The Edge of the Cyber World See the latest
The U.S. Cybersecurity and Infrastructure Security Agency confirmed this week that ransomware gangs are now exploiting a critical WatchGuard Firebox firewall vulnerability, a flaw that has sat on the agency’s Known Exploited Vulnerabilities catalog since December 2025. The update, reported first by BleepingComputer, arrived in a routine Thursday KEV catalog refresh that flipped the entry’s…
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. “The
With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable…
A university CISO just told the cybersecurity press exactly how he refused to pay a $1.25 million LockBit ransom demand and still got every system back online. In an interview published September 14, 2026, Infosecurity Magazine sat down with Zach Lewis, CIO and CISO of the University of Health Sciences and Pharmacy (UHSP) in St.…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security…
A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. “Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,” Acronis Threat Research…
A threat actor spent roughly a week in late August 2026 doing almost nothing by hand. Instead, hundreds of autonomous AI agents did the scanning, the exploit-building, the breaking-in, and much of the follow-up looting across 395 organizations in 48 countries. Security researchers had warned for years that this moment was coming. According to Help…
Security operations centers spent 2025 experimenting with AI copilots. By September 2026, the experiment is over and a new product category has hardened: the AI SOC analyst platform, software that does not just summarize an alert but plans an investigation, queries the SIEM and EDR itself, and returns a verdict with cited evidence. Three vendors…
Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as…
Multiple espionage-motivated threat actors have adopted BlueMoon in opportunistic, rushed deployments. The post BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days appeared first on SecurityWeek.
