NRG Networks Inc.

Threat: Actively exploited Windows Shell security feature bypass (CVE‑2026‑96951) Severity: High (CVSS 8.8) Impact Domain: Endpoint security, fraud prevention, regulatory compliance, third‑party risk Why This Matters Specifically for Banks Financial institutions depend heavily on endpoint trust controls — SmartScreen, MotW, Office Protected View — to prevent credential theft, RAT deployment, and lateral movement into payment systems. This 0‑day directly undermines those controls. Key banking‑sector implications: Higher probability of workstation compromise Malware delivered via email or messaging can execute with fewer warnings, increasing the success rate of phishing‑driven intrusions. Increased fraud‑risk exposure Compromised endpoints are a primary vector for: SWIFT manipulation Wire‑fraud initiation Treasury workstation takeover Privileged credential theft (AD, PAM, core banking systems) Regulatory pressure FFIEC, OCC, FDIC, and Federal Reserve examiners expect rapid patching o...

KB5124010 (Sept 2026 preview) and KB5127648 (Oct 2026 security update) —are breaking Remote Desktop Services (RDS) on Windows 11 and Windows Server. The failures primarily affect non‑admin RDP connections and enterprise-managed hosts with Administrator Protection enabled, producing error 0xC000000D (“The token that was passed to the function is invalid”). Microsoft has confirmed the issue and published temporary and permanent fixes. Administrator Protection + Recent Updates = Broken RDP Microsoft confirmed that enabling Administrator Protection (a UAC-hardening feature) causes RDP failures after installing: KB5124010 (Sept 2026 preview) KB5127648 (Oct 2026 security update) Later cumulative updates for Windows 11 24H2 / 25H2 / 26H1 / 26H2 Symptoms: RDP fails with 0xC000000D Message: “The token that was passed to the function is invalid.” Only non-admin users are affected Windows Server RDS Deadlocks After September 2026 Updates On Windows Server 2019/2022/2025, the September 20...

A newly disclosed chain of vulnerabilities in LG webOS smart TVs could allow an attacker on the same local network to gain root-level control of affected televisions without requiring a PIN or user interaction. Researchers found that three flaws can be combined to bypass the pairing process, launch trusted applications, and execute commands as root. LG has released a security update and recommends users install the latest firmware. Attackers could potentially take full control of vulnerable TVs. A compromised TV could be used as a foothold on a home or corporate network. No active exploitation in the wild has been reported so far. Check for and install the latest LG webOS firmware update. Keep smart TVs on a separate IoT or guest network when possible. Disable unnecessary remote-control or second-screen features if not needed. Tested this myself and was able to gain access on my LG TV.  Models included but not limit too.  LG LG43UM7000PLA LG OLED55CXPUA LG OLED48C1PUB LG OL...

Tensorlake npm package—the TypeScript SDK for Tensorlake (an AI agent infrastructure platform).   The package was injected with a variant of the Shai-H ​ ulud (ChainDrop) worm, which steals developer credentials, self-propagates through the victim's repositories, and deploys a destructive "hostage token" dead-man's switch. The attack bypassed traditional perimeter checks by leveraging compromised credentials from an internal project maintainer: Verified Commits: On October 7, 2026, the threat actor made direct file uploads to the main branch of the tensorlakeai/tensorlake GitHub repository using a maintainer’s verified identity, entirely bypassing the pull request process. Valid Provenance Attestation: Because the malicious code lived directly on the main branch, the repository's automated GitHub Actions pipeline legitimately built and published the package. Consequently, version 0.5.144 shipped with a valid npm provenance attestation, proving that secur...

BYOD — a new ransomware‑as‑a‑service gang — has leaked the full subscriber database of Trump Mobile, exposing 3,615 customers’ personal information. The breach is now well‑validated across multiple independent cybersecurity outlets, and the leaked data appears authentic.  BYOD claims it infiltrated Liberty Mobile , the MVNO powering Trump Mobile, by infecting a Liberty employee with infostealer malware / a remote access trojan (RAT) . Using stolen credentials, the attackers pivoted into Trump Mobile’s environment, where no multi‑factor authentication (MFA) was in place.  They exfiltrated 3,615 customer records , which they later dumped publicly on their dark‑web leak site. BYOD also claims it still has live access to a Trump Mobile dashboard.  Across all reporting, the exposed dataset includes: Full names Email addresses Phone numbers Home addresses Order histories Plan details (e.g., “30 Day Unlimited Talk Text Data”) Cancellation records Abandoned checkout data Unful...

Cloudflare Verification Pages on Windows (2025–2026 Threat Landscape) Fake Cloudflare “verification” pages are one of the most widespread Windows‑targeting malware delivery methods today. They impersonate Cloudflare’s browser‑check screens but instruct users to run Windows commands — something real Cloudflare never does . Below is a structured, detailed breakdown with current intelligence. These pages are not Cloudflare. They are malicious overlays injected into compromised websites. They mimic: Cloudflare Turnstile “Checking your browser…” interstitials Ray ID blocks CAPTCHA‑style verification But then they add instructions like: “Press Win+R to continue verification” “Paste the code we copied for you” “Run this command to complete human verification” This is the ClickFix / TerminalFix malware‑delivery technique. Windows provides attackers with: Win+R (Run dialog) PowerShell with iex(irm “…”) execution High corporate usage Access to browser cookies, saved passwords, crypto wall...

