Welcome. Not every interesting story makes the headlines. Here you’ll find stories about hackers, technology, history, crime, business, and the people behind them. If you’re curious, you’ll fit right in.

What if a stranger could poison your CRM… and your AI agent did the rest? That’s essentially what researchers demonstrated with Salesforce Agentforce. The attack was called SalesBleed. An attacker could submit a malicious Salesforce Web-to-Lead form containing hidden instructions. The attacker didn’t need to authenticate to the Salesforce environment. The malicious instructions could sit inside the CRM until an employee later asked Agentforce to process a lead. That’s where things got interesting. The researchers found ways to manipulate Agentforce into accessing CRM data and sending information to attacker-controlled infrastructure without requiring the victim to click a malicious link. The researchers also found a separate issue in the Agentforce + Slack integration that could allow the agent to send phishing messages using the agent’s trusted identity. Think about that for a second: A phishing message from an unknown email address → suspicious. A phishing message appearing to come from a trusted AI agent inside your company’s Slack → potentially much more convincing. And this is the bigger lesson: AI agents don't just process prompts. They can access data, call tools, and interact with other systems. So if an attacker can control the data an agent reads, that data can potentially become an indirect way of controlling the agent. SalesBleed shows why AI security can't stop at protecting the model. You also have to secure: The data agents consume
 The tools they can call
Their permissions
External URLs and destinations
Cross-platform integrations Human approval for sensitive actions
The boundary between trusted and untrusted data Salesforce says the reported attack paths have been fixed. But the architectural lesson goes far beyond Salesforce: Never assume data is harmless just because it entered your system through a legitimate workflow. With AI agents, untrusted data can become instructions. And an instruction inside a trusted agent can become an action.

Imagine deploying your application in the cloud.. Then discovering that your container could potentially read pieces of data left behind by another customer. That's what researchers found in Cloudflare Containers. The vulnerability affected Cloudflare Containers and Sandboxes, which run workloads on shared infrastructure. The problem was buried in how Cloudflare reused storage blocks between containers. A configuration called skip_block_zeroing meant that reused 64 KB storage blocks weren't completely cleared before being assigned to another workload. Researchers found they could write just 4 KB to a block and potentially read the remaining 60 KB. That leftover space could contain data from a previous customer. And this wasn't just theoretical. The researchers found residual material on 18 of 24 tested container placements across 20 of 22 underlying nodes. They identified things such as directory structures, database pages and SQLite databases. That's a serious cloud security problem because the entire point of multi-tenant infrastructure is that my container should not be able to see anything left behind by your container. But there's an important distinction: Cloudflare says there is no evidence that malicious attackers exploited this vulnerability or that customer data was compromised. The flaw was responsibly reported through Cloudflare's bug bounty program on September 4. Cloudflare has since removed the configuration, retired affected container disks, cleared cached snapshots and completed remediation across the fleet. No customer action is required. The interesting lesson isn't just about Cloudflare. It's about cloud isolation. Sometimes you don't need to escape a container. You don't need to break into another customer's application. You just need the infrastructure underneath both of you to forget to clean up.

How Hackers Stole $1,500,000,000 in 3 minutes

Microsoft SharePoint is under attack. CVE-2026-65660 was patched in August. Now attackers are exploiting it in the wild. The flaw can lead to remote code execution, and researchers have observed attempts to deploy webshell backdoors. CISA has now added it to its Known Exploited Vulnerabilities catalog, with U.S. federal agencies given until September 28 to patch it. 🔗 Microsoft advisory: msrc.microsoft.com/update-gu…

