€™s new report highlights 15 trends making detection and response harder, including:

๐Ÿ”น +483.7% growth in device code phishing
๐Ÿ”น +437% increase in fake CAPTCHA attacks
๐Ÿ”น +104.7% growth in ClickFix activity

See where detection gaps are growing and what security leaders should prioritize next.

๐Ÿ‘‰ Read the full report โ€“ tap here to access.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel
โค4๐Ÿ”ฅ1
As of recently: Revolut Confirms Data Breach via Fake Government Requests

British fintech Revolut confirmed a data breach after a fraudster used a spoofed government agency email domain to trick staff into handing over customer records.

Exposed data included customers' names, birth dates, addresses, phone numbers, and copies of passports and driver's licenses.

Revolut said a limited number of customers were hit, blocked the fraudulent address, and alerted law enforcement and regulators, adding that funds and systems remain secure.

@Cyber_Security_Channel
โค3
Google Confirms Gemini Autonomously Hacked Three Companies During Security Testing

Google confirmed its Gemini AI model autonomously breached the protected systems of three companies during red-team testing by security firm Irregular.

In one case, Gemini simply guessed a set of leaked credentials to gain unauthorized access, marking the model's first known autonomous hacks.

Irregular notified Google in late July, but the incidents stayed private until this week, when Google said Gemini had acted appropriately by halting each breach on its own.

@Cyber_Security_Channel
๐Ÿ”ฅ6โค3๐Ÿ˜1
North Korean Hackers Posed As Employers To Steal $11 Million In Crypto

Security agencies from the US, Japan, Germany, and Australia warned that North Korean group WaterPlum poses as employers to target software developers and IT professionals worldwide.

The group has infected more than 30,000 devices across over 100 countries.

Operators have drained nearly $11 million in cryptocurrency from over 7,000 wallets, funneling the funds back to North Korea.

Investigators found WaterPlum sharing infrastructure with North Korean IT workers embedded in corporate contracts.

@Cyber_Security_Channel
โค7๐Ÿ‘2๐Ÿ‘€2
๐Ÿค Cyber Security News is looking for ADVERTISERS

Our community is continuously growing and we are searching for exciting companies & products to share with our audience.

Requirements to Qualify

โ€ข Relevant to channels niche / industry
โ€ข Long-term approach and collaboration mindset
โ€ข $2,000+ monthly ad spend budget to invest in campaigns

What We Offer

โ€ข
Exposure to 80,000+ community members
โ€ข Personal success manager to scale your campaigns
โ€ข Brand awareness, leads, sign-ups, customers, followers, etc.

๐Ÿ“ฉ Contact for Partnership

If you are serious about promoting your business, send us an introduction Email โ†’ cybersecnewsinfo@gmail.com

Important Note

Spots to become a sponsor are limited.

Reach out before they fill up.

(we only have 7 left)

Let's talk soon!

- - - - -

@Cyber_Security_Channel
โค6๐Ÿ‘Ž3
Researchers Used Claude to Hack Into OpenAI

A three-person team at Hacktron AI used Anthropic's Claude Opus 5 to chain two vulnerabilities and breach OpenAI's systems under a bug bounty program.

The exploit began with a memory flaw in the libheif image library, triggered by a malicious photo upload on OpenAI's forum, letting attackers hijack the server and seize employee ChatGPT and Codex accounts.

Researchers disclosed the flaws, OpenAI patched them and paid a $6,500 bounty; the same exploit failed under Opus 4.8 but worked hours after Opus 5 launched.

@Cyber_Security_Channel
โšก8โค5
OpenAI Disrupts Encryption Bypass Used to Steal AI Reasoning Data

OpenAI disclosed that it disrupted a months-long campaign using a novel encryption bypass to extract protected AI reasoning data, without breaching its systems or databases.

By late July, the company had identified roughly 15,000 suspicious accounts behind over 16,000 extraction prompts and fully shut down the operation.

OpenAI linked a core cluster of the activity to individuals tied to Chinese AI rival Moonshot AI, though it offered no public technical evidence for the claim.

@Cyber_Security_Channel
โค11
Google Freezes Open-Source Bug Bounty Program Over AI Slop Submissions

Google paused its Open Source Software Vulnerability Rewards Program on October 1, citing a โ€œsignificant riseโ€ in automated, AI-generated bug reports.

The company said most of these submissions were invalid or contained outright hallucinations, overwhelming the engineers and maintainers who had to review them.

Google plans to resume the program with an update in early 2027 and is directing researchers to its other bug bounty programs meanwhile.

@Cyber_Security_Channel
โค4๐Ÿ˜3
๐Ÿšจ September Attacks US Security Teams Should Watch and Act on Now

September campaigns targeted US organizations with session theft, trusted-tool abuse, hidden delivery, and real-time fraud.

๐ŸŽฏ Industries in focus: Technology, manufacturing, government, healthcare, and consulting.

๐Ÿ”น CSuite: Steals Microsoft 365 sessions and compromises endpoints

๐Ÿ”น IronToll: Uses 114 domains for payment phishing

๐Ÿ”น Wazza: Hides phishing behind anti-bot filtering

๐Ÿ”น TerminalFix: Delivers malware through trusted components

Together, they enable account takeover, payment fraud, operational disruption, and costly response.

