The Threat Codex

IDScan confirms breach tied to 153 million stolen driver’s licenses

Identity verification company IDScan has confirmed that hackers accessed customer data stored in its cloud platform, days after reports linked the company to a massive database containing more than 153 million driver's license scans.

Tracking BigBear 2.0 Evilginx2 Phishing Campaign | CloudSEK

CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.

CJP protests: India tells GitHub to block Bitchat app, Jack Dorsey leaks notice

The Indian government has ordered GitHub to remove all repositories of Jack Dorsey's Bitchat, alleging that the Bluetooth messaging app could be used to bypass internet shutdowns and hinder investigations amid the ongoing CJP protests in Delhi.

Arctic Wolf

CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Auth Remote Code Execution (RCE) Vulnerability - Arctic Wolf

Threat Summary A maximum-severity (CVSS 10.0) vulnerability CVE-2026-86218 has been discovered in N-able N-central prior to build 2026.3.1.14. This flaw allows unauthenticated attackers to execute arbitrary code on the N-central server before authentication enabling remote takeover of the platform. The vulnerability is classified as static code injection (consistent with CWE-96) in a public-facing application endpoint. ... CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Aut

Europol-led action against nihilistic violent extremist network "The Com" – Referral Action Days disrupt online ecosystem and leads to the referral of 4340 URLs referencing disturbing content | Europol

Over several weeks in June and July 2026, Europol supported an action targeting nihilistic violent extremist content online. Investigators from nine countries participated in these ‘Referral Action Days’, with the common goal to disrupt The Com online ecosystem and limit propaganda dissemination, as well as to find new investigative leads. The action also aimed at enhancing platforms’ response to and awareness of terrorist content online produced and disseminated by The Com groups.

OX Security

CVE-2026-59873: Decompression DoS Via Unlimited Input In node-tar, 90M Weekly Downloads Affected

CVE-2026-59873: A high-severity decompression DoS vulnerability in node-tar (<=7.5.18). How it works and how to patch

An alignment assessment of recent cybersecurity incidents

We present an alignment assessment of four incidents in which Claude models gained unauthorized access to real third-party systems.

Hugging Face warns an autonomous AI agent hacked its network

The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system.

Cybernews

Polarsteps data exposure put travelers’ locations at risk

230 million photos and videos were accessible in a Polarsteps data exposure, along with GPS points and home addresses. Read what the evidence shows

Volexity

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure ho

Bing Images RCEs: How XBOW Found Three Critical Flaws | XBOW

See how XBOW autonomously uncovered three critical Microsoft RCEs by tracing ordinary image-processing and file-upload paths to proven code execution.

New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

Malwarebytes

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

One compromised Shark robot vacuum could unlock remote access to many others.

Security Affairs

CVE-2026-42533: Critical NGINX Bug Could Turn HTTP Requests Into Server Takeovers

F5 fixes critical nginx flaw CVE-2026-42533 that can crash servers and, in some cases, allow remote code execution through crafted HTTP requests.

Hackers abuse Notepad++ plugins to stealthily install malware

Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.

Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

A coordinated Unified Threat Advisory covering active Cl0p ransomware affiliate exploitation of internet-exposed PTC Windchill and FlexPLM deployments.

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

OCCRP

Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport

Spyware company NSO Group’s co-founder Shalev Hulio used an Israeli diplomatic passport to enter Panama in 2013, raising questions over the firm’s claims of independence from the Israeli state.

Zoom warns of critical account takeover vulnerability

Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts.

picussecurity.com

FrigidStealer Explained: macOS Infostealer and Gatekeeper Bypass

Understand how FrigidStealer infects macOS through fake updates and how to validate your defenses against this infostealer with Picus.

Gray Rabbits and the Tale of a One-Click Backdoor

One click. Three critical failures. One backdoor.

ExfilSquad hackers leak info of over 100,000 UK police officers, staff

A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals.

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants

Rapid7

GitLab has patched CVE-2026-85706, a CVSSv3.1 10.0 path traversal vulnerability in the repository commits API that allows an unauthenticated user to read arbitrary files from GitLab CE and EE servers. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 11, 2026. Self-managed instances should be upgraded to 19.1.8, 19.2.6, or 19.3.2 on an emergency basis.

Malwarebytes

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Extortion groups ShinyHunters and ShadowByt3$ claim they stole vast amounts of patient data. Those allegations have not been verified.

Check and Protect: Analysis of Telegram Phishing Operation Targeting Exiled Activist - RESIDENT.NGO THREAT LAB

In July 2026, RESIDENT.NGO investigated a cloaked phishing operation targeting the Telegram account of an exiled Belarusian activist living in Lithuania. Delivered in a private Telegram Secret Chat as a fake Telegram security alert, the phishing link led to a convincing Telegram-themed page designed to capture one-time login codes in…

Russia accuses Telegram founder of aiding terrorism, seeks international arrest

Russia is seeking to place Telegram founder Pavel Durov on an international wanted list, alleging that the app has been used by Ukrainian intelligence to organize terrorist attacks and conduct espionage inside Russia.

Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI

Dolphin X, a new Windows stealer and remote access trojan, targets hundreds of applications from browsers to crypto wallets and includes an AI Profiler that helps attackers zero in on victims.

Countering misuse of AI: September 2026 / Anthropic

Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.

ASEC

Not Every Fox is Silver: Inside an AtlasRAT loader chain - ASEC

Not Every Fox is Silver: Inside an AtlasRAT loader chain ASEC

CVE-2026-0310: Critical PAN-OS Buffer Overflow Flaw

Palo Alto Networks patched CVE-2026-0310, a PAN-OS buffer overflow flaw that can lead to root RCE on PA-Series firewalls

404 Media

Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats

Humans are reading ChatGPT users’ prompts to improve OpenAI’s models, and those chats can include sensitive, personal information, according to leaked internal documents and real prompts seen by 404 Media.

Malwarebytes

Update Chrome now to protect against an actively exploited vulnerability

Chrome issues another monster update, fixing an actively exploited V8 vulnerability and 229 other flaws.

Rapid7

Root cause technical analysis of CVE-2026-16232, an authentication bypass in the SmartConsole login process affecting Check Point Security Management Server and Multi-Domain Security Management Server (MDS).

Securelist

PAYLOAD ransomware attacks through Active Directory GPO

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US

Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release