CosmicBytez Labs https://labs.cosmicbytez.ca IT & Cybersecurity Intelligence - News, Security Advisories, HOWTOs, and Project Guides en-ca Wed, 30 Sep 2026 15:14:06 GMT https://labs.cosmicbytez.ca/images/icon.png CosmicBytez Labs https://labs.cosmicbytez.ca <![CDATA[AI's Third Wave: Coworkers Break the Security Model That Worked for Agents]]> https://labs.cosmicbytez.ca/news/2026-09-30-ais-third-wave-coworkers-break-the-security-model-that-worked-for-agents https://labs.cosmicbytez.ca/news/2026-09-30-ais-third-wave-coworkers-break-the-security-model-that-worked-for-agents Wed, 30 Sep 2026 00:00:00 GMT news AI Identity Security Non-Human Identity Agentic AI Access Management Token Security <![CDATA[Alleged ShinyHunters Leader Arrested in the Netherlands]]> https://labs.cosmicbytez.ca/news/2026-09-30-alleged-shinyhunters-leader-arrested-in-the-netherlands https://labs.cosmicbytez.ca/news/2026-09-30-alleged-shinyhunters-leader-arrested-in-the-netherlands Wed, 30 Sep 2026 00:00:00 GMT news ShinyHunters Cybercrime Law Enforcement Data Extortion FBI <![CDATA[Bitget Says $387.5 Million Theft Traces Back to a Zero-Day in Third-Party Security Products]]> https://labs.cosmicbytez.ca/news/2026-09-30-bitget-hacked-via-zero-day-in-third-party-security-products https://labs.cosmicbytez.ca/news/2026-09-30-bitget-hacked-via-zero-day-in-third-party-security-products Wed, 30 Sep 2026 00:00:00 GMT news Bitget Cryptocurrency Exchange Zero-Day North Korea TraderTraitor Crypto Theft <![CDATA[Google: AI Is Changing the Pace and Profile of Vulnerability Discovery]]> https://labs