Tracked as CVE-2026-76784, the flaw could allow an attacker on the same local network to send unauthorized commands to vulnerable devices. The issue has a CVSS v4.0 score of 8.7.

The vulnerability is caused by weaknesses in the security used to protect communication between Kasa devices and their local control components.

Attackers Could Manipulate Device Commands

An attacker does not need an account or special permissions to exploit the issue. However, they must have access to the same local network or wireless environment as the targeted device.

This could make shared Wi-Fi networks, compromised home networks, and poorly separated business networks potential attack environments.

Attackers could potentially capture legitimate device commands and reuse them or create their own commands.

Depending on the device, this could allow someone to:

• Turn smart plugs, switches, or lights on or off
• Interrupt connected appliances
• Change device behavior or schedules
• Repeatedly send commands and disrupt normal operation

The affected products include several Kasa smart plugs, switches, and the KL125 smart bulb, along with other models.

Firmware Updates Are Available

TP-Link has released updated firmware for affected products. Because firmware versions depend on the specific model, hardware revision, and region, users should check their exact device before installing an update.

Users can look for the latest firmware through the TP-Link Download Center or Kasa Smart app.

Until devices are updated, users and organizations can reduce their exposure by:

• Placing IoT devices on a separate network or VLAN
• Keeping smart devices away from sensitive systems
• Limiting access from guest networks
• Watching for unexpected device activity

The vulnerability is a reminder that smart home devices do not need to be directly exposed to the internet to become a security concern. An attacker who gains access to the local network may still be able to manipulate vulnerable IoT devices.

The post TP-Link Kasa Flaw Could Disrupt Smart Devices appeared first on First Hackers News.

Tracked as CVE-2026-18252, the flaw has a CVSS score of 7.3 and affects GitLab Enterprise Edition. GitLab fixed the issue in versions 19.3.1, 19.2.5, and 19.1.7.

GitLab.com has already been updated, but organizations running self-managed installations should upgrade as soon as possible.

How the Vulnerability Works

The problem is linked to the way the Duo Claude AI agent processes configuration supplied from a user-controlled source.

Under certain conditions, an authenticated user with Developer-level permissions could manipulate this behavior and cause the AI agent to execute arbitrary commands within a CI environment.

This is particularly concerning because CI pipelines often have access to sensitive development resources, including:

• Source code and build files
• Deployment credentials and cloud tokens
• Package registry credentials
• Secrets used by automated jobs

An attacker who gains command execution could potentially access exposed secrets, modify build artifacts, or interfere with software development and deployment processes.

GitLab Releases Security Fix

GitLab classified the vulnerability as an untrusted control sphere issue. Exploitation requires network access, low-level privileges, and user interaction.

There is currently no public exploit or evidence that the vulnerability is being actively exploited.

The same GitLab patch releases also address several other security issues, including denial-of-service vulnerabilities, access-control problems, and weaknesses involving pipeline and compliance policies.

Self-managed administrators should upgrade to the appropriate patched release:

• GitLab 19.3.1
• GitLab 19.2.5
• GitLab 19.1.7

The updates may require database migrations, so administrators should plan the upgrade according to their deployment architecture.

The vulnerability also highlights a broader security concern: AI agents integrated into development platforms should be treated as powerful automation systems with access to code and secrets.

Organizations should restrict access to AI-agent configurations, limit CI secrets, isolate pipeline jobs, and monitor automated workflows for unexpected command execution.

The post GitLab AI Agent Flaw Could Expose CI Pipelines appeared first on First Hackers News.

The first vulnerability, CVE-2026-75604, affects applications using the Image Optimization API on Windows servers. It is related to improper handling of file paths and can allow attackers to access files outside the intended application directory.

The issue affects certain Next.js versions using either the Pages Router or App Router, particularly when running on Windows-based systems.

Windows Applications Face Path Traversal Risk

The vulnerability is caused by insufficient restrictions on attacker-controlled file paths. By sending a specially crafted request, an attacker could potentially make the application access unintended locations on the server.

Successful exploitation could result in:

• Exposure of sensitive files
• Unauthorized modification of server content
• Disruption of application availability

The flaw requires no authentication or user interaction, although the advisory rates exploitation complexity as high.

