Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management gave outsiders useful clues before login. The Chinese gaming company sold the online platform to an investor group called San Vicente Acquisition LLC in May 2020. Securities and Exchange Commission on September 2, 2026, the California-based company said it settled the suit related to historical data practices before 2020, when it was managed by Kunlun. Over allegations that it shared users’ personal information, including their HIV status, with third-parties. New enhancements eliminate the need for hardware replacements or manual firmware updates when transitioning to smartphone credentials. Intrado has expanded its OneAlert emergency notification software to include a Canadian French interface for multilingual North American organizations.
- “Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,” Trezor said .
- Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska’s attack warning , published on September 5.
- N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.
- The attacks rely on backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients.
- It also said that the data extortion threat actor known as Cinder likely represents yet another rebrand or a possible continuation of Pink operations, citing overlaps between organizations listed on the Cinder leak site and those connected to Pink.
Chrome users were caught off guard by a 4-GB Google AI model baked into Chrome, sparking privacy concerns. WIRED rebuilt Flock’s latest search tool from code the company sends to a police officer’s browser. A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software.
CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes. https://www.imfirewall.us/deconstructing-modern-cyber-threats-advanced-tactics-and-defense-mechanisms/ Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska’s attack warning , published on September 5. JSCeal was first documented by Check Point in July 2025, highlighting the threat actors’ use of fake cryptocurrency trading sites to which unsuspecting users are redirected via malicious ads on Facebook and Google. A TantoSec proof-of-concept turns an AES-CBC “padding oracle” in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July.
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
- A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software.
- Sansec, which discovered the flaw and named it StyleSmuggler , said attacks started on September 4.
- Alpharetta, Georgia, cops share data with thousands of Flock users, ranging from federal agencies to a fish and wildlife commission.
- CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes.
- Map cross-domain privilege escalation to sever breach routes at key choke points.
Intelligent automated camera systems enable healthcare facilities to monitor patient safety, detect falls and enhance privacy in real time. New software updates aim to streamline video monitoring, speed up incident investigations and lower server hardware costs. https://myshoppingconnection.com/what-is-the-safest-way-to-shop-online-from-international-stores/ Unsanctioned AI agents create data exfiltration risks as security leaders urge governance that tracks automated actions without slowing workflows. A major software update brings redesigned navigation, Apple Watch support and enhanced device controls to Prima security users.
Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing
11 years of practitioner data on what it takes to keep pace with a field that keeps shifting. It also said that the data extortion threat actor known as Cinder likely represents yet another rebrand or a possible continuation of Pink operations, citing overlaps between organizations listed on the Cinder leak site and those connected to Pink. It also functions as a remote access and browser monitoring toolkit that runs host commands, steals credentials, hijacks sessions… Privacy laws by sharing sensitive data for commercial purposes such as advertising.
The company named the four programs https://expandsuccess.org/what-are-innovative-solutions-to-common-problems/ ProManager , WinUpdate , SoftManager , and LockAppHost and published the findings on September 2 , along with a technical white paper . “The payloads are protected with javascript-obfuscator , using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers,” Check Point Research said in a technical report published last week. N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. For the 2026 Cloud Security Index , Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have almost nothing in common. Read the full recap for the week’s major developments, plus more research, attacks, and security news beyond what we covered last week. Add active attacks on browsers, routers, and online stores, and there’s plenty to check—even for teams that have kept up with the patches.