EY suffered a third‑party platform breach that exposed personal and financial data belonging to clients of Goldman Sachs’ wealth‑management division and Man Group , after an attacker accessed and downloaded tax‑related documents between March 28 and April 12, 2026 . The breach stemmed from a Checkmarx‑related vulnerability in a support‑ticket system EY used for tax services—not from any compromise of Goldman Sachs or Man Group’s own networks. An unauthorized third party infiltrated a third‑party IT service management (ITSM) platform used by EY’s tax teams. This system stored attachments containing sensitive client tax documents. Once inside, the attacker downloaded files tied to multiple EY clients, including individuals associated with: Goldman Sachs Wealth Management Man Group , the UK‑listed hedge fund EY detected suspicious activity on April 23 , 11 days after the last unauthorized access. By then, the data theft had already occurred. Across multiple disclosures, the comprom...

  It’s easy for phishers to hijack caller ID for smishing because the global telephone system was never designed to authenticate who is actually sending a call or text . Modern attackers exploit these structural weaknesses with cheap VoIP tools, SMS gateways, and cybercrime‑as‑a‑service platforms. The short version: caller ID is “asserted,” not verified — and attackers can simply lie. The core reasons spoofing is so easy 1. Legacy telecom protocols trust whatever caller ID is provided Traditional phone networks run on SS7 , a signaling system built decades ago when only national carriers interconnected. SS7 assumes all participants are trustworthy , so it accepts whatever caller ID a network claims without cryptographic verification. This “trust by default” model is fundamentally incompatible with modern threat actors. 2. VoIP and SIP make spoofing trivial VoIP systems use SIP headers (e.g., From , Contact , P‑Asserted‑Identity ) that can be manipulated by the sender. Attackers ca...

  SC WordPress backdoor is specifically engineered to rebuild itself after cleanup , using a self‑healing mesh of persistence layers across files, the database, and shared memory . Removing visible malware does nothing if even one persistence node survives.  The SC backdoor is not a single file — it’s a redundant network of loaders, drop-ins, fake plugins, database payloads, and shared-memory segments . Each component can recreate the others , forming a circular recovery loop. Core behaviors Lives in at least eight locations at once (files, DB, shared memory). Any surviving component rewrites missing ones on the next page load. Uses early‑loading WordPress hooks (auto_prepend, drop-ins, mu‑plugins). Stores full payloads in the database and in System V shared memory , allowing reinfection even after disk cleanup. Hides itself from plugin lists and update checks , and can forge admin cookies. Deleting the malicious plugin or file does not remove the backdoor. Here’s how th...

  How Attackers Turn ChatGPT‑Style Content Into RAT Delivery Lures — And Why Defenders Should Care Remote Access Trojans (RATs) remain one of the most persistent threats facing organizations today. While the malware itself hasn’t changed dramatically, the delivery mechanisms have — and generative AI has become part of that evolution. Attackers aren’t using AI to generate malware; they’re using it to polish the social‑engineering layer that gets victims to install it. What’s Actually Happening Cybercriminals are increasingly leveraging AI writing tools to create high‑quality phishing lures , making malicious emails look more legitimate, more personalized, and more convincing than ever. These lures are then paired with RAT payloads delivered through: Malicious attachments (fake invoices, resumes, shipping notices) Weaponized documents exploiting known vulnerabilities Links to compromised websites hosting installers Fake “security updates” or “account verification” prompts The AI‑ge...

  Unauthenticated attackers can write arbitrary files on FortiMail appliances via crafted HTTP/HTTPS requests. On a Linux‑based perimeter email gateway, arbitrary file write = practical remote code execution (RCE) . This flaw is confirmed exploited in the wild and added to CISA’s KEV catalog. CVE‑2026‑104286 combines two weaknesses: Path Traversal (CWE‑22) — FortiMail fails to sanitize directory traversal sequences ( ../ , encoded variants). Improper NULL Byte Neutralization (CWE‑158) — %00 truncates paths at the OS level, bypassing validation. Together, these allow attackers to write files anywhere on the filesystem through the web‑facing management or service interface.  Once an attacker can write arbitrary files, they can: Drop a webshell into a served directory Modify cron jobs Overwrite binaries invoked by privileged services Add SSH authorized_keys Plant persistence in FortiMail’s internal daemons Security researchers emphasize that this should be treated as an act...

  “SalesBleed” Exploits Salesforce AI Agents for Zero-Click Data Theft A newly disclosed set of vulnerabilities dubbed “SalesBleed” affected Salesforce Agentforce, demonstrating how an attacker could manipulate trusted AI agents to exfiltrate CRM data without a victim clicking a malicious link and potentially use those agents to conduct phishing through internal Slack channels. Researchers at Zenity Labs disclosed the findings on September 24, 2026. How SalesBleed Worked SalesBleed consists of three vulnerabilities involving Agentforce. Two could enable zero-click data exfiltration, while the third could allow an attacker to abuse an Agentforce-Slack integration to distribute phishing messages. The attack began with a surprisingly ordinary entry point: a public Salesforce Web-to-Lead form . An attacker could: Submit a poisoned sales lead containing malicious AI instructions through a public Web-to-Lead form. No Salesforce authentication was required. The malicious instructions ...