Vercel has addressed the issue in Next.js 15.5.24 and 16.3.3. There is no reliable workaround for affected Windows deployments, making an update the recommended solution.

Malicious AVIF Images Could Trigger RCE

The second critical issue affects applications using the Image Optimization API to process AVIF images.

The problem is linked to libheif, an image-processing component used through the Sharp package. An attacker could submit a specially crafted AVIF image to a vulnerable image optimization endpoint.

If the malicious file is processed by the affected component, it could potentially lead to remote code execution on the server.

The vulnerability affects a wide range of Next.js releases, with fixes available in 15.5.24 and 16.3.3.

Next.js temporarily disabled AVIF optimization as a protective measure while the dependency issue was being addressed, but organizations should still upgrade their applications rather than relying on this mitigation.

Update Next.js Deployments

Organizations using Next.js should update to a patched release and rebuild their production applications or containers.

Security teams should also review:

• Public image-upload and image-optimization endpoints
• Windows-hosted Next.js applications
• Logs for unusual file-path requests
• Suspicious AVIF image-processing activity

Keeping both Next.js and its underlying dependencies updated is important because vulnerabilities in supporting libraries can also create serious risks for applications built on the framework.

The post Patch Now: Critical Next.js Flaw Enables RCE appeared first on First Hackers News.

Tracked as CVE-2026-19632, the vulnerability affects TranslatePress versions up to 3.3.1. The plugin has more than 400,000 active installations, making the issue important for a large number of WordPress websites.

The vulnerability has a CVSS score of 9.8, placing it in the critical category. It has been fixed in TranslatePress 3.3.2.

How the Vulnerability Can Be Exploited

The problem is related to how TranslatePress handles password-reset emails and stores text that can be translated.

Under certain settings, a password-reset link generated for an administrator can accidentally be saved inside the plugin’s translation data. This link contains information that could allow someone to reset the administrator’s password.

The affected translation data can then be accessed through a publicly available AJAX function in the plugin.

An attacker who knows an administrator’s username or email address could potentially:

• Request a password reset
• Find the exposed reset link
• Set a new administrator password
• Log in and take control of the website

Administrator Access Can Lead to Full Takeover

Successful exploitation could give an attacker administrator-level access to the affected WordPress site.

Once inside, an attacker could install malicious plugins, modify themes, create additional administrator accounts, change website content, or access sensitive information.

The vulnerability does not affect every TranslatePress installation under the same conditions. The exposure depends on how the administrator’s language settings and the plugin’s translation features are configured.

The issue was responsibly reported to Wordfence, which worked with TranslatePress developer Cozmoslabs to address the problem. A security update was released on August 13, 2026.

Update TranslatePress Immediately

Website owners using TranslatePress should update to version 3.3.2 or later as soon as possible.

Administrators should also review their websites for unexpected changes, unfamiliar user accounts, or newly installed plugins and themes. Enabling two-factor authentication or passkeys can provide another layer of protection for administrator accounts.

Keeping WordPress plugins updated is especially important because a vulnerable plugin can become an entry point to the entire website.

The post WordPress Plugin Flaw Puts 400,000 Sites at Risk appeared first on First Hackers News.

The attackers are not primarily interested in getting developers to install the packages. Instead, they are using the packages as a place to store deceptive web pages. Because those pages can be accessed through well-known package-hosting domains, the links may appear more trustworthy to unsuspecting users.

The campaign was discovered by OX Security, which found that the affected packages contained similar HTML-based phishing content. Some of the packages were receiving hundreds of downloads each week before they were taken down.

Trusted Domains Used to Build Trust

The malicious packages include HTML files designed to resemble familiar security verification pages, including fake Cloudflare CAPTCHA screens.

When someone opens one of these files through a package mirror, hidden JavaScript can communicate with external infrastructure controlled by the attackers. The visitor can then be sent to another website chosen by the attackers.

This approach gives criminals an advantage: the initial link may point to a legitimate package-mirror domain rather than a newly created suspicious website.

Services such as unpkg and other npm mirrors are commonly used by developers, making them difficult to block across an organization.

The destination can also be changed later, meaning the same hosted file could potentially be used to send visitors to different phishing campaigns.