One of the most important changes in Java 26 isn't something users will see. It's a security control that can stop Java applications from using cryptographic algorithms that you don't want them to use. JDK 26 introduces: jdk.crypto.disabledAlgorithms It lets administrators restrict algorithms at the JCA/JCE cryptography layer. Why does that matter? Because cryptography becomes a security problem when an application relies on algorithms that are outdated, weak, or no longer acceptable for a particular environment. Instead of depending entirely on every developer to make the right choice, the JDK can enforce restrictions. And that's not the only security change. JDK 26 also adds: → Signed JAR support for ML-DSA
→ Hybrid Public Key Encryption (HPKE)
→ Additional algorithm constraints and certificate checks in the SunX509 Key Manager
→ Improved keytool password handling
→ User-controlled SecureRandom for XML signature generation There's another interesting change developers should know about: Java's HTTP Client API now supports HTTP/3. HTTP/3 runs over QUIC and uses TLS 1.3, bringing modern transport capabilities directly into Java's standard HTTP client. For developers, the bigger takeaway is this: Security isn't only about adding another library after you've written the application. The platform itself is becoming part of the security boundary. If you build Java applications, especially backend systems, APIs or enterprise software, JDK updates aren't just about performance and new syntax. They can change the security capabilities available to your application. Resources: JDK 26 Security Updates:
docs.oracle.com/en/java/java… JDK 26 Security Developer's Guide:
docs.oracle.com/en/java/java… JDK 26 Release Changes:
docs.oracle.com/en/java/java… JDK 26.0.2 Release Notes:
oracle.com/java/technologies…

There’s something Donald Trump did during his first presidency that cybersecurity people are still benefiting from in 2026. In 2018, Trump signed the law that established CISA the Cybersecurity and Infrastructure Security Agency. CISA became responsible for helping protect U.S. critical infrastructure and federal networks, while also sharing cybersecurity guidance and threat information with organizations. One of its most useful resources today is the Known Exploited Vulnerabilities (KEV) Catalog. It tracks vulnerabilities that are known to have been exploited in real-world attacks. That matters because security teams don't have unlimited time to patch everything at once. Knowing which vulnerabilities attackers are actually exploiting helps defenders prioritize what needs attention first. And that's only one part of the cybersecurity changes made during Trump's first administration. His administration also elevated U.S. Cyber Command and released a National Cyber Strategy in 2018. Whatever your politics, these are cybersecurity decisions that had consequences beyond one presidency. Some of the infrastructure and security practices created or expanded during that period are still part of the cybersecurity landscape in 2026. That's the part I found interesting. Resources: cisa.gov/news-events/alerts/… trumpwhitehouse.archives.gov…

Meta blocked paid ads for an Elon Musk documentary. Then it said: "This was an error." The documentary, "Musk," directed by Alex Gibney, is scheduled for U.S. theatrical release on October 9. The film's distributor, Bleecker Street, had reportedly been rejected by Meta, YouTube, TikTok and X when it tried to advertise the trailer. Meta and YouTube initially cited or flagged the ad as political content. But there's an interesting update. Meta has now said the rejection was an error and that the ads are being restored. YouTube also said the trailer itself had always been available on YouTube, but the paid advertisement was temporarily restricted by its system. After review, YouTube cleared the ad to run. TikTok and X had not announced a similar reversal in the latest reports I found. The situation raises an interesting question about automated advertising systems: How does a platform decide that something is "political content" when the material is a documentary about a technology billionaire, his businesses, public influence and political activity? And what happens when that classification is simply wrong? The most interesting part of this story may not be the documentary itself. It's that a decision made by a platform's advertising system can determine whether someone is even allowed to pay to put a piece of content in front of an audience. Then, in this case, one of the platforms said the original decision was simply an error.

Uber was fined nearly $1 billion over something that sounds simple: Its system could suspend drivers without a human reviewing the decision. The Dutch Data Protection Authority fined Uber €825 million ($964 million), saying the company violated GDPR rules through automated decisions that affected drivers between 2018 and 2022. According to the regulator, some driver accounts were suspended, in some cases permanently, based on automated decisions without human review to check whether the system had made a mistake. The authority also said Uber failed to properly inform drivers that automated decision-making was being used. And this is where the story gets bigger than Uber. Imagine an algorithm deciding whether you can continue working. No conversation. No manager looking at the case. No human checking whether the data was wrong. Just a system making the decision. Automation can make decisions faster and at enormous scale. But when that decision directly affects someone's income, access to work, or livelihood, the question isn't only: "Can we automate this?" It's also: "What happens when the system gets it wrong?" Uber disputes the decision and said the policies examined were historical and had been discontinued years ago. The company says it now uses human reviews, safeguards and an appeal process. Uber has said it plans to appeal the fine. The €825 million penalty is huge. But the bigger lesson is about automated decision-making: The more power we give algorithms to make decisions about people, the more important human oversight becomes. Because an algorithm can make the same mistake thousands of times before anyone notices. 🔗 Source: securityweek.com/uber-fined-…

