Author: Gary Behan

Five alleged leaders of the Black Axe syndicate arrived in the United States on 11 September 2026 to face wire fraud and money laundering charges, the latest development in a long-running transatlantic effort to dismantle a criminal network that has been running internet fraud campaigns for over a decade. The Black Axe cybercrime extradition caps an investigation stretching back to arrests made in South Africa in 2021 at the United States’ request.The five defendants, Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru, are accused of coordinating an internet fraud campaign from Cape Town between 2011 and 2021.…

Microsoft has confirmed that the KB5002914 Excel copy paste failure is real, reproducible, and currently without an official fix, leaving users of four Office versions unable to move data around their spreadsheets without realising anything has gone wrong. The bug surfaced in the wake of Microsoft’s September 2026 Patch Tuesday, which TechRepublic reports addressed 974 vulnerabilities across Microsoft products, making it the company’s largest Patch Tuesday release on record.What the KB5002914 Excel copy paste bug actually doesThe failure mode is frustratingly quiet. When the issue occurs, a user attempts to paste content, the source cell or range stays selected, the…

Microsoft has shipped a set of out-of-band updates to deliver a Windows RDS emergency fix, resolving Remote Desktop Services failures that its own September 2026 security updates introduced across Windows 10, Windows 11, and Windows Server. The same out-of-band releases also address a Hyper-V folder-sharing bug and a partial set of USB audio problems, though one audio issue remains open.The September security updates destabilised Remote Desktop Services on affected machines, producing RDP connection failures, sign-in errors, and in some cases servers that stopped responding entirely. Beyond the core RDS collapse, administrators found that related components could also seize up: Microsoft…

A mass-scanning campaign is actively exploiting a Vite dev server exploit to harvest cloud credentials from internet-exposed development environments, with attackers specifically after AWS and Azure secrets. The vulnerability at the centre of it all, The Hacker News reports, carries a CVSS score of 8.2 and was observed being weaponised throughout August 2026.The flaw, tracked as CVE-2026-39364, affects Vite versions 7.1.0 through 7.3.2 and the entire 8.x branch prior to 8.0.5. Disclosed on 7 April, it allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass file read and access controls, pulling files out of…

Microsoft has confirmed that the September 2026 RDS failures affecting Windows Server systems were triggered by this month’s Patch Tuesday security updates, and has since issued out-of-band fixes to address the mess. The issue touches Windows Server 2012 and later, along with Windows 10 and Windows 11 devices.The confirmation arrived via a release health update on Friday, following a wave of reports from Windows administrators who found that installing the September updates broke Remote Desktop Services (RDS) entirely. In some cases, servers had to be hard-reset just to regain basic functionality.What the September 2026 RDS Failures Actually Look LikeMicrosoft’s own…

Revolut has confirmed a Revolut data breach triggered by a fake government request, in which a threat actor impersonating a government agency obtained sensitive customer data, including passport copies, facial verification images, and full transaction histories. The company operates in over 160 countries and regions and serves more than 80 million customers worldwide, including 800,000 business customers. How the Fake Government Request Got Through The attacker sent an email to Revolut using a government agency’s official email domain. According to emails sent to affected customers, ‘the request came from an unauthorised email account sent directly using the official government agency’s…

A Sogou Input Method vulnerability carrying the identifier CVE-2026-51990 is being actively exploited in the wild to install the GrayRabbit backdoor on Windows machines, according to researchers at Gen Digital. The flaw is a one-click remote code execution weakness, and the group behind the campaign is UNC3569, a threat actor with documented ties to the People’s Republic of China. How the Sogou Input Method vulnerability is exploited The attack chains three weaknesses in Sogou Input Method, a widely used application developed by Tencent that lets users type Chinese characters on a standard keyboard. Gen Digital’s research team, Gen Threat Labs,…

The Dutch Nationaal Cyber Security Centrum (NCSC) is warning that exploitation of two Check Point VPN flaws is imminent, urging organisations to apply available patches without delay. The two vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-85103, have each been assigned a CVSS score of 9.8, placing them firmly in the critical severity category, according to Computing.No public proof-of-concept (PoC) exploit has been reported at this stage, but the NCSC is not waiting for one to appear before sounding the alarm. ‘The NCSC assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon,’ the…

Anthropic’s Claude AI threat intelligence report, published on 10 September 2026, details how multiple threat groups, financially motivated criminals and state-sponsored espionage actors linked to Russia and China, abused its models across an eight-month window stretching from December 2025 to August 2026. The catalogue of misuse covers cyber operations, influence campaigns, surveillance, scams, biological and conventional weapons development, and model distillation.One detail worth registering immediately: according to Anthropic’s own report, all confirmed malicious activity involved the Claude Haiku, Sonnet, and Opus model families. No harmful use was found on Claude Fable or Mythos. That is either reassuring or simply a…

Microsoft has detailed a Microsoft 365 passkey phishing campaign active since May 2026, in which threat actors impersonate corporate IT help desks to trick employees into handing over session tokens and credentials, with ShinyHunters, Helix, and related extortion groups identified as participants.The attacks begin well before any phone call or message is sent. According to Microsoft, the actors invest heavily in pre-attack research, gathering information about employees and organisational structure from public sources such as social networking and professional profiling platforms. Once they have enough to sound plausible, they contact targets directly (by phone or message) claiming that a passkey,…