Author: Gary Behan

The FBI has carried out a NightmareStresser DDoS takedown, seizing the domains used by one of the world’s longest-running DDoS-for-hire platforms. The action, announced on Wednesday, adds another chapter to Operation PowerOFF, the long-running international law enforcement effort targeting so-called booter services worldwide.The seized domains, nightmare-stresser[.]com and nightmarestresser[.]org, now display a seizure banner stating that the action was supported by Operation PowerOFF. Before they were taken offline, the platform described itself as the ‘#1 online IP booter’ and ‘the only DDoS tool available 24/7.’ Those are bold claims for a service now bearing the FBI’s watermark.What NightmareStresser was and how…

The China-linked espionage group FamousSparrow has deployed the FamousSparrow SparroWocky backdoor across government organisations in Latin America, with researchers at ESET now publishing a detailed technical breakdown of the malware and its accompanying infrastructure. The campaign has been running for more than a year, and it marks a meaningful evolution in the group’s tooling.According to ESET researchers, SparroWocky is a modular, full-blown C++ backdoor that has, since August 2025, effectively replaced the group’s previous custom implant, SparrowDoor. Yahoo Finance’s coverage of the ESET research notes that FamousSparrow appears to have abandoned SparrowDoor entirely in favour of the new tool, and…

Anthropic is testing a Claude Money bank account feature that would let users connect their financial accounts directly to Claude, and it surfaced in the iOS app before any official announcement. Details remain thin precisely because of that sequencing: the feature appeared in the app ahead of any planned reveal, which means questions about supported banks, connection methods, and geographic availability are still unanswered.The feature was spotted by TestingCatalog on X, who noticed a new Money section appearing in the Claude iOS app alongside existing sections for Chats, Code, Artifacts, Dispatch, and Cowork. The page carries the line ‘Understand your…

Spain’s Agencia Española de Protección de Datos (AEPD) has received what it describes as the country’s first notification of a personal data breach attributed to an autonomous AI agent, and the agency says it changes the conversation around cybersecurity risk entirely. According to Fleet, the AEPD disclosed the incident on 14 September 2026, marking a concrete, documented case of what had until now largely remained a theoretical threat.The organisation that filed the notification described an attack in which an AI agent powered by a known large language model (LLM) identified vulnerabilities in generic files, successfully logged into their systems, and…

The ransomware attack recovery cost that actually cripples businesses has very little to do with the ransom itself. When downtime, remediation, legal work and business disruption are factored in, the average total cost of a ransomware incident reached $5.08 million, according to IBM’s Cost of a Data Breach Report 2025, a figure that dwarfs what most organisations ever hand over to attackers.The median ransom payment, per the 2026 Verizon Data Breach Investigations Report, is $139,875. That number is easy to misread, though. According to Medha Cloud, the median ransom payment sits at $200,000, while the mean has been pulled upward…

Copilot buttons missing in classic Outlook for Windows remain unresolved, with Microsoft confirming it is still actively investigating the fault while offering a temporary workaround for affected users.The problem surfaces for customers holding either a Copilot Chat (Basic) licence or a paid M365 Copilot (Premium) account. For those users, the Copilot and Copilot Chat buttons can simply vanish from the side navigation pane and the area above the ribbon, with no obvious reason why.What the Copilot Buttons Missing in Outlook Bug Actually DoesMicrosoft has laid out the ways the fault can present itself. The Copilot button may disappear from the…

Windows Server 2022 end of support arrives on 13 October 2026, when the platform exits mainstream support and transitions to extended support, which runs until 14 October 2031. Microsoft posted the reminder on Friday, and it comes with a clear nudge: start testing Windows Server 2025 sooner rather than later.The timeline is straightforward. The October 2026 security update will be the last one issued under mainstream support. From that point on, Windows Server 2022 moves to extended support, which covers monthly security updates at no additional cost through October 2031. That is still five years away, but enterprise upgrade cycles…

A high-severity privilege escalation vulnerability in the Acronis cPanel backup plugin has been added to CISA’s Known Exploited Vulnerabilities catalogue after the company confirmed active exploitation in what it describes as ‘limited, targeted attacks.’ Tracked as CVE-2026-87886 with a severity score of 7.8, the flaw affects Acronis’s backup integrations for cPanel, WebHost Manager (WHM), and Plesk, the control panels that sit at the heart of a huge proportion of shared and managed web hosting infrastructure worldwide.What CVE-2026-87886 actually doesThe vulnerability is a Linux local privilege escalation bug: a low-privileged attacker who already has a foothold on a vulnerable server can…

CenterPoint Energy has confirmed a CenterPoint Energy data breach in which an attacker obtained personal information belonging to an unspecified portion of its customers, after the threat actor went public with 7.49 million records allegedly pulled from the company’s own external-facing systems. The attacker’s account of how they did it makes uncomfortable reading for anyone responsible for API security. How the CenterPoint Energy data breach unfolded The attacker, operating under the alias “4d722e4d656f77”, told Help Net Security that the data was extracted by iterating through millions of IDs on CenterPoint’s public API. According to the threat actor, the API lacked…

A previously unknown malware framework, BambooToken MQTT malware, has been quietly compromising Windows and Linux systems since at least February 2023, with activity now confirmed as recently as July 2026, according to Ampus Cyber. Lumen’s research arm, Black Lotus Labs, published its own analysis of the campaign, detailing how the malware uses the Message Queuing Telemetry Transport (MQTT) protocol for command-and-control (C2) communications, a trick that helps it dodge detection by avoiding any direct connection between infected machines and attacker infrastructure.MQTT is a lightweight messaging protocol built for Internet of Things (IoT) devices. It routes messages through a central broker…