Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can’t Install Fix
Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac,…
Category: TheHackerNews
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini…
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports…
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Ravie LakshmananSep 16, 2026Vulnerability / Web Security A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has…
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Swati KhandelwalSep 16, 2026Artificial Intelligence / Software Security Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later…
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Ravie LakshmananSep 16, 2026Vulnerability / Web Security Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that…
BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows…
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran’s intelligence service uses to…
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the…
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Ravie LakshmananSep 15, 2026Vulnerability / Malware With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for…
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
Swati KhandelwalSep 15, 2026Vulnerability / Web Security A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on…
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
A flaw in Telegram Desktop let a bot’s message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said…