GoKawiil
Tech News
Cisco has released fixes for a critical zero-day, CVE-2026-76504, in its Catalyst SD-WAN Manager software that attackers are already exploiting to gain unauthenticated admin access. The flaw stems from improper URI encoding handling that lets crafted HTTP requests bypass authentication on a specific API endpoint. Cisco says it learned of active exploitation in September 2026 and is urging customers to upgrade immediately.
Security researchers have released an exploit called Relapse that jailbreaks the PlayStation 5 across nearly every firmware version except the newly released 14.00.00. Hackers say jailbroken consoles can already run recent titles like Marvel's Wolverine and The Witcher III Remastered without payment, and can install homebrew software in under a minute.
Bitget disclosed that attackers who stole $387.5 million from its hot and warm wallets last week gained access by exploiting zero-day vulnerabilities in two third-party security appliances. Investigations by SlowMist and Mandiant found the attackers planted a web shell and malware, moved laterally to Bitget's production wallet job server, and used a custom withdrawal tool to execute transfers over roughly three hours starting September 24-25. Bitget had suspended withdrawals after detecting the unauthorized transfers.
Security researchers at Malwarebytes have identified a fraudulent advertisement claiming Apple's unreleased iPhone Duo foldable can be preordered now for a $500 discount, even though Apple has said preorders start October 16 and sales begin October 23. The scam relies on the DarkSword exploit chain, which can steal data from vulnerable iPhones running iOS 18.4 to 18.6.2 simply by loading the malicious page, without requiring any clicks or typed input.
A developer known as ntfargo has published a new PS5 jailbreak called Relapse, covering firmware versions 7.00 through 13.60. The exploit uses a browser-based WebKit stage combined with a kernel-level flaw to gain read/write access, and is delivered either via a local Python server or a hosted webpage. The release credits a large group of contributors and includes a disclaimer limiting its stated use to educational and security research purposes.
Mandiant and other security firms say attackers began exploiting an unpatched Citrix NetScaler flaw, tracked as CVE-2026-88772, in early September to install custom web shells and tunneling malware, gain root access, steal credentials, and move into internal networks. Victims span government, financial services, education, legal, and professional services organizations in North America and Europe. Citrix disclosed two related zero-days, CVE-2026-88771 and CVE-2026-88772, on Sunday and released patches after researchers including GreyNoise and watchTowr flagged active exploitation.
An analysis of the Commodore 64 game Mercenary by Paul Woakes reveals a previously undocumented exploit: standing on a specific invisible patch of grass near the starting location and pressing E lifts the player directly into the Colony Craft's hangar, which normally hovers far overhead with no ground-level access. Pressing E again returns the player to the craft's deck, bypassing the game's usual movement and altitude logic. The discovery was made through a byte-accurate reconstruction of the game's original rendering and control code.
Researchers identified a double-fetch flaw in Avast's kernel driver that can lead to a pool overflow, potentially allowing code execution outside the antivirus sandbox. The flaw involves multiple reads of the same user-supplied data, which can be manipulated between fetches. Recent Windows updates mitigate this issue by enforcing user-mode access checks, reducing the exploit's viability.
Hacking group ShinyHunters told 404 Media it stole personal data on all FBI employees and job applicants after exploiting a flaw in Oracle's PeopleSoft software used on the bureau's recruitment site. The FBI confirmed it is investigating the claimed compromise of FBIJobs.gov, and the site's main application pages are currently showing maintenance and error messages. The FBI said it has not yet determined whether the breach originated with a third-party vendor or its own systems.
Hacking group ShinyHunters says it stole terabytes of sensitive data on FBI employees and job applicants, exploiting a zero-day flaw in Oracle's PeopleSoft software to breach Amazon Web Services' GovCloud. A sample reviewed by Reuters and 404 Media reportedly includes names, addresses, birthdates and Social Security numbers for about 5,000 employees, and the group also claimed responsibility for briefly hijacking the FBI's website. The FBI confirmed it is investigating a claimed compromise of the FBIJobs.gov portal and possible exposure of employee personal information.
GreyNoise's Global Observation Grid detected a Chinese-speaking threat actor exploiting flaws in ZyXEL GS1900 switches and WordPress's wp2shell vulnerabilities to compromise 996 devices and steal over 18,500 records. The group, linked to the Red Heron actor previously tied to a Gitea flaw, breached at least 49 organizations across 29 countries since early June 2026, including an unnamed Western government agency.
Check Point Software has issued emergency hotfixes for CVE-2026-93616, a critical path traversal vulnerability in its Security Management Server that lets unauthenticated attackers upload and run arbitrary scripts. The company confirmed the flaw is being actively exploited, with a handful of customers already compromised, and released a fix in R82.20 Security Hotfix covering Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.