ClickFix Makes the Attack More Dangerous

The campaign is particularly concerning because it can be connected to the growing ClickFix attack technique.

ClickFix campaigns typically show victims a fake verification message and instruct them to perform an action, such as copying a command and running it on their computer. Instead of exploiting a technical vulnerability, the attacker relies on the victim to complete the dangerous step.

Security teams should therefore watch for unusual activity involving package mirrors, especially when employees are accessing HTML files directly rather than downloading normal development dependencies.

Developers should also be careful with package links received through emails, messages, tickets, or search results. A familiar domain does not guarantee that every file hosted on it is safe.

Most importantly, never run a command simply because a webpage claims it is required to complete a CAPTCHA, security check, or verification process.

This campaign demonstrates how attackers are finding creative ways to hide phishing infrastructure inside services that organizations already trust.

Indicators of compromise (IoCs):-

The post npm Packages Exploited for ClickFix Phishing appeared first on First Hackers News.

The activity was detected on July 28, 2026, and ASOS confirmed the incident the following day. The company launched an investigation and found that an unauthorized party may have used previously exposed usernames and passwords to access customer accounts.

The incident appears to involve credential stuffing, where attackers test stolen login details from other websites against new services. This type of attack often succeeds when people reuse the same password across multiple accounts.

Customer Accounts Were Accessed

According to ASOS, the information that may have been accessed varies by account. It could include names, email addresses, delivery or billing addresses, phone numbers, dates of birth, and information connected to social media accounts.

Some payment information may also have been visible, including the cardholder’s name, last four digits of the card, and expiration date.

ASOS said there is no indication that full card numbers, CVV codes, or ASOS account passwords were exposed.

The company moved quickly to contain the incident. On July 29, it blocked access to affected accounts and required customers to reset their passwords. Customers were notified by email on July 30.

ASOS also found suspicious transactions on a small number of accounts. The company said its security systems or fraud team blocked or canceled those transactions, and no further unauthorized activity was identified after containment.

Password Reuse Remains a Major Risk

The incident highlights how attackers can take over accounts even when a company itself has not suffered a direct password database breach.

When credentials from an unrelated data breach are reused on another website, attackers can try those same combinations automatically. A successful login can then expose personal information or potentially lead to fraudulent purchases.

Customers affected by the incident should:

• Create a new, unique ASOS password
• Change the same password on other websites where it was reused
• Enable multi-factor authentication whenever available
• Review bank and payment accounts for unusual activity

Users should pay particular attention to their email, banking, payment, and social media accounts, as these can provide attackers with access to additional services.

Customers who are concerned about possible identity misuse can also review their credit reports and consider additional protections such as a fraud alert or credit freeze.

The ASOS incident is another reminder that password reuse can turn an old data breach into a new account takeover. Using unique passwords and multi-factor authentication can significantly reduce the risk of attackers successfully accessing multiple accounts

The post Hackers Target ASOS Accounts Using Stolen Login Credentials appeared first on First Hackers News.

The fraudulent websites claim to detect serious security problems and warn that third-party antivirus products are no longer supported by Windows. In reality, the scan is fake and the warnings are designed to pressure users into taking unsafe actions, leading them to believe they need to perform a Microsoft security scan.

Researchers found that the websites collect basic information about a visitor’s browser and device, then use it to create a convincing but completely fabricated security report. The ultimate goal is to move victims into a fake refund or technical-support process.

Fake Security Scan Creates a False Warning

Malwarebytes identified 11 related websites hosted on the same server. The pages use similar branding and attempt to look like legitimate Microsoft security checks.

The sites display warnings about Windows updates, browser protection, memory security, firmware settings, and processor performance. However, a normal webpage cannot perform the deep system checks it claims to conduct.

The scammers combine genuine device information, such as screen size and operating system details, with pre-written warnings. This makes the fake report appear personalized and convincing.

The displayed security score is also manipulated, with results kept between 13 and 30 out of 100, ensuring that visitors always believe their computer has serious problems.

The biggest red flag is the instruction to uninstall third-party antivirus software. Windows supporting Microsoft Defender does not mean other legitimate antivirus products are unsupported.

