PPHM HACKER NEWS

🔴 Microsoft fixes broken copy and paste for Excel 2016 users

Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update.

This follows a wave of customer reports on the Microsoft Q&A forums and Reddit that KB5002914 breaks copy-and-paste, autofill, and formula dragging in Excel.

"Although users try to paste content, the source remains selected and the destination is unmodified," Microsoft said when it confirmed these issues earlier this week and blamed them on what it described as a code regression. "When this issue occurs, users receive no indication of the failure, such as a beep or error message."

🔴 MIND Secures $72 Million for AI-Powered DLP

Data loss prevention (DLP) startup MIND has announced raising $72 million in a Series B funding round that brings the total raised by the company to $112 million.

The investment round was led by Crosspoint Capital Partners, with additional support from previous investors YL Ventures and Paladin Capital Group.

Based in Seattle, MIND emerged from stealth mode in 2024 with an AI-native DLP platform built to protect customer data through smart automations.

MIND provides real-time detection and blocks data exfiltration attempts across the entire enterprise environment, including email, endpoint, gen-AI, and SaaS deployments.

🔴 Check Point, Kaspersky, Tanium Patch Product Vulnerabilities

Cybersecurity firms Check Point, Kaspersky, and Tanium have each patched severe vulnerabilities in their products, including ones that can be exploited for remote code execution.

Check Point has informed customers about a critical vulnerability affecting Security Management and Log Server products.

The flaw, CVE-2026-91843, can be exploited by an unauthenticated attacker “to remotely execute arbitrary code with root privileges through the login process.”

🔴 AI Agent Breaches Spanish Organization, Modifies Personal Data

A Spanish organization has suffered a personal data breach at the hands of an agentic AI system (with human oversight).

On Sept. 14, Spain's Data Protection Agency (AEPD) — the Spanish government's data protection watchdog — described a breach report submitted by an unnamed organization, in which an unidentified hacker used a "well-known language model" to breach corporate personal data stores. Details are scarce, but the AI appears to have discovered and exploited a set of loose credentials, plus an enterprise application vulnerability, allowing its proprietor to modify personal data records and access corporate invoices.

🔴 RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.

"Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses an automated multi-stage infection pipeline," Zimperium researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega said.

"Once deployed, it pairs Accessibility abuse with autonomous local ADB (Android Debug Bridge) self-pairing to break out of the standard Android application sandbox, staging independent native daemons that execute with shell-level privileges."

🔴 Find out why insiders are becoming the new cybercriminal weapon

“Disloyal” employees can earn hundreds of thousands of dollars by selling access to their company or exclusive information.

Milan, September 15, 2026 – Cybercriminals are increasingly leveraging insiders within the organizations they target. This is the latest dangerous trend emerging from “ The Market for Trust: How Cybercriminals Recruit Corporate Insiders ,” the latest study from TrendAI™ , a global leader in AI security and a business unit of Trend Micro™.

🔴 Your PC isn't infected; it's just been rented to hackers. Loader-as-a-Service (LAAS) is here

Malicious programs are increasingly resembling ordinary software. Unit 42 experts discovered a large infrastructure they called CL-CRI-1171, which for at least two years sold criminal hackers access to individuals' personal devices.

The scheme operates on a pay-per-install (PPI) model, where the client pays for the delivery of their malware to the victim's computers. This model has existed for many years, but CL-CRI-1171 has expanded this base to the advertising network level. A single operator attracts audiences, verifies visitors, and distributes programs from multiple clients to infected systems.

🔴 Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials

A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header.

This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10.

The issue impacts pgAdmin 4 versions 6.2 through 9.17 and has been addressed in pgAdmin 4 version 9.18.

Local Code Execution Can Escalate to Full macOS Control Through Virtualization Layer

A high-severity vulnerability in Parallels Desktop for Mac could allow a low-privileged local user or malicious process to execute code with root privileges on the host system.

🔗 Read More

🔴 North Korean IT Workers Pay People to Sit Through Job Interviews While They Control the Computer

North Korean IT-worker operators are recruiting foreign nationals to sit on camera during remote job interviews.

At the same time, the real candidate provides answers, completes coding tasks, or remotely controls the proxy’s computer, according to new research from Silent Push.

The campaign turns ordinary job seekers into identity and payment intermediaries, creating a direct route around location checks, hiring controls, and sanctions screening.

