The Hacker News #1 Trusted Source for Cybersecurity News

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity. Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. The new office will serve as the central authority for cybersecurity policy covering US ports, vessels, and maritime facilities.

SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks. Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices. „The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users,“ Microsoft said . As AI dramatically shortens the time from https://www.ilaca.info/finding-parallels-between-and-life-2/ vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.

An active malware campaign is using https://master-your-business.com/how-can-you-implement-iot-in-your-business/ bogus software-download websites to impersonate trusted vendors and distribute malicious installers. „So defenders have an early advantage, to help them protect vital infrastructure – which in turn protects people who rely on those systems.“ The tech giant said it’s currently working with over 650 partners globally, including CrowdStrike, Datadog, Menlo Security, Palo Alto Networks, and Snowflake. A total of 22 patches were releaased, a majority for code execution, privilege escalation, and information disclosure vulnerabilities. The company has notified the SEC that hackers accessed patient, employee, provider, business, and financial information. The defendants unsuccessfully attempted to physically install malware on ATMs to force them to dispense cash.

Dropbox Says 5,000 Accounts Were Compromised Through Lenovo ID Authentication Flaw

Organizations must focus on adopting AI at business speed without losing control of cyber risk. The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its .git directory intact, which a shared archive, a shared drive, a sync folder, or a USB stick preserves, whereas an ordinary clone does not. The installers, once launched, deploy malware that’s capable of setting up persistence, weakening security protections, and communicating with attacker-controlled infrastructure. Dropbox has disclosed that approximately 5,000 user accounts were compromised in August after attackers exploited a weakness involving its Lenovo ID sign-in integration. A wave of cyberattacks across the US and Europe in August exploited the trust businesses place in everyday tools, turning Microsoft 365 logins, remote-management…

• The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its .git directory intact, which a shared archive, a shared drive, a sync folder, or a USB stick preserves, whereas an ordinary clone does not.
• Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication.
• The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems.
• A later session that attempted to extend the exploit into a command-and-control (C2) implant w…

• Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.
• The industrial giant has released advisories for its RSLinx Classic, ArmorStart, ControlFLASH, FactoryTalk, and other products.
• The program is available to a group of Google Cloud customers, government agencies, and cybersecurity partners.
• An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.
• Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.

Virtualizor released Patch 9 with a Security Analyzer on September 1, but the vendor said cryptographic package signing remained future work. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1. The Windows maker has assessed with moderate confidence that the campaign is consistent with a Chinese threat cluster dubbed Silver Fox (aka Yinhu), which has a track record of using spoofed vendor download pages to distribute Gh0st RAT and ValleyRAT (a… The program is available to a group of Google Cloud customers, government agencies, and cybersecurity partners. Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program .