The Fake Refund Trap

After the fake scan, victims are taken to a refund form that requests personal and financial information. The page also asks for details about antivirus software and remote-access tools.

The scammers can then use a phone call to convince victims that they need to provide remote access to complete a supposed refund.

Some warning signs include:

• A webpage claiming to perform a complete security scan
• Extremely low security scores designed to create panic
• Instructions to remove antivirus protection
• Requests for banking or personal information
• Pressure to install remote-access software

According to Malwarebytes, information submitted through the fraudulent form is sent to the attackers through Telegram. Victims are then shown a message claiming that a refund representative will contact them shortly.

Once remote access is granted, scammers may be able to view files, access accounts, or monitor sensitive activity.

How to Stay Safe

Users should never trust a random webpage that suddenly claims their computer has serious security problems. Legitimate security providers do not require users to uninstall antivirus software or give strangers remote access to their computers.

If you encounter one of these fake scans, close the webpage and verify the warning through the official website of your security provider.

Anyone who has already provided remote access should disconnect the affected device from the internet, remove the remote-access software, restore antivirus protection, and run a full security scan.

If banking information was shared, contact the bank immediately using an independently verified phone number and change important passwords from a separate trusted device.

The scam relies on fear and urgency rather than real technical analysis. Taking a moment to verify an alarming security warning can prevent a fake scan from becoming a much more serious account or financial compromise.

Indicators of compromise (IoCs):-

The post Fake Security Scan Tricks Users Into Remote Access Scam appeared first on First Hackers News.

Along with this milestone, WhatsApp is introducing stronger two-step verification and additional information for calls from unknown numbers. These updates are designed to make accounts harder to compromise while helping users recognize potential scams.

The integration of WhatsApp passkeys is part of WhatsApp’s ongoing commitment to enhancing user safety and privacy.

Passkeys Make WhatsApp Accounts Safer

Passkeys allow users to sign in using security features already available on their devices, such as a fingerprint, Face ID, or screen lock. Unlike traditional passwords or SMS codes, passkeys use cryptographic credentials that remain securely associated with the user’s device.

This makes them much more resistant to phishing, credential theft, and other attacks that depend on tricking users into revealing login information.

WhatsApp has now reached more than 1 billion passkey users and is expanding support for people who use multiple devices or switch between Android and iPhone.

Users can manage their passkeys through Settings > Account > Passkeys, where they can add or review their available credentials.

The milestone is significant because messaging accounts contain valuable personal information and are increasingly targeted by attackers looking to steal conversations, impersonate users, or target their contacts.

Stronger Two-Step Verification

WhatsApp is also giving its two-step verification system a security upgrade. Instead of relying only on the traditional six-digit PIN, users can now create a stronger password.

The new password must be at least eight characters long, with at least one letter and one number. Users can also add special characters for additional protection.

A longer password provides a much larger combination of possible values than a short numeric PIN, making simple guessing and automated attacks more difficult.

Users who have been using an easy-to-guess PIN should take this opportunity to switch to a unique and stronger password.

More Context for Unknown Calls

WhatsApp is also adding another layer of protection against scams by providing more information when users receive calls from unknown numbers on Android.

The incoming call screen can show details such as whether the number is from another country or whether the caller shares a group with the recipient.

This additional context can help users pause before answering a suspicious call or responding to an unexpected request. That is particularly useful because many scams rely on urgency and social engineering rather than technical exploits.

Together, passkeys, stronger two-step verification, and improved caller information give WhatsApp users several layers of protection against phishing, account takeovers, and social-engineering attacks.

For users, the message is straightforward: enable passkeys when available, use a strong two-step verification password, and be cautious when dealing with unfamiliar callers or unexpected requests for sensitive information.

The post WhatsApp Strengthens Security With WhatsApp passkeys appeared first on First Hackers News.

The attackers impersonate IT support staff and convince employees that they need to install a software fix. What looks like a routine helpdesk request can ultimately give attackers access to the victim’s system and valuable corporate information.

Security researchers at Expel identified the campaign and found that the malware components appeared to have been developed around late July 2026.

Fake IT Support Leads to Malware Infection

The attack begins with a Teams conversation in which the threat actor poses as an internal IT service desk employee.