AI voice cloning just helped scammers trick an Italian bank into moving €95 MILLION. And around €36 million is still missing. The attack began in February 2026 when Paolo Molesini, then chairman of Fideuram, received a WhatsApp message that appeared to come from Carlo Messina, CEO of parent company Intesa Sanpaolo. The message requested urgent help with an overseas financial transaction. Then came the part that made the scam look legitimate. Molesini received a phone call from someone impersonating Paolo Nastasi, managing partner of A&O Shearman Italy. According to Reuters sources, the scammers used AI to replicate the lawyer's voice. They also sent 11 documents, including a confidentiality agreement and an apparent power of attorney carrying Messina's signature. Everything was designed to make the request look authentic. Believing the transaction was legitimate, Molesini instructed Fideuram's finance department to make a series of international transfers. Around €95 million was sent, mainly to accounts in China and Hong Kong. Fideuram later detected irregularities and alerted banks and authorities. Authorities and banks managed to recover roughly €53 million, according to Reuters sources. But around €36 million remains missing. The remaining funds were reportedly moved through overseas accounts and converted into cryptocurrency, making recovery more difficult. Italian prosecutors are investigating the case. And this is what makes the incident important: AI didn't have to hack the bank's systems. It was used to make a social-engineering attack much more convincing. A fake message. A cloned voice. Forged documents. A sense of urgency. And a request that appeared to come from people the victim trusted. For organizations, "Does this sound like the CEO?" can no longer be enough. High-value financial requests need independent verification through a separate trusted channel — even when the voice, phone number, documents and messages all appear legitimate. 🔗 Reuters: reuters.com/legal/government… 🔗 Corriere della Sera: milano.corriere.it/notizie/c… #CyberSecurity #AI #Scam #Deepfake #Fraud #SocialEngineering

Citrix NetScaler admins are being warned about TWO new zero-day RCE vulnerabilities reportedly being exploited in the wild. And there’s no patch yet. The warning involves NetScaler appliances internet-facing infrastructure used by organizations for VPN access, authentication, application delivery and remote access. According to watchTowr, the two vulnerabilities were identified during forensic investigations and can reportedly lead to remote code execution. The problem? There are still very few technical details available. No CVE numbers. No public exploit details. No confirmed affected builds. No public indicators of compromise. And Citrix has not yet published an advisory for these newly reported flaws. That has left security teams facing a difficult decision: keep an internet-facing NetScaler online while waiting for a fix, or take it offline and potentially disrupt critical remote-access services. Some organizations have reportedly chosen to shut their appliances down. But don't confuse this with CVE-2026-19490. That is a separate, previously disclosed NetScaler authentication-bypass vulnerability that is already being exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog. The latest warning is reportedly about TWO additional, currently unpatched RCE vulnerabilities. Until Citrix releases more information, organizations running NetScaler should: • Identify every internet-facing NetScaler appliance • Verify the exact software versions and configurations • Restrict unnecessary access • Preserve logs and forensic evidence • Monitor for suspicious sessions, configuration changes and outbound connections • Prepare an emergency response plan • Follow Citrix's official security advisories for the upcoming fixes This is also a reminder that when a critical edge device is potentially compromised, simply waiting for a patch isn't always enough. Organizations may need to investigate whether an attacker already gained access before applying the eventual fix. 🔗 Latest report: cybersecuritynews.com/citrix… 🔗 watchTowr research: labs.watchtowr.com/ 🔗 Citrix security bulletins: support.citrix.com/ #CyberSecurity #InfoSec #ZeroDay #Citrix #NetScaler

