VulnHub

Brevo has confirmed that cybercriminals managed to steal a Cloudflare API key, which they then used to inject harmful ClickFix scripts into Brevo's websites and the JavaScript files of its customers. This injection allowed the attackers to distribute malware across various customer sites, potentially affecting numerous users and businesses relying on Brevo's services. The incident raises serious concerns about supply chain security, as it highlights the vulnerabilities that can arise when third-party services are compromised. Companies using Brevo's services should be vigilant and assess their security measures to prevent similar attacks in the future. This incident is a stark reminder of the risks associated with API key management and the importance of securing access credentials.

A serious vulnerability has been discovered in Docker Sandboxes running on macOS, allowing malicious code to escape its designated project directory. This flaw, tracked as CVE-2026-77179, enables attackers to read and modify files on the host system with the same privileges as the user running the virtual machine. Docker issued a security warning on September 15, highlighting the potential risks for users of affected Docker versions. This vulnerability is particularly concerning because it could lead to unauthorized access to sensitive files, posing a significant threat to data integrity and privacy. Users of Docker on macOS should take immediate action to secure their systems against potential exploitation.

Researchers have linked the Iranian hacktivist group Handala Hack to a new surveillance tool called HEAVYGRAM, which operates through Telegram. This backdoor allows attackers to execute commands remotely, collect system and network information, and even capture screenshots. Additionally, there's a Delphi-based utility named CRUDEEXCLUDE involved. These tools can exfiltrate sensitive data, including passwords and Telegram session files, raising significant concerns for users of these platforms. The implications are serious, as the use of such tools could lead to widespread data breaches and privacy violations, especially for individuals and organizations utilizing Telegram for communication.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued new guidance urging critical infrastructure organizations to implement cyber decoys within their networks. These decoys, which can mimic real assets, are designed to lure attackers and help organizations detect malicious activities more effectively. By placing these decoys strategically, companies can disrupt threats before they cause significant damage. This approach is particularly important for sectors that are frequently targeted by cybercriminals, as it can enhance overall security and response capabilities. CISA's recommendations come at a time when the frequency of cyberattacks on critical infrastructure continues to rise, emphasizing the need for proactive defense strategies.

Revolut has reportedly been the target of hackers who impersonated an Italian government agency, successfully accessing customer information for five months. During this time, the attackers compromised 680 high-profile accounts and demanded a ransom of $3 million. The breach raises significant concerns about the security measures in place at Revolut and the potential for misuse of sensitive customer data. Customers of Revolut, particularly those with high-profile accounts, should be vigilant and monitor their accounts for any unusual activity. This incident underscores the ongoing challenges companies face in protecting customer data from sophisticated cyber threats.

Authorities have taken action against NightmareStresser, a notorious DDoS-for-hire service that has been operational since at least 2022. This service has been linked to hundreds of thousands of distributed denial-of-service (DDoS) attacks, with the operators claiming connections to Russia. The crackdown aims to disrupt the activities of cybercriminals who have been using this platform to target various organizations and individuals, causing significant disruption and financial damage. The seizure of the service's domains is a crucial step in combating the growing problem of DDoS attacks, which have become more prevalent and sophisticated in recent years. The implications of this action may deter other potential DDoS-for-hire services from operating or encourage them to go underground.

A serious vulnerability has been discovered in the Unbound DNS resolver, specifically in its DNSSEC validator. Versions prior to 1.26.1 contain a heap overflow flaw that could allow an attacker to execute remote code if they control a malicious DNS zone and target a vulnerable resolver. This issue, tracked as CVE-2026-81642, was disclosed by NLnet Labs, the maintainer of Unbound. The newly released version 1.26.1 resolves this critical flaw, making it essential for users and organizations running affected versions to update immediately. The potential for remote code execution poses significant risks, including unauthorized access to systems and data breaches, underlining the importance of keeping software up to date.

Ransomware attacks targeting manufacturers have surged by 40% in early 2026, according to recent research. This increase is largely attributed to ransomware groups taking advantage of disruptions in the supply chain caused by operational shutdowns. The manufacturing sector is particularly vulnerable, as these attacks not only threaten individual companies but can also have a cascading effect on broader supply networks. Experts warn that as these disruptions continue, manufacturers need to bolster their cybersecurity measures to protect against potential attacks. The situation highlights the growing intersection of cybersecurity and supply chain management, making it crucial for companies to remain vigilant.