Cybersecurity researchers

Cybersecurity researchers disclosed a critical flaw in the Elementor Pro WordPress plugin that could allow unauthenticated attackers to upload PHP and execute code. The vulnerability, designated CVE-2026-32475, has a CVSS score of 9.0 out of 10.0 and involves an unrestricted file upload mechanism within the Forms module.

Cybersecurity researchers flagged a global cybercrime operation that abuses thousands of hacked WordPress websites. This infrastructure is used to spread malware and steal data, commandeering infected hosts. The criminals store stolen documents, screenshots, and activity logs using an entire toolkit of criminal software.

Cybersecurity researchers flagged a previously undocumented Linux botnet family called Evooo1Bot. This malware derives its core functionality from the Mirai botnet source code and can turn internet-facing devices into SOCKS proxies. Although it reuses the DDoS engine, the botnet extends the original framework with numerous capabilities.

Cybersecurity researchers flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro"). This extension was observed delivering a browser wallet and credential stealer. The specific extensions identified as malicious include helper-beeps.solidity-pro and web3devtoolsx.solidity-pro.

Cybersecurity researchers discovered a malicious NuGet package named 'Newtonsoftt.Json.Net' that disguises itself as the legitimate Newtonsoft.Json library. The trojanized fork is designed to manipulate live game results on Digitain, with seven versions published to the package registry.

Cybersecurity researchers have disclosed TuxBot v3 Evolution, an IoT botnet framework showing signs of large language model (LLM) assistance, though the AI-generated code included a safety disclaimer that the developer failed to remove.

Cybersecurity researchers have discovered malicious npm packages designed to deliver a Windows-based remote access trojan (RAT). The identified packages include aes-decode-runner-pro (145 downloads), postcss-minify-selector (256 downloads), and postcss-minify-selector-parser (615 downloads), all published in the past month by an npm user.

Cybersecurity researchers have identified a new attack method called Agentjacking, which exploits AI coding agents by tricking them into executing malicious code via fake error reports generated through the Sentry platform. The attack leverages an open-source error-tracking and performance-monitoring system to compromise developer machines.

Cybersecurity researchers have identified a new malspam campaign exploiting Google's DoubleClick domain to bypass detection and deliver the DesckVB RAT. The campaign uses a legitimate Google-owned domain to route traffic before reaching attacker-controlled infrastructure.

Cybersecurity researchers disclosed an unpatched vulnerability in the Windows search: URI handler that could allow attackers to steal NTLMv2 hashes. The issue is similar to CVE-2026-33829, which affected the Windows Snipping Tool's ms-screensketch: URI handler, and was identified by Huntress.

A security flaw in Gitea, an open-source version control platform, allows unauthenticated attackers to access private container images. The vulnerability, CVE-2026-27771, affects all versions prior to 1.26.2 and was disclosed by cybersecurity researchers.

Cybersecurity researchers have disclosed a 9-year-old Linux kernel vulnerability (CVE-2026-46333) with a CVSS score of 5.5 that enables unprivileged local users to execute arbitrary commands as root on major Linux distributions. The flaw involves improper privilege management and affects default installations across several major distros.

Cybersecurity researchers discovered 28 fraudulent apps on the Google Play Store that tricked users into joining a subscription with fake data, resulting in financial loss. The apps collectively gained over 7.3 million downloads. One app alone accounted for a significant portion of these downloads.

Cybersecurity researchers discovered a large-scale fraud operation exploiting Telegram's Mini App feature to conduct crypto scams, impersonate brands, and deliver Android malware.

Cybersecurity researchers discovered a malicious npm package, '@validate-sdk/v2', used in attacks attributed to the DPRK. The package, falsely presented as a legitimate SDK, was linked to Anthropic's Claude Opus LLM and employs AI-inserted malware, fake firms, and RATs for cyber operations.

Cybersecurity researchers discovered a critical remote code execution (RCE) vulnerability in GitHub.com and GitHub Enterprise Server, tracked as CVE-2026-3854 (CVSS score: 8.7). The flaw allows authenticated users with push access to exploit a command injection vulnerability via a single 'git push' command.

Cybersecurity researchers discovered 73 fake Microsoft Visual Studio Code extensions on the Open VSX repository linked to the GlassWorm v2 malware campaign. The malicious extensions, cloned from legitimate ones, include six confirmed to deliver malware.

Cybersecurity researchers identified a critical design flaw in the Model Context Protocol (MCP) that could enable remote code execution (RCE), posing significant risks to systems using vulnerable MCP implementations and threatening the AI supply chain.

Researchers have identified a new malware named ZionSiphon, specifically targeting Israeli water treatment and desalination operational technology (OT) systems. The malware, detected by Darktrace, is capable of establishing persistence, modifying configuration files, and scanning for OT services.

A researcher named 'Chaotic Eclipse' has released a proof-of-concept exploit for a Microsoft Defender zero-day vulnerability called 'RedSun,' which grants SYSTEM privileges. The exploit was published as a protest against Microsoft's handling of cybersecurity researchers.

The GlassWorm campaign has evolved with a new Zig dropper designed to infect multiple developer IDEs. Researchers identified the threat in a malicious Open VSX extension named 'specstudio.code-wakatime-activity-tracker,' which disguises itself as the legitimate WakaTime tool.

A new variant of Chaos malware is targeting misconfigured cloud deployments, expanding its scope beyond routers and edge devices. Darktrace reported this development in a recent analysis.

Cybersecurity researchers have uncovered the Masjesu Botnet, a DDoS-for-hire service advertised on Telegram since 2023. It targets global IoT devices, including routers and gateways, across multiple architectures.