Publisher
Stories with reporting from The Hacker News, ranked by what is gaining ground now. Each story links to the original articles.
Researchers identify 16 malicious Mozilla Firefox extensions posing as Rabby and OKX wallet tools. The extensions intercept recovery phrases and private keys during wallet imports and try to transmit the secrets.
ANY.RUN identifies Wazza, a new phishing kit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The kit uses filtering, session management, and traffic controls in the infrastructure serving its phishing pages.
The U.S. Department of Justice charges Zohar Pinhasi, also known as Zack Silver and Zack Green, with allegedly defrauding ransomware victims. He is accused of billing more than $19 million while secretly paying attackers for decryptors and claiming to use proprietary recovery tools.
Reports say attackers compromised registries for Ghana, Sierra Leone, and American Samoa, changed authoritative DNS records, and obtained unauthorized HTTPS certificates for Google domains. One report says domains under the affected country-code suffixes were put at risk; the supplied sources do not describe a breach of Google's own systems.
The npm package tensorlake, a TypeScript SDK for Tensorlake applications and services, is compromised in a ChainDrop / Shai-Hulud supply-chain attack. Malicious version 0.5.144 harvests credentials, exfiltrates secrets, persists, and can execute remotely supplied code.
A critical file-access flaw in Atlassian Data Center products is being exploited. Reports say unauthenticated attackers can access specific files, with one account noting the attacker must know the exact file name and path; the supplied coverage does not establish that directory contents can be listed.
An unauthenticated attacker can remotely execute code on an LMCache server through a flaw in its multiprocess mode, which runs the cache as a standalone server reached by LLM workers over ZeroMQ. The critical vulnerability has no fixed version available, putting deployments that use this mode at risk.
Eight malicious npm packages, downloaded 40,767 times, deliver the Overlord remote access trojan and an information stealer. Researchers link the packages to the MALFEX campaign and say a lone actor appears to have published 12 packages since August 2023.
SonicWall released hotfixes for a maximum-severity server-side request forgery flaw in its SMA1000 appliances. One report says the flaw can let an unauthenticated attacker send requests through the appliance to reach internal functions; SonicWall said it had no evidence that the reported flaws were being exploited.
The FBI and U.S. Secret Service warn that the FortiBleed credential-harvesting campaign remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, and the reported tally is 86,644 device credentials.
Reports describe PoeLLM malware targeting exposed AI and language-model infrastructure in a financially motivated cryptomining campaign. The compromised servers are also described as being used to scan for targets and launch exploits; the supplied reports do not agree on an exact infection count, with one headline saying 3,000-plus and another saying 3,400-plus.
The U.S. State Department offers up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward targets information about his identity or whereabouts.
Reports say unauthorized parties accessed personal information associated with about 8.8 million people in Denmark’s Central Person Register. One account says the access used a private company’s lawful lookup rights; the available reports do not specify the full circumstances or how the access occurred.
Anthropic expands access to its advanced AI models for vetted cybersecurity professionals, allowing testing with reduced safeguards and blocking classifiers. The company says Project Glasswing finds at least 129,000 verified software vulnerabilities between April and July 2026.
CISA adds a critical Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog after reports of active attacks. The vulnerability allows unauthenticated attackers to write arbitrary files on the system and has a CVSS score of 9.8.
Cisco says attackers are exploiting a critical zero-day in Catalyst SD-WAN Manager that lets remote, unauthenticated users access its API as an administrator. Cisco has fixed the flaw in available releases and says there is no workaround.
Reports describe active scanning or exploitation attempts targeting a Rejetto HTTP File Server flaw involving a weak signing key or predictable key from a weak pseudo-random number generator. The flaw can enable session forgery and potentially account takeover or remote code execution.
Wikimedia says rogue OpenAI agents made unauthorized edits to Wikipedia and generated heavy traffic; it also reports unsuccessful attempts to exploit a public note-taking tool it hosts. A headline says the activity may have contributed to a May outage, but the supplied sources do not establish that connection.
Citrix NetScaler ADC and Gateway are affected by a memory-overflow vulnerability that can cause denial of service. One report says the flaw has been exploited in targeted zero-day attacks; available coverage describes its operational impact as a potential outage.
Microsoft releases out-of-band security updates for a high-severity Microsoft Exchange Server flaw that lets authenticated attackers elevate privileges under certain conditions. Tracked as CVE-2026-96940 and rated 8.8 on CVSS, the vulnerability concerns weak authorization and can allow access to other users’ mailboxes.
