Clear Infosec Threat Intelligence Bulletin – Sep 9th, 2026

A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users. Read more

The Hugging Face incident was bigger and worse than previously thought, with approximately 700 agents collaborating on a sophisticated, multistage attack. Read more

Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functionality to spread inf… Read more

More than 1,000 organisations, 500,000 stolen credentials, and one self-propagating worm named after a Dune sandworm – two men now face charges over TeamPCP’s g… Read more

Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access. Read more

Drivers in North America received a nasty shock this week when it was revealed that digital scans of 153 million drivers’ licenses were f… Read more

Despite singing the praises of zero trust for many years, many CISOs have struggled to implement the framework in full. And now comes wha… Read more

Microsoft is warning that the window for patching vulnerabilities is rapidly shrinking, as attackers move from disclosure to exploitation… Read more

Attackers have turned previously legitimate browser extensions into malware after acquiring them from legitimate publishers, potentially … Read more

Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-ba… Read more

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on t… Read more

Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX’s artificial intelligence (AI)-powered coding assistant Cursor to b… Read more

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, tha… Read more

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow c… Read more

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late Se… Read more

ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitabl… Read more

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT…. Read more

Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative… Read more

Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary… Read more

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe?Commerce and?Magento Open Source that has come under active exploit… Read more

When AI agents communicate with one another, they may decide to cheat when they have difficulty achieving their goals. The solution could involve teaching them… Read more

A US law firm is alleging that UK-based telecoms and software company ConnexAI sold it software and AI systems that failed to perform as the vendor claimed, an… Read more