Breaking News – Cyber Threats – 2026-09-02 08:00 PDT

Breaking News – Cyber Threats (last 6h)

Generated: 2026-09-02 08:00 PDT

• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
  The Hacker News • 2026-09-02 07:06 • thehackernews.com
  Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication.

  The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive
  https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html

• Ransomware protection for MSPs: A 6-point checklist for faster recovery
  BleepingComputer • 2026-09-02 07:02 • www.bleepingcomputer.com
  Ransomware resilience requires more than backups or endpoint detection alone. Acronis outlines six capabilities MSPs should test across client environments, from reducing exposure and detecting attacks to preserving recovery points and restoring operations quickly. […]
  https://www.bleepingcomputer.com/news/security/ransomware-protection-for-msps-a-6-point-checklist-for-faster-recovery/
• Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
  The Hacker News • 2026-09-02 06:44 • thehackernews.com
  A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting.

  Check Point Research said it has tracked the campaign since mid-2025.

  The modules
  https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html

• BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
  The Hacker News • 2026-09-02 06:12 • thehackernews.com
  Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separately said 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise.

  The incident window ran from approximately August 28 at 20:57
  https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html

• Dropbox accounts breached through Lenovo email verification flaw
  BleepingComputer • 2026-09-02 05:30 • www.bleepingcomputer.com
  Dropbox is warning some users that an unauthorized party accessed their accounts by exploiting a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs. […]
  https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/
• Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
  The Hacker News • 2026-09-02 05:22 • thehackernews.com
  Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices.

  ThreatFabric said the campaign’s advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union
  https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html

• How to Secure Enterprise AI: From Adoption to Incident Readiness
  The Hacker News • 2026-09-02 04:30 • thehackernews.com
  The debate about whether AI delivers business value is over. The challenge now is implementing it at scale and securely across every function while meeting board-level pressure to move fast. Organizations must focus on adopting AI at business speed without losing control of cyber risk. Download the full eBook here. 

  The Business Reality 

  In Sygnia’s 2026 CISO Survey Report, which
  https://thehackernews.com/2026/09/how-to-secure-enterprise-ai-from.html

• Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
  The Hacker News • 2026-09-02 03:53 • thehackernews.com
  SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks.

  The vulnerabilities, discovered internally by SonicWall’s William Perry and Adam Babis, are listed below –

  CVE-2026-83548 (CVSS score: 10.0) –  A pre-authentication SSRF vulnerability in the Appliance
  https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html

• Microsoft Defender flags legitimate Google search links as malicious
  BleepingComputer • 2026-09-02 03:29 • www.bleepingcomputer.com
  Microsoft is investigating an issue causing the Defender for Office 365 security software to mistakenly block access to legitimate Google search links. […]
  https://www.bleepingcomputer.com/news/security/microsoft-defender-flags-legitimate-google-search-links-as-malicious/
• Wireless Routers as Motion Detectors
  Schneier on Security • 2026-09-02 03:22 • www.schneier.com

  Comcast has added motion detection as a feature to its wireless routers:

  The feature sends push notifications to users when motion is detected near a connected device, such as a TV or printer. It has different settings for when people are home, asleep, or away. The Xfinity app also lets users see live motion activity and a feed of recent activity.

  Comcast acknowledges that the system has some limitations. Home size, layout, building mater…
  https://www.schneier.com/blog/archives/2026/09/wireless-routers-as-motion-detectors.html

• GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
  The Hacker News • 2026-09-02 02:18 • thehackernews.com
  Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals.

  The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31.

  GeoNetwork originated at the United Nations Food and
  https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html

• Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
  The Hacker News • 2026-09-02 02:10 • thehackernews.com
  The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017.

  Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, the U.S. Attorney’s Office for the Northern District of California
  https://thehackernews.com/2026/09/extradited-russian-hacker-faces-charges.html

• US charges Russian for infecting 80,000 freelancers with malware
  BleepingComputer • 2026-09-02 02:06 • www.bleepingcomputer.com
  A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware. […]
  https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/

Sources: BleepingComputer, The Hacker News, KrebsOnSecurity, SANS ISC, CISA.