Hacking OpenAI
AI helped researchers exploit a Discourse flaw in under 72 hours, hijacking OpenAI staff accounts and exposing the risks of shared SSO.
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems.
Flock cameras are riddled with security vulnerabilities and hard-coded credentials
This morning, DDoSecrets published an exciting new dataset: Filesystem images of the partitions from an in-use Flock ALPR camera. 404 Media and Wired published a joint investigation into it. I downloaded the dataset and am now thoroughly nerd-sniped. Hackers from a collective called stegan0gram collected the data. “Why
Chinese hackers use SparroWocky malware in govt espionage attacks
Amid the US and China's fight for eco-colonial influence in Latin America, a stealthy backdoor has taken flight.
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
Helpfeel confirms a Gyazo data breach exposing 23.62 million user records and metadata from hundreds of millions of images.
Revolut Data Leak May Trace Back to Compromised Italian Government Accounts
Revolut allegedly fed customer information to hackers impersonating an Italian government agency for five months.
FBI takes down one of the longest-running DDoS-for-hire services
DLes États-Unis viennent de démanteler NightmareStresser, l'un des plus anciens services de « DDoS-à-la-demande » au monde. L'offensive s'inscrit dans le cadre de la coalition internationale Operation PowerOFF, qui traque ces plateformes criminelles depuis 2018. Utilisé par plus de 500 000 pirates, le service a servi à lancer des centaines de milliers d'attaques contre des écoles, des administrations et des plateformes de jeux.
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
The authentication bypass flaw CVE-2026-76460 impacts Cisco's Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score.
Multiples vulnérabilités dans Google Pixel (16 septembre 2026)
Google a commencé à déployer la mise à jour de sécurité de septembre pour les appareils Pixel. Celle-ci corrige 110 problèmes de sécurité, dont une faille zero-day. L’entreprise encourage donc les personnes concernées à l’installer rapidement. Voici comment faire si vous êtes passé à côté.
First Agentic AI Data Breach Reported to Spanish Regulator
AI-driven cyberattacks used to be exotic. Soon, it'll be odd if threat actors aren't using agents to do all of their bidding.
Le suivi mondial des météores et des bolides est paralysé par une cyberattaque
Group plans to be largely out of commission for several weeks.
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Cybermois 2026 : près d’un Français sur deux désormais notifié suite à une violation de ses données
Cybermalveillance.gouv.fr publie son 3ᵉ baromètre sur la cybersécurité des Français… et le constat est alarmant. L'étude révèle que près de la moitié des Français ont été informés d'une fuite de leurs données personnelles en 2026.
Google fixes actively exploited Android zero-day on Pixel devices
The Pixel phone maker said there are indications that a bug in the phone's modem "may be under limited, targeted exploitation."
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
UK, US, and Dutch agencies expose Chosen Brick, Iranian malware used to track and harass dissidents, journalists, and activists via Telegram.
Iranian cyber targeting of dissidents, activists and journalists
Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.
Acronis warns of actively exploited flaw in its cPanel backup plugin
Acronis says CVE-2026-87886, a local privilege escalation flaw in its Linux backup plugins, was exploited in limited targeted attacks.
Hackers target WordPress sites via third-party WooCommerce plugin
Attackers are exploiting CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells and gain remote code execution.
📡 IDScan confirme le vol de 153 millions de permis de conduire Après la vente de 153 millions d...
Newsletter de cybersécurité du 16 septembre 2026 couvrant les actualités majeures : vol confirmé de 153 millions de permis de conduire chez IDScan, mise en place du guichet unique d'alerte de l'ENISA pour le Cyber Resilience Act, et recension de 14 cyberattaques et 14 vulnérabilités critiques de la semaine incluant ClickFix et GitLab.
DCOD • Cybersécurité+1 source16 sept.
Ep.750 - RadioCSIRT Flash info cybersécurité du mardi 15 septembre 2026
🪟 L'éditeur Microsoft décrit NeedyMantis, un malware chargé par DLL sideloading via des programmes légitimes comme Poedit ou TightVNC, qu'il observe depuis ...
Electric and gas utility CenterPoint Energy warns of data breach after dark web post
CenterPoint Energy confirmed a data breach after a hacker claimed to have stolen 7.49 million customer records.
Devil’s advocate? Uncensored Luciferus AI service advertised underground
An uncensored AI service called Luciferus is being sold as a subscription on a hacking forum, capable of generating malware, Sophos found.
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Attackers exploit a Vite flaw in exposed dev servers to extract cloud credentials, configuration files, and infrastructure state.
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, deploying different backdoors each.