Latest security news

Fri, 4 Sept 2026

1. 15:20
   PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

   PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. The flaw, tracked as CVE-2026-6471 (CVSS score: 7.2), has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are

   The Hacker News
2. 14:51
   New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

   A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and

   The Hacker News·Linux
3. 14:23
   OpenAI pledges $1B to provide resources, training for frontline cyber defenders

   Amid heightened scrutiny, the company will use frontier AI to help water, power and local government providers fight malicious actors.

   Cybersecurity Dive
4. 13:22
   New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges

   An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "FalconFlank" that lets attackers escalate privileges on up-to-date Windows systems.

   BleepingComputer·Windows
5. 13:00
   AI Is Ending the Era of Hidden Vulnerabilities — Are Vendors Ready?

   A tidal wave of bug reports is overwhelming software vendors, exposing secure-by-design failures and creating disclosure bottlenecks.

   Dark Reading
6. 12:00
   DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

   Overview A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage in long-term surveillance. The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected. Operating alongside this are an SSH keylogger, a curl-based RAT, and a stager. The RAT maintains a watchdog thread dedicated to tracking HAProxy’s health, and reporting it back to the operator’s infrastructure. The earliest uploads on VirusTotal date back to mid-2025 and the

   Rapid7 Blog·Linux
7. 08:48
   Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

   Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including

   The Hacker News·WordPress
8. 07:35
   Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

   Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The streaming media service did not elaborate on what those issues are, but said CVE identifiers have been requested for them. "We recommend all server owners and Desktop users

   The Hacker News
9. 07:18
   Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

   Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote

   CriticalUsed in attacksThe Hacker News·Google, Chrome
10. 06:47
    GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests

    OpenAI on Thursday officially unveiled GPT‑6 Astra, which it described as the "world's most intelligent and aligned model." The development comes days after the artificial intelligence (AI) company said the model had reached the "Critical" cybersecurity capability threshold under its Preparedness Framework. "Astra is state-of-the-art on computer use, browsing, software engineering,

    The Hacker News