False
        

Texte déclencheur Texte ignoré Texte bloqué

-->
      #1 Trusted Cybersecurity News Platform
    Followed by 5.70+ million   
    
    
     Get the Latest News
    * Home
    * Newsletter
    * Webinars
    * Home
    * Threat Intelligence
    * Vulnerabilities
    * Cyber Attacks
    * Webinars
    * Expert Insights
    * Awards
    
    
    
      Resources
      * Webinars
      * Awards
      * Free eBooks
      About Site
      * About THN
      * Jobs
      * Advertise with us
    Contact/Tip Us
      
    Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback!
    Follow Us On Social Media
        
     RSS Feeds  Email Alerts

  The Hacker News | #1 Trusted Source for Cybersecurity News

                  OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause

                     Aug 10, 2026 Artificial Intelligence / Threat Detection
                    OpenAI has announced that it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity. In response to the discovery, the AI upstart said it's implementing security controls for higher-capability models and associated activities, such as isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution. "We are pausing internal activities involving Astra that do not yet meet these strengthened security control requirements," it said in a statement. "We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation. Monitors evaluate the model's Chain of Thought and trigger a security re...

                  Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

                     Aug 08, 2026 AI Security / Enterprise Security
                    Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor , an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was enough to make the assistant gather internal data and send it out through a URL request, with no separate approval step. The firm published on August 5, 2026 and said the chain still worked with Rovo's web-search option switched off. That bypass is single-sourced, and the report establishes the finding's status only on that date; a later remediation is not confirmed here. Varonis Threat Labs put the instructions in a link instead. It found that the rovoChatPrompt URL parameter would preload attacker instructions into Rovo Chat, so one click from an authenticated user was enou...

                  New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

                     Aug 08, 2026 Email Security / Vulnerability
                    New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. PortSwigger researcher Gareth Heyes presented the work at Black Hat USA 2026. One Outlook/Firefox chain spoofs a Microsoft sign-in screen and captures the password a recipient types. A Yahoo/AOL paste race can expose a Medium email-login token and let an attacker sign in as the victim. A Gmail/Cowork chain can exfiltrate a Slack token after prompt injection and user interaction. The paper presents proof-of-concept research and does not report malicious exploitation. Public PoCs remain available as of August 8. The researcher said Fastmail fixed two CSS mutation bugs and a Proton Mail proxy bypass stopped working when he re...

                AI Threat Readiness 101

                  Wiz Cloud Security / AI Security
                  Learn the four pillars of AI threat readiness and how security teams can reduce risk faster with detection, validation, and remediation built for today's threat landscape.

                  Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

                     Aug 08, 2026 Zero-Day / Vulnerability
                    Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance. Armed with the elevated access, the attacker can change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above," Metabase said in an advisory. Metabase Cloud instances have already been updated to the latest version. Users running self-hosted versions are advised to apply security patches released b...

                  N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

                     Aug 08, 2026 Vulnerability / Enterprise Security
                    N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. "We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques," the company said. "This is not a duplicate of our previous communication. Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers." The disclosure comes as N-able acknowledged that it detected unusual activity within a customer's environment on July 31, 2026, leading to the discovery of unknown threat actors exploiting a then-zero-day flaw in the N‑central server (CVE-2026-18577, CVSS score: 8.2). It impacts all versions prior to 2026.3.1.7. It's worth noting that CVE-2026-18577 relates to an i...

                The State of Shadow AI in 2026 (And How Attackers Are Taking Advantage)

                  Push Security Shadow AI / Browser Security
                  AI adoption has exploded, but every new app, integration and extension introduces new threats and risks.

                  Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

                     Aug 08, 2026 Vulnerability / Network Security
                    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.6), is a command injection flaw that could be weaponized to achieve arbitrary code execution on susceptible devices. "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints," CISA said . In an analysis published in June 2026, watchTowr Labs described the issue as present in a function named "escape_quotes()" within the load balancer application and that it stemmed from improper handling of user-supplied input, ultimately enabling command injection. Successful exploitation of the...

                  Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

                     Aug 07, 2026 Malware / Browser Security
                    A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul McCarty said . Unlike other npm-oriented software supply chain attacks that make use of lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code, the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages. The attack leads to the execution of a downloader named WEL1DROPPER , which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers...

                  ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

                     Aug 07, 2026 Malware / Social Engineering
                    ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that's compatible with the computer's CPU architecture. "While the malware payload is capable of stealing passwords, its most interesting function is its capability to slowly deplete cryptocurrency accounts, siphoning their contents into accounts under the threat actor's control," Huntress security researcher Andrew Brandt said . The attack chain begins with pasting a ClickFix command into the Terminal app, triggering the execution of a Bash profiler/loader that collects extensive system details and then retrieves a Mach-O payload that matches the victim's processor architecture. The payload is a Go-based stealer that can ...