๐Ÿ‘‰ See the attack chains, close critical gaps, and get actionable IOCs for faster response. Read now by clicking here for the full material.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel
โค4๐Ÿ”ฅ4๐Ÿ˜1
Hackers Steal Records of 8 Million Citizens From Danish Government Database

Attackers abused a Danish company's lawful access to the Central Person Register, stealing names, addresses, and ID numbers of roughly 8 million citizens and residents.

The breach happened in September but wasn't found until October 2, and the government confirmed it as Denmark's largest data breach on record.

Minister Christina Egelund called it a serious incident, noting the exposure also includes citizens living abroad and the deceased, with no attacker yet named.

@Cyber_Security_Channel
๐Ÿ’ฏ8โค3๐Ÿ‘2๐Ÿ‘€2
AT&T to Pay $177 Million After Two Massive Customer Data Breaches

Federal judge approved AT&T's $177 million settlement over two massive 2024 customer data breaches, with no admission of wrongdoing.

The first exposed Social Security numbers and other details for 73 million customers after data surfaced on the dark web, while the second, tied to a Snowflake workspace breach, exposed call and text records for nearly all AT&T cellular customers.

The deal sets up $149 million and $28 million funds for the two incidents, though the claims deadline already closed.

@Cyber_Security_Channel
โค4๐Ÿ˜2
Ransomware Recovery CEO Indicted for $19M Fraud Scheme

Federal prosecutors indicted Zohar Pinhasi, owner of ransomware remediation firm MonsterCloud, for defrauding ransomware victims.

He allegedly charged clients over $19 million while secretly paying hackers $8 million in ransom, falsely claiming to use proprietary decryption tools.

Pinhasi pleaded not guilty to wire fraud and conspiracy charges in Brooklyn federal court and was released on a $2 million bond.

He faces up to 60 years in prison as the case exposes fraud in the unregulated ransomware recovery industry.

@Cyber_Security_Channel
โค8๐Ÿ˜4๐Ÿ‘€1
Governments Abuse Online Ads to Deploy Zero-Click Spyware

Researchers at Citizen Lab and Confiant disclosed that spyware vendors are hijacking online ad networks to infect devices with zero-click attacks requiring no user interaction.

The investigation ties Israeli ad platform Discover-Tech to spyware makers Candiru and Bindecy, which used it to target specific devices via malicious ad bids.

At least 45 Al Jazeera computers were hacked in 2024-2025, and bidding data shows ads reaching militaries, governments, and agencies like the IAEA and ICC.

@Cyber_Security_Channel
โค5
Join the ImmuniWeb AI Platform Webinar: New Products and Capabilities (Q3 2026 Update) to discover the latest products, capabilities and innovations of the ImmuniWebยฎ AI Platform, earn CPE credits, and explore practical ways to strengthen cybersecurity while reducing operational costs.

โšกKey Insights:

โœ”๏ธ New cybersecurity & compliance products by ImmuniWeb

โœ”๏ธ Latest product features, functionalities and integrations

โœ”๏ธ Practical use of Machine Learning and AI by ImmuniWeb in 2026

โœ”๏ธ Cybersecurity cost reduction strategies

โœ”๏ธ Cybersecurity compliance with ImmuniWeb

โœ”๏ธ Live demo of the ImmuniWeb AI Platform

โœ”๏ธ 2026 product roadmap and upcoming capabilities

๐Ÿ“… Date: 22nd of October, 2026.

The 60-minute webinar will be held in English, with live subtitles available in 35+ languages. You can join via Zoom or Microsoft Teams.

๐ŸŽค Host: Dr. Ilia Kolochenko, Founder & Chief Architect at ImmuniWeb

โœ… Registration โ€“ tap here to secure your spot.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel
โค3
Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide

A cybercriminal operator used AI agents built on OpenAI's Codex and DeepSeek to automatically develop and launch exploits against internet-facing PaperCut print-management servers.

GreyNoise said the campaign compromised at least 440 servers across 395 organizations in 48 countries, chaining two flaws, CVE-2026-81578 and CVE-2026-82078, to bypass authentication and gain remote code execution.

PaperCut urges customers to update to patched releases 26.0.5, 25.0.13, or 24.1.10 to close the vulnerabilities.

@Cyber_Security_Channel
๐Ÿ‘3๐Ÿ”ฅ1๐Ÿ‘1
๐Ÿ” Whatโ€™s Really Attacking Your Industry? Insights From 74K Sandbox Analyses

ANY.RUN analyzed 74,086 sandbox sessions from a financial organization to uncover what threat data can show about enterprise security:

๐Ÿ“Š 12.8% of submissions were malicious, compared with the 13.0% banking-sector median

โšก 15.1 seconds median time to detect threats, versus 16.9 seconds across the banking sector

๐Ÿ’ป 88.2% malicious yield for PowerShell scripts, the highest among analyzed file formats

๐Ÿ•ต๏ธ 19 unique malware families observed, placing the organization in the top 1% of banking-sector peers for malware family diversity

For SOC leaders, individual verdicts tell only part of the story. @anyrun_app combines interactive sandbox analysis with industry-wide threat intelligence to help enterprise security teams understand their threat landscape and measure SOC performance.

Read full article here to discover what threat data can reveal about your organization.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel
โค4๐Ÿ‘4๐Ÿ‘2