Breaking News – Cyber Threats – 2026-09-04 13:00 PDT

Breaking News – Cyber Threats (last 6h)

Generated: 2026-09-04 13:00 PDT

• IDScan sued over alleged data breach affecting 153 million drivers
  BleepingComputer • 2026-09-04 09:56 • www.bleepingcomputer.com
  Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver’s licenses. […]
  https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/
• Using a VM to Contain an AI Agent
  Schneier on Security • 2026-09-04 09:31 • www.schneier.com

  It won’t work:

  My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact.

  An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.

  https://www.schneier.com/blog/archives/2026/09/using-a-vm-to-contain-an-ai-agent.html

• Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
  The Hacker News • 2026-09-04 08:57 • thehackernews.com
  Microsoft is alerting of a “high-volume phishing campaign” that’s using invisible Unicode tag characters to bypass email filters.

  “Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them,” the Microsoft Security Research team said.

  The
  https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html

• Critical Citrix NetScaler auth bypass now leveraged in attacks
  BleepingComputer • 2026-09-04 08:25 • www.bleepingcomputer.com
  Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian. […]
  https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/
• PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
  The Hacker News • 2026-09-04 08:20 • thehackernews.com
  PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server.

  The flaw, tracked as CVE-2026-6471 (CVSS score: 7.2), has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are
  https://thehackernews.com/2026/09/postgresql-fixes-12-year-old-logical.html

• New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
  The Hacker News • 2026-09-04 07:51 • thehackernews.com
  A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors.

  The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and
  https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html

• Microsoft says some users can’t open the Teams desktop client
  BleepingComputer • 2026-09-04 07:30 • www.bleepingcomputer.com
  Microsoft is working to resolve a known issue that causes delays or blocks some users from opening the Microsoft Teams desktop client on Windows systems. […]
  https://www.bleepingcomputer.com/news/microsoft/microsoft-says-some-users-cant-open-the-teams-desktop-client/
• 39 New Methods That Compromise Passkey Authentication
  BleepingComputer • 2026-09-04 07:01 • www.bleepingcomputer.com
  Passkeys eliminate many password-based attacks, but researchers have documented 39 methods for compromising authentication built around them. Token explains how attackers can abuse authentication prompts, synced credentials, enrollment, recovery, and other trust boundaries without breaking FIDO2 cryptography. […]
  https://www.bleepingcomputer.com/news/security/39-new-methods-that-compromise-passkey-authentication/

Sources: BleepingComputer, The Hacker News, KrebsOnSecurity, SANS ISC, CISA.