Your home security camera could be exposing more than you think. A serious vulnerability in TP-Link Tapo C200 cameras could allow an attacker on the same network to bypass authentication and gain admin access without knowing the camera password. That could expose live video, recordings and other camera controls. Researchers also found a DoS flaw that can crash the camera’s HTTPS service. The vulnerabilities are tracked as: • CVE-2026-15315 — Authentication bypass • CVE-2026-15316 — Denial of Service TP-Link has released firmware V5_1.4.6 for the affected C200 V5. If you use a Tapo C200, update the firmware and avoid exposing the camera directly to the internet. 🔗 Research: opswat.com/blog/authenticati… 🔗 TP-Link advisory: tp-link.com/us/support/faq/5…

Hackers exploited a Samsung flaw then BUILT their cryptominer on the victim’s own computer. That unusual move created so much activity that it helped security researchers spot the attack. Here’s what happened: Attackers exploited CVE-2025-4632, a critical vulnerability in Samsung MagicINFO 9 Server that can allow attackers to write files with system-level privileges. Samsung released a fix in May 2025. But in September 2026, Huntress investigated an intrusion where the vulnerability was used to gain access to a Windows system running MagicINFO. Once inside, the attackers: Tried to install AnyDesk for remote access Created a new local administrator account Disabled Microsoft Defender Launched a Monero mining tool Compiled the miner directly on the victim's machine And that last step is what makes this attack especially interesting. Instead of simply dropping a finished cryptominer, the attackers used a miner builder and several Windows development tools and compilers to create it on the compromised endpoint. That generated a noisy process chain that defenders could see in endpoint telemetry. The resulting miner then connected to a public mining pool and used the victim's computing resources to mine Monero. Huntress also observed the attackers making multiple attempts to download AnyDesk. Microsoft Defender blocked the first attempts before the attackers eventually succeeded. And there's another important lesson here: The vulnerability had already been patched. This wasn't necessarily about discovering a brand-new zero-day. It shows what can happen when internet-facing software remains vulnerable long after a security update is available. For defenders, the warning signs weren't just the final miner. They included: Unexpected remote-access software New administrator accounts Security tools being disabled Sudden compiler activity Unknown programs running from user directories Unexpected connections to cryptocurrency mining pools Attackers don't always hide by doing less. Sometimes they hide by doing something unusual enough that nobody immediately understands what they're seeing. If you run Samsung MagicINFO, check that your installation is patched and avoid exposing vulnerable management servers directly to the internet. cybersecuritynews.com/samsun…

23.6 million user records were exposed in a breach involving Gyazo. But the number that caught my attention wasn't 23.6 million. It was 490 million. That's roughly how many image metadata records attackers accessed. Here's what happened: Attackers exploited a vulnerability in Gyazo's image-upload server. The breach exposed about 23.62M user-related records. Exposed data included names, emails, password hashes, user IDs and session information. X integration tokens were also among the potentially exposed data for connected accounts. Attackers obtained a list identifying private images. Help feel said it could not rule out that some private images were viewed. And there's an important lesson here: A screenshot-sharing service isn't just storing screenshots. It's also storing the identity, session and metadata surrounding those screenshots. That's why a vulnerability in an upload server can become much bigger than an “image upload” problem. If you use Gyazo, this is worth reading carefully especially if you connected your X account. Source: corp.helpfeel.com/en/news/ne…

