Researchers from the security firm Calif have demonstrated a new worm that can take over WeChat accounts through incoming calls, without the recipient needing to answer or interact with their phone. This attack requires that the caller is already in the victim's WeChat contacts. Calif tested the worm on three different phones, successfully showing how it propagates. The company reported this vulnerability to Tencent, the owner of WeChat, in July 2023. This type of attack raises significant concerns for users, as it exploits a common communication method and could potentially compromise personal information or lead to unauthorized access to accounts.
Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.
Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.
Cisco has issued a warning about serious vulnerabilities in its Secure Email product related to S/MIME flaws that could allow attackers to access encrypted email content. Additionally, critical vulnerabilities in its IOS XR and Nexus switch software could let hackers execute remote code and bypass authentication, posing a significant risk to affected systems. Companies using these products should take immediate action to secure their environments, as the potential for exploitation could lead to unauthorized access and data breaches. The vulnerabilities have been publicly disclosed, emphasizing the need for users to stay vigilant and apply any available patches to mitigate risks. Cisco has released patches for the critical switch vulnerabilities, but users must address the S/MIME flaws as they remain unpatched at this time.
A member of Serbia's student protest movement has had their iPhone infected with Pegasus spyware, developed by the NSO Group. Researchers from the Citizen Lab, in partnership with the SHARE Foundation, discovered that a zero-click exploit via iMessage was used for the infection. This means the spyware could be installed without any interaction from the user, posing a significant risk to privacy and security. The incident raises concerns about surveillance tactics used against activists and highlights the ongoing issue of digital rights violations in regions with political unrest. Such spyware can gather sensitive information without the target's knowledge, making it a powerful tool for repression.
The Iranian hacking group known as Nimbus Manticore has been linked to two new types of malware that can affect both Linux and macOS systems. These malware families are remote access trojans (RATs) created using Node.js and JavaScript, allowing attackers to gain control over infected devices. Researchers from Kaspersky noted that the group is using a clever tactic of posing as recruiters to deliver malicious code through fake coding tests. This development is concerning as it expands the group's targeting capabilities and indicates a shift in their methods. Users and organizations using Linux or macOS systems should be vigilant and consider enhancing their security measures to prevent potential infections.
A cyber espionage group linked to China, known as Fire Ant, has broadened its operations to target Cisco IOS XR routers, TACACS servers, and Linux management hosts. This escalation follows a previous focus on VMware hypervisors. The group aims to steal credentials and disable security logs, which could severely compromise the integrity of high-value networks. Sygnia, the incident response firm that investigated the incidents, emphasizes the significance of these vulnerabilities given the critical role these systems play in network management and authentication. Organizations using these technologies should be vigilant and take immediate steps to secure their infrastructures.
A new phishing-as-a-service platform named AnonyMousKIT has been discovered, which automates the process of stealing passcodes from iPhones. This service utilizes voice AI agents to trick users into providing their unlock codes, specifically targeting those who have had their Apple devices stolen. Once attackers obtain the passcodes, they can disable the Activation Lock, allowing them to access and potentially resell the stolen devices. This poses a significant risk to iPhone users, as it could lead to increased theft and exploitation of stolen devices. Users are urged to remain vigilant and skeptical of unsolicited calls requesting sensitive information.
A security researcher known as Zerotistic has found a way to enroll a Linux device in Apple's Find My network, which typically only supports Apple products. By deceiving Apple's systems, the researcher managed to send location data from the network to a Linux machine. This discovery raises concerns about the security of Apple's location services, as it indicates that unauthorized devices could potentially gain access to sensitive location information. Users of Apple's ecosystem should be aware of this vulnerability, as it could lead to unauthorized tracking of devices. The implications extend to privacy and security, prompting a need for Apple to examine its protocols to prevent similar exploits in the future.
On August 18, 2026, Apple addressed a significant security vulnerability in its image handling framework that could allow malicious images to execute harmful code on both desktop and mobile devices. This vulnerability is identified as CVE-2026-65346 and poses a risk to users who may unknowingly open compromised image files. The issue could potentially lead to unauthorized access or control over affected devices, making it crucial for users to update their systems promptly. Apple has released patches to fix this vulnerability, emphasizing the importance of keeping software up to date to protect against such threats. Users of both macOS and iOS devices should ensure they are running the latest versions to mitigate this risk.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified four critical vulnerabilities that are currently being exploited in the wild, adding them to its Known Exploited Vulnerabilities (KEV) catalog. Among these is CVE-2026-65400, a serious authentication flaw in Apple macOS that could allow unauthorized access. Other vulnerabilities affect Microsoft SharePoint, VMware vCenter, and Microsoft IKE, all of which pose significant risks to organizations using these platforms. With a CVSS score of 9.8 for CVE-2026-65400, it’s crucial for users and companies to act quickly to mitigate these risks. The exploitation of these vulnerabilities could lead to severe data breaches or unauthorized access, making it essential for affected parties to stay informed and apply necessary updates and patches.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities catalog, specifically targeting flaws in Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE. One notable vulnerability, CVE-2026-33824, relates to the Windows Internet Key Exchange (IKE) Service Extensions and poses a risk of remote code execution. These vulnerabilities could allow attackers to exploit systems running the affected software, potentially leading to unauthorized access or data breaches. It's crucial for users and organizations utilizing these platforms to take immediate action to mitigate the risks associated with these vulnerabilities. Keeping software updated and applying any available patches is essential to protect against potential exploitation.
The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being targeted by cybercriminals. The vulnerabilities include a double free flaw in Microsoft Internet Key Exchange (CVE-2026-33824), a weak authentication issue in Microsoft SharePoint (CVE-2026-55040), a path traversal vulnerability in Broadcom's VMware vCenter (CVE-2026-59310), and an improper authentication vulnerability in Apple macOS (CVE-2026-65400). These vulnerabilities pose significant risks, especially for federal agencies, which are required to prioritize their remediation under Binding Operational Directive 26-04. Although this directive specifically targets federal agencies, CISA encourages all organizations to adopt similar practices to enhance their security posture against these threats.
Hackers are exploiting a recently patched vulnerability in macOS, known as CVE-2026-65400, which allows unauthorized access to the macOS Screen Sharing feature. This flaw enables attackers to bypass authentication and gain root access to affected systems, leading to the installation of cryptominers without user consent. The Netherlands’ National Cyber Security Centre has issued a warning about this active exploitation, emphasizing the need for users to update their systems. Apple has released patches for macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1) to address this issue, urging all macOS users to upgrade promptly to protect their devices. Failure to do so could leave systems vulnerable to further attacks and unauthorized resource usage.
Recently, a vulnerability in macOS screen sharing has been exploited by attackers to gain root access to affected systems. Once inside, they deployed a Monero miner, which utilizes the system's resources to mine the cryptocurrency without the owner's consent. This incident raises concerns for macOS users, particularly those who rely on screen sharing features for remote work or support. The exploitation of this vulnerability not only compromises the integrity of the systems involved but also highlights the need for users to stay vigilant about software updates and security practices. As the attacks are ongoing, users should be particularly cautious and monitor their systems for unusual activity.