Breaking news and updates from the world of technology.
Three threat clusters — a Qilin ransomware affiliate, a Sandworm-linked APT deploying Cyclops Blink, and a credential-theft group — exploited Cisco's CVE-2026-20079 and CVE-2026-20316.
GreyNoise says a Russian-speaking actor used Codex and DeepSeek-powered agents to exploit two PaperCut flaws, reaching full domain admin at one U.S. high school in seven minutes.
CVE-2025-14733 was first flagged as exploited in December. Nine months later, nearly 9,000 unpatched Firebox firewalls remain exposed, and CISA says ransomware gangs are now using the flaw.
CVE-2026-20079 has a CVSS score of 10.0 and lets unauthenticated attackers execute root commands on Cisco FMC devices. CISA has added it to the KEV catalog with a September 12 federal patch deadline.
A joint US intelligence advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI in a campaign that allegedly extracted billions of tokens from Claude, GPT, Gemini, and Grok since 2024.
Microsoft's monthly security update patches 973 vulnerabilities — including two Windows zero-days under active exploitation that CISA added to its Known Exploited Vulnerabilities catalog the same day.
A campaign using the EtherHiding technique stores malware payloads in BNB Smart Chain contracts, making infrastructure takedowns nearly impossible.
Attackers are actively backdooring online stores through StyleSmuggler, a zero-day in Magento and Adobe Commerce that enables unauthenticated remote code execution across all current versions.
Unauthorized attackers accessed C-Track, Thomson Reuters' court case management platform, for four months — potentially exposing SSNs, health data, and sealed court documents.
CVE-2026-20212 leaves two TCP ports reachable on 10 Silicon One-based Nexus 9000 switches, letting unauthenticated attackers execute code as root on the data center fabric AI clusters depend on.
A critical unauthenticated remote code execution bug in the open-source Langflow platform is being actively exploited, with attackers specifically querying environment variables for OpenAI API keys, AWS secrets, and Langflow superuser credentials. Attack volume has grown from 50 to 360 attempts in days.
A high-severity authentication bypass in Exchange Server 2016, 2019, and Subscription Edition lets attackers take over any mailbox on a vulnerable server. Microsoft patched it in August, but Shadowserver found nearly 22,000 unpatched servers still exposed online — 85% of Germany's on-premises fleet among them.