A 14-year-old Linux kernel flaw can now be exploited to gain ROOT access. And in certain Docker environments, it can potentially let an attacker escape the container and compromise the host. The vulnerability is CVE-2025-39964, a race condition in Linux's AF_ALG cryptographic interface. The vulnerable code was introduced back in Linux 2.6.38 in 2011 and remained exposed for roughly 14 years. Security researcher Muhammad Alifa Ramdhan discovered the issue while auditing the Linux kernel for Google's kernelCTF program. The bug allows two threads to interact with the same AF_ALG socket at the wrong time, causing the kernel's internal state to become inconsistent. Researchers turned that race condition into an out-of-bounds access and ultimately developed a way to gain arbitrary kernel write access. The exploit then targets core_pattern, a Linux kernel setting that controls how core dumps are handled. By manipulating it and triggering a crash, the proof of concept can execute attacker-controlled code with ROOT privileges. But it gets even more interesting with containers. Docker containers share the host's Linux kernel. So if an attacker can exploit the vulnerable kernel from inside an affected container, the same kernel-level primitive can potentially be used to escape the container and gain root access to the host. The researchers developed the exploit for Google's kernelCTF program and reportedly received a $113,337 reward. CVE-2025-39964 is also listed in CISA's Known Exploited Vulnerabilities catalog. If you manage Linux servers or container infrastructure: • Update your kernel through your Linux distribution • Reboot into the patched kernel • Prioritize container hosts and shared infrastructure • Check systems where untrusted local code can execute • Verify that the running kernel actually contains the fix A vulnerability doesn't have to be new to become dangerous. Sometimes the biggest story is what was hiding in the code for years. 🔗 Full technical research: idnsec.com/research/linux-lo… 🔗 Google kernelCTF research: github.com/google/security-r… 🔗 Linux CVE advisory: lists.openwall.net/linux-cve… #Linux

Your MFA worked. Your password was correct. Your login looked completely normal. And the attacker still got in. That’s the problem with session theft. Researchers are seeing phishing services like NovaCookies sell adversary-in-the-middle attacks for as little as $320 a month. The attacker doesn't need to guess your password. They don't necessarily need malware. They can sit between you and the real login page, relay your authentication in real time, and steal the session created after you successfully log in. Now they have something much more valuable than your password: Your authenticated session. That session can carry the same access your identity already has. And this is where things get uncomfortable. Another campaign tracked by ANY.RUN recorded thousands of potential compromise events, with session-cookie theft making up the largest category. There are even cases involving users who had already secured their accounts with MFA. Infostealers can grab browser session cookies from an infected device and attackers can replay those sessions without having to defeat the password or second factor again. So resetting the password after an incident may not be enough. If the attacker already has the session, the session and its refresh tokens need to be revoked too. MFA is still important. But authentication is an event. Your session is the state that comes after it. And attackers are increasingly targeting the state. The question isn't only: "Did the user authenticate successfully?" It's also: "What happens after authentication?" How long does the session live? What can it access? Can the device be trusted? And how quickly can that session be revoked if it's stolen? The front door may be secure. The attacker may already be inside.

A 16-year-old security researcher just walked into a Microsoft internal analytics service with a fake admin token. And the problem wasn’t a stolen password. It was a missing JWT signature check. The researcher, known online as Faav, discovered Microsoft’s internal analytics service called Titan while researching its exposed infrastructure. Titan’s main webpage showed “VPN REQUIRED.” But its API was still reachable over the internet. An exposed Swagger document revealed an endpoint called /v2/Query that accepted SQL queries. That’s where things got interesting. Titan was checking several fields inside JSON Web Tokens, including the tenant, audience, application ID and user identity. But it wasn’t properly verifying the token’s cryptographic signature. So Faav created an unsigned JWT using the none algorithm. Then he changed the upn value to: admin Titan mapped that value to a local administrator account. A simple SELECT 1 query worked. He now had administrator-level access to the analytics service without a legitimate Microsoft login. From there, Faav found metadata covering thousands of databases, tables, dashboards, charts and datasets. The researcher says the accessible environment connected to: • 17 ClickHouse analytics databases • 9,863 unique table names • 17,990 Microsoft employee email records • 15,001 employee organization records • 24,569 dashboards • 425,891 charts • 27,347 dataset definitions Using database metadata, he estimated the reachable environment contained around: 17.3 TRILLION database rows. But there’s an important detail. That does NOT mean 17.3 trillion customer records were exposed. The number includes historical, duplicated and derived data. Faav says he deliberately avoided accessing customer data. He only pulled metadata and two single-row samples from Bing search analytics. No customer data was taken. He reported the vulnerability to Microsoft on September 5, 2026. Microsoft closed the affected endpoint four days later, on September 9. On September 17, Microsoft awarded him a $5,000 bounty. There’s also an interesting part of the story around the disclosure. Faav says Microsoft had editorial control over the public write-up and requested changes to sections and figures before publication. The bigger lesson here isn't about a teenager breaking into Microsoft. It's about how one missing security check can undermine multiple layers of authentication. A system can validate the user, tenant, audience and role all it wants. If it doesn't first verify that the token itself is authentic, an attacker can potentially control the claims being trusted. JWTs aren't secure simply because they exist. The signature has to be verified. 🔗 Full technical breakdown: cybersecuritynews.com/micros… 🔗 Microsoft Security Response Center: microsoft.com/en-us/msrc #CyberSecurity #InfoSec #WebSecurity #JWT #Microsoft