The victim is then directed to download an MSI file hosted on Azure Blob Storage, making the file appear more trustworthy.

The installer is presented as “PowerShell Cleaner” and drops additional files, including a ZIP archive and PowerShell scripts. These components launch the malware while keeping much of its activity hidden from the user.

SynkLoader can collect detailed information about the infected computer, including:

• Computer and username details
• User privileges
• Running processes and services
• Active Directory information
• System configuration

The malware communicates with attacker-controlled infrastructure at regular intervals and can receive commands or additional Python code.

It also creates a randomly named scheduled task that helps the malware restart after a reboot or user logon.

Fake Windows Lock Screen Steals Passwords

One of the more concerning components is PhishLocker, which displays a fake Windows 11 lock screen.

The screen is designed to look like a legitimate Windows password prompt and attempts to convince the victim to enter their Windows password.

The stolen password could then provide attackers with access to additional corporate services, particularly in environments where the same credentials are used across multiple applications.

Another component, called TrafficRedirector, can act as a reverse proxy through the infected computer. This could allow attackers to access internal services or route internet traffic through the victim’s corporate connection.

Researchers also identified capabilities for remote PowerShell access and VNC-based remote control, giving attackers additional ways to interact with a compromised system.

How Organizations Can Reduce the Risk

Employees should be cautious when receiving unexpected IT support requests through Teams. Any request to install software should be verified through a trusted internal communication channel before proceeding.

Security teams should monitor for:

• Unexpected external Teams communications
• Unapproved MSI downloads
• Newly created scheduled tasks
• Suspicious PowerShell activity
• Unusual in-memory execution
• Connections to known malicious infrastructure

Teams audit logs and endpoint telemetry should also be preserved when investigating suspected infections.

The campaign highlights an important security lesson: trusted communication platforms can become powerful delivery channels when attackers successfully impersonate internal support teams.

IoCs

The post Hackers Use Microsoft Teams Phishing to Deploy SynkLoader Malware appeared first on First Hackers News.

The flaw allows remote, unauthenticated attackers to execute operating system commands with the privileges of the zimbra user. This creates a serious risk for organizations running internet-facing Zimbra mail servers.

How the Zimbra Flaw Can Be Exploited

The vulnerability is associated with Zimbra’s SNMP trap functionality. Exploitation is possible when the snmp_notify parameter is enabled and the swatchdog service is running.

Since swatchdog is enabled by default, systems using the affected SNMP configuration may be exposed without requiring an attacker to have valid credentials.

Successful exploitation could give attackers access to the underlying mail server, allowing them to run commands, create or modify files, steal email data, deploy web shells, establish persistence, or attempt to move deeper into the organization’s network.

Active Exploitation and Detection

CERT Polska has confirmed that the vulnerability is being used in an ongoing attack campaign, making this more than a theoretical security concern.

Zimbra has addressed the issue in version 10.1.20. Administrators should verify their installed version and upgrade affected systems as soon as possible.

Organizations that cannot patch immediately should review whether SNMP trap functionality is required and check if the snmp_notify configuration is enabled.

Security teams should also inspect /var/log/zimbra.log for unusual “Service status change” entries. Unexpected service names, commands, or changes between running and stopped states could indicate malicious activity.

It is also important to search for recently created or modified files owned by the zimbra user, particularly in:

• /opt/zimbra/jetty/webapps/
• /opt/zimbra/jetty_base/webapps/
• /tmp/

Look for unfamiliar JSP files, scripts, archives, executable files, or heavily obfuscated content. Unexpected outbound connections from the Zimbra server should also be investigated.

What Organizations Should Do

Organizations running vulnerable Zimbra installations should prioritize upgrading to version 10.1.20 or a later fixed release.

If compromise is suspected, isolate the affected server, preserve relevant logs and suspicious files for forensic investigation, rotate potentially exposed credentials, and check other connected systems for signs of lateral movement.

The active exploitation of CVE-2026-73570 highlights why internet-facing email infrastructure requires rapid patching and continuous monitoring. Patching should be followed by log analysis and threat hunting to ensure attackers have not already established persistence.

The post Critical Zimbra Bug Exploited in the Wild appeared first on First Hackers News.