The Hacker News

Today’s signal The Hacker News recently reported SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE. Published context: September 22, 2026. A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edit ...

Today’s signal The Hacker News recently reported ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks. Published context: September 21, 2026. A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more f ...

Today’s signal The Hacker News recently reported Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR. Published context: September 21, 2026. A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft’s own hardware-compatibility program signs the driver, scored zero detections ...

Today’s signal The Hacker News recently reported Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors. Published context: September 21, 2026. The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based “much smaller organization” in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activi ...

Today’s signal The Hacker News recently reported Identity Visibility in 2026: The Foundation of Identity Security. Published context: September 19, 2026. Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon’s annual Data Breach Investigations Report. This article explains what identity visibility means in IAM, why cloud and multicloud environments complica ...

Today’s signal The Hacker News recently reported Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents. Published context: September 18, 2026. A flaw in four widely used AI coding agents lets someone who controls a plugin’s code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.14 ...

Today’s signal The Hacker News recently reported SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE. Published context: September 19, 2026. SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manage ...

Today’s signal The Hacker News recently reported Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws. Published context: September 19, 2026. Three researchers at the security firm Hacktron used Anthropic’s Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI’s public help forum and moved through a weakness in OpenAI’s own login system. Th ...

Today’s signal The Hacker News recently reported Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks. Published context: September 17, 2026. Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. “This vulnerability is due to insufficient authentication control on an API endp ...

Today’s signal The Hacker News recently reported Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution. Published context: September 16, 2026. A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by ...

Today’s signal The Hacker News recently reported China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE. Published context: September 15, 2026. A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations ( ...

Today’s signal The Hacker News recently reported AI Changed the Exposure Problem. Validation Needs to Change With It.. Published context: September 14, 2026. There’s a lot of noise around AI and cybersecurity right now. What’s actually important is far simpler, if often lost in the hubbub. Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action. In the first half of 2026, a whopping 35,853 CVEs were publis ...