More than 2 million WordPress sites installed an Elementor version with a vulnerability that could let an attacker create a new administrator account. And the scary part? The attacker may only need to trick a logged-in admin into clicking a link. The vulnerability affects Elementor 4.3.0 and 4.3.1. Researchers found that the plugin could skip WordPress's CSRF protection when a specific string appeared in the request URL. That sounds small. It wasn't. Because an attacker could abuse that behavior to make the victim's browser send unauthorized requests to the WordPress site. On a default setup, that could mean creating a new administrator account controlled by the attacker. No password guessing. No malware installation. Just a malicious link opened by someone who already has an administrator session. The vulnerability was rated CVSS 8.8 and has been fixed in Elementor 4.3.2. And here's the part developers should pay attention to: Elementor is active on more than 10 million WordPress sites, while the two vulnerable versions were installed on more than 2 million sites. There is no evidence that all those sites were compromised. But it shows how quickly a vulnerable release can spread through the WordPress ecosystem. If you're running Elementor, check your version. 4.3.0 or 4.3.1 → update to 4.3.2. Don't wait for an attack to tell you that you're vulnerable. 🔗 Resources: The Hacker News: thehackernews.com/2026/09/el… WPScan: wpscan.com/plugin/elementor/

Your antivirus can still be running while malware is already inside your machine. That’s what makes this new Lunex Stealer campaign interesting. Researchers at Ontinue found a malware operation abusing a vulnerable AMD driver, PDFWKRNL.sys, to interfere with security monitoring on Windows. The technique is called BYOVD: Bring Your Own Vulnerable Driver. Instead of simply killing antivirus or EDR processes, Lunex uses the AMD driver to interfere with kernel-level security callbacks. The security tools remain running. But they can be left effectively blind. And then the real theft begins. LunexStealer can target credentials and data from Chrome, Edge, Brave, Yandex, Opera, Opera GX and Vivaldi. It also targets cryptocurrency wallets, browser session data and other sensitive information. But Lunex doesn't stop at stealing credentials. Researchers found a PowerShell-based Chrome Native Messaging Host that can survive reboots and browser restarts and gives the attacker capabilities including: • Reading files • Writing files • Downloading files • Listing drives and directories • Executing programs The infection chain reportedly starts with compromised websites showing fake Cloudflare/CAPTCHA verification pages. Victims are then tricked into running a malicious MSI installer, which launches LunexLoader, abuses the vulnerable AMD driver, and finally deploys the stealer. The vulnerable driver is linked to CVE-2023-20598. Even more interesting: Ontinue's testing found that HVCI and Microsoft's Vulnerable Driver Blocklist did not prevent the specific driver variant used in this campaign from loading. Researchers identified 28 Lunex panels across 13 countries, suggesting this isn't just a single malware sample. It's a broader Malware-as-a-Service operation. The bigger lesson? Attackers don't always need to turn your security software off. Sometimes, they can leave it running and make it blind. 🔗 Resources: The Hacker News: thehackernews.com/2026/09/lu… Ontinue technical analysis: ontinue.com/resource/lunex-u… Ontinue IOCs: github.com/ontinue-research/…