🔴 SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firms

A wider cluster of SpiceRAT command-and-control infrastructure has been linked to the SilkParasite cyber-espionage activity targeting government, telecommunications, and energy-related entities across Central Asia.

The infrastructure findings extend the operational footprint around servers previously associated with the suspected China-nexus cluster, but do not establish that any impersonated organization was compromised.

Detection logic derived from Cisco Talos’ 2024 analysis of SpiceRAT first flagged related systems in late 2025, while a coordinated group of five active servers emerged in mid-March 2026.

🔴 “Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation

Security researchers at ADEX have documented a cloaking technique that requires no cloaking code at all.

Instead of running user-agent detection on attacker-controlled servers, the operators chained together three fully legitimate components a Google search results page, a hacked educational website, and a standard redirect in an evasion strategy designed to bypass Google Ads screening and ad moderation.

🔴 Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation.

The campaign combines targeted social engineering, Microsoft Defender exclusion abuse, multi-stage loaders, and Telegram-based command-and-control to surveil Iranian dissidents, journalists, and people perceived as opponents of the Iranian government.

The research expands on U.S. government disclosures issued earlier this year.

On March 19, the U.S. Department of Justice seized four domains it said were used by Iran’s Ministry of Intelligence and Security (MOIS) to support cyber-enabled psychological operations and transnational repression, including Handala-Hack[.]to and Handala-Redwanted[.]to.

🔴 "What if Hitler had the atomic bomb first?" DeepSeek attacks the US AI race

DeepSeek engineer Liu Shenyu has harshly criticized the idea of ​​slowing down the development of advanced AI, promoted by Anthropic and OpenAI executives. The developer, who participated in the creation of the DeepSeek V4.1 models, stated that he fears even more a scenario in which the most powerful systems end up under the control of a few American companies, and compared a potential Anthropic monopoly on general AI to a hypothetical situation in which Nazi Germany had obtained the atomic bomb first.

Liu published his thoughts amid a sudden heated debate about the speed of AI development. He believes advanced models should remain accessible to a broad group of developers and users , while Anthropic and OpenAI's closed distribution model risks concentrating computing resources, knowledge, and technological influence in the hands of a few corporations.

🔴 Two in Five Organisations Hit by AI-Related Compliance Failures in Past Year, Research Finds

40% of organisations have suffered an AI-related compliance or governance issue in the last 12 months, with legacy and poorly designed business processes identified as the leading cause, according to new research from Camunda.

The study found that process-related issues contributed to 84% of the compliance and governance failures organisations reported. Employees appear acutely aware of the risk: 79% said they fear their own use of AI could trigger a compliance issue at their organization, while 96% expect process-related challenges to fuel future AI compliance problems.

🔴 BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).

A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.

Real-Time Phishing Platform Turns SMS Scams Into Interactive Fraud Operations

A sophisticated phishing framework known as JWR is being used in large-scale SMS campaigns to steal payment-card information, banking credentials, one-time passwords, identity documents and digital-wallet accounts.

🔗 Read More

🔴 RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

RatHat, a newly identified Android banking malware family that combines Accessibility abuse, local Android Debug Bridge (ADB) pairing, native shell-level components, and generative-AI-assisted interface automation.

The operation appears linked to China-based threat actors and is primarily designed to steal banking credentials, payment PINs, one-time passwords, device-unlock secrets, and other high-value data from infected Android devices.

In one analyzed build, the malware could impersonate a well-known streaming service and dynamically alter its visible icon and app label, including use of a “Chrome” activity alias.

🔴 Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

A security breach at Gyazo, Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday.

It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links.

Helpfeel said those IDs could be used to view the images without permission, and that it has temporarily disabled viewing of some of them.

🔴 AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals

AI agents can end up retraining the model that powers them, a process that can embed recoverable secrets in the model and eliminate refusals the model had been previously trained to enforce, according to new research from AI security firm Irregular.

Researchers at Irregular found that an AI coding agent, tasked only with fixing incorrect application outputs, chose on its own to fine-tune and redeploy the open-weights model powering both the application and future instances of itself.

The experiment used a self-hosted setup in which a single open-weights model filled two roles: one instance ran a coding agent doing standard software maintenance work, and a separate instance powered an AI application that translated plain language requests into a fictional query language. Both instances loaded from the same checkpoint.