Skip to content
September 2026 Page 25

September 2026

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

Ravie LakshmananSep 22, 2026Malware / Cyber Espionage The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. “SideCopy campaign operations… 

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

Swati KhandelwalSep 22, 2026Vulnerability / Artificial Intelligence Malware already running on a Mac can quietly take over Meta’s Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has… 

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

Swati KhandelwalSep 22, 2026Vulnerability / Web Security A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that… 

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Ravie LakshmananSep 22, 2026Vulnerability / Endpoint Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing… 

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at… 

Contagious Interview Campaign Compromises 30,000 Devices, Steals .71M in Crypto

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to…