Author: Gary Behan

The Bitget North Korea crypto hack is now larger than first disclosed: on-chain tracing has pushed the revised total to $387.5 million, up from the initial $351.6 million figure the exchange announced after discovering the breach, according to BleepingComputer. Bitget’s security systems flagged the first unauthorised transfers at 18:31 UTC on 24 September 2026, according to Tech Insider, triggering a full suspension of withdrawals that remains in place while investigators work through what happened.The exchange says its cold wallets and the overwhelming majority of platform assets are secure and unaffected. Hot and warm wallets bore the brunt of the attack,…

A fresh variant of the MacSync malware iCloud calendar technique has surfaced, with the Swift-based infostealer now hiding attacker commands inside publicly accessible iCloud calendar event descriptions to pull down next-stage payloads. Kaspersky researchers uncovered the campaign, detailing a malware family that has grown considerably more capable since it first emerged as a variant of the AMOS stealer family in April 2025.How the MacSync iCloud Calendar Delivery Chain WorksThe more complex of the two delivery methods Kaspersky identified involves a downloader that retrieves commands hidden in the description field of a public iCloud calendar event. Those commands are passed directly…

A GitLab email token exposure flaw is allowing attackers to push code, open merge requests, and raid CI/CD secrets, and the entry point has been hiding in plain sight inside public READMEs and contributing guides the whole time. Researchers at application security company Aikido have published findings showing that a built-in GitLab feature, quietly misused, hands outsiders the ability to act as a project’s token owner with no password required. What the GitLab email token actually does GitLab includes a feature called ‘Email work item to this project’, which generates a private email address for each project. When an external…

The clock on FedRAMP VDR VER compliance is ticking toward 7 December 2026, the date on which the Vulnerability Detection and Response and Vulnerability Exploitability and Response rules become mandatory for all cloud service offerings obtaining or maintaining FedRAMP certification. A grace period extends through 7 March 2027 for offerings operating under a corrective action plan, but the harder truth is that most programmes have not yet fully scoped what these rules actually require.The rules did not arrive without warning. CISA issued Binding Operational Directive 26-04, to which FedRAMP’s VDR and VER notice responds, and FedRAMP had already released the…

Microsoft has released the Windows 11 KB5124010 update, a September 2026 non-security preview build carrying 46 changes across Windows 11 24H2 and 25H2. Among the headliners: Bluetooth reliability improvements, Emoji 17.0 support, and a new setting that lets users remap the Copilot key to something they might actually use more often.As an optional preview update, KB5124010 gives administrators and keen users the chance to test improvements and bug fixes ahead of their scheduled arrival in next month’s Patch Tuesday cumulative update. The important caveat is that monthly optional updates of this type carry quality improvements only; security fixes are not…

Microsoft has shipped a fix for the Windows File History backup bug that left users on multiple Windows 10 and Windows 11 versions unable to create or update backups after installing September 2026 security updates. The fix arrived quietly, but the underlying problem had already caused enough noise in Event Viewer and enough confusion over phantom drive errors to warrant its own service alert.What the File History backup bug actually doesFile History, accessible via Control Panel under System and Security, backs up a user’s account profile (Documents, Music, Pictures, Videos and Desktop) to an external drive or network location, then…

The domain third-party.com, long treated as a generic placeholder in developer documentation, is now serving a third-party.com ClickFix attack that impersonates a Cloudflare security check and attempts to trick Windows users into running malicious PowerShell commands. As The Hacker News reported, the domain has been serving the lure since at least June 2026.Manifold Security first flagged the issue after discovering the malicious page while examining public AI skills and MCP server documentation that referenced the domain. BleepingComputer subsequently confirmed that visitors to third-party.com are served a fake Cloudflare ‘Performing security verification’ CAPTCHA screen, complete with a ‘Verify you are human’…

A financially motivated threat actor has been deploying AI agents as credit card skimmers, compromising at least 119 websites and stealing more than 600,000 payment card records, all while keeping the per-target cost under $80. The campaign has been active since at least July and was still ongoing as of 22 September, according to findings from cybersecurity startup Gambit. The operation runs on three open-source AI agent frameworks working in sequence. Strix handles scanning and vulnerability discovery. Cairn functions as an autonomous exploitation engine, tasked with objectives such as obtaining a shell or admin access. Hermes, the orchestration layer, manages…

An infrastructure management systems attack trend has emerged as the defining theme of the September edition of Eclypsium’s InfraTrust Pulse, with the platforms used to configure and control enterprise network devices now firmly in attackers’ crosshairs. Between 25 August and 17 September, the report tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities, 42 rated critical, eight carrying a maximum CVSS score of 10.0, and 71 exploitable remotely without authentication.Five of the advisories contained vulnerabilities that made it onto CISA’s Known Exploited Vulnerabilities (KEV) catalog. But the headline finding is not the raw volume; it is where the…

The Always On VPN September update for Windows 11 is breaking enterprise VPN connections, Microsoft has warned IT administrators, with affected systems either hanging in a ‘Connecting’ state or cycling through repeated failed attempts. The culprit, according to Microsoft Support, is that KB5124008 and subsequent updates enable a feature called Machine Identity Isolation, and that feature only works properly in environments running a Windows Server 2025 Domain Functional Level or above.In a service alert shared by Microsoft MVP Susan Bradley and seen by BleepingComputer, Microsoft confirmed the issue affects customers whose systems attempt to connect to an enterprise network via…