Placeholder domain used in dev docs now serves ClickFix attacks (2026-09-23 22:46 UTC)
Kurz: The “third-party.com” domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. […]
New RemControl Android banking malware targets users in Europe and Canada (2026-09-23 21:25 UTC)
Kurz: A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. […]
Check Point warns of hackers exploiting Security Gateway VPN RCE flaw (2026-09-23 19:53 UTC)
Kurz: Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. […]
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry (2026-09-23 18:06 UTC)
Kurz: Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for…
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You (2026-09-23 16:53 UTC)
Kurz: The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run a…
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key (2026-09-23 16:06 UTC)
Kurz: Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, c…