                  UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

                     Aug 07, 2026 Phishing / SaaS Security
                    A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671 . "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via their personal mobile devices," Google Threat Intelligence Group (GTIG) and Mandiant said in a report. These calls are designed to trick victims into spoofed login portals where adversary-in-the-middle (AitM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. The threat actors then leverage the captured data to establish session persistence and deploy automated Python and PowerShell scripts for data exfiltration from enterprise cloud environments and SaaS applications, including Microsoft 365 and Okta. According to the tech giant, UNC6671 has d...

                  New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

                     Aug 07, 2026 Web Security / Vulnerability
                    WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. Tracked as CVE-2026-64638 (CVSS score: 8.9), the high-severity vulnerability requires no attacker privileges. According to pwn.ai , which discovered the flaw and shared technical details with The Hacker News, the login-page XSS requires no authentication. Once a crafted username reaches the failed-login error page, the resulting JavaScript executes in the visitor's browser with no further interaction required on that page. The code-execution path requires a victim already logged in as an Administrator and explicit interaction with an attacker-controlled page. In pwn.ai's demonstration, that interaction is one ordinary click. The researchers told The...

                  Growing Up The Hard Way

                     Aug 07, 2026 Security Compliance / Software Security
                    Open Source had a great childhood. For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who was watching. It ran the kind of lemonade stand that took IOUs from anyone who wandered up — take what you need, pay me back whenever, no need to leave a name. It was idyllic. It was also, in retrospect, a little feral. Then, somewhere around 2020, its voice started to crack. It tried to grow a beard. Acne everywhere. SolarWinds, then Log4Shell, then TeamPCP and Shai-Hulud — the supply chain woke up one morning like the end of Ender's Game : the simulation had been real the whole time. Those were real battles. Real systems, real money, real people, all of it quietly leaning on code we'd been treating like a practice round. And then the adults showed up with rules: executive orders, European regulations, permission slips for half the places it wanted to go. What it did not get was a nice, slow, storybook ...

                  18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

                     Aug 07, 2026 Linux / Vulnerability
                    A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it. Anyone running an older kernel with SCTP reachable should update. Tracked as CVE-2026-64564 and named SCTPhantom by its finders, the flaw was disclosed publicly on August 6, two days after the kernel CVE team assigned it. No public exploit code had surfaced at the time of writing, and The Hacker News found no entry for the flaw in CISA's Known Exploited Vulnerabilities catalog as of August 7. The flaw is local, not remote, and it needs SCTP reachable on the target, which limits exposure. Where those conditions held, Tencent Zhuque Lab reports it got root on the kernel builds it tested for Debian 13, Ubuntu 24.04, Rocky Linux 9 and RHEL 9, and ...

                  New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

                     Aug 07, 2026 Network Security / Vulnerability
                    Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026 , the research found affected behavior across independently developed implementations, including Windows and Linux. Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack. NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure. There is no single patch for the broader attack class. Organizations should apply available Windows and Linux updates and encryp...

                  Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

                     Aug 07, 2026 Phishing / Email Security
                    Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. "The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic," Arctic Wolf Labs said . "Automated activity maintains compromised sessions at approximately eight-hour intervals." The activity is assessed to impact organizations across healthcare, education, manufacturing, government, and professional services sectors located in the U.S., Canada, and Europe. It shares tactical overlaps with Payroll Pirate attacks tracked by Microsoft under the moniker Storm-2755 . Payroll Pirates is the designation assigned to a broader financially motivated threat cluster that involves hijacking the accounts of employees to reroute sal...
            Next Page 
            ⚡ Top Stories This Week

                  New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit

                  Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

                  Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

                  AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

                  Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs

                  Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

                  OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark

                  Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data

                  Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs

                  Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

                  Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

                  Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

                  ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

                  Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say

                  Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

                  ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link

                  Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

                  Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

                  Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

                  Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
          ⭐ Featured Resources

                [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions

                Download the 5-Step Action Plan for AI-Speed Exploitation

                Get the Checklist for Gaining Control of AI Use Across Your Organization

                Get the 2026 CISO Benchmark Report Based on 600 Security Leaders
      Expert Insights Articles Videos

      How AI-Assisted Attacks Are Breaking Legacy SIEM Tools

         August 3, 2026 Read ➝

      A Look Inside Lasso's AI Security Platform

         July 27, 2026 Read ➝

      Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One.

         July 27, 2026 Read ➝

      How to Make Social Engineering Unprofitable

         July 22, 2026 Read ➝
    Cybersecurity Resources
        11 Real Stories: How Identity Exposure Unlocks Active Attack Paths
      Map cross-domain privilege escalation to sever breach routes at key choke points.
        Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On
      35 labs plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C.
        SANS AI Cybersecurity Summit Returns This November
      Learn how practitioners are applying AI to today's cybersecurity challenges.
    ​
        Get the Latest News in Your Inbox

      Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.

        Email
      Connect with us!
        
          2,000,000 Followers
        
          725,000 Followers
        
          25,500 Subscribers
        
          172,000 Followers
        
          1,990,000 Followers
          60,000 Followers
        Company
        * About THN
        * Advertise with us
        * Contact
        Pages
        * Webinars
        * Awards
        * Privacy Policy
         RSS Feeds
         Contact Us
      © 2026 The Hacker News. All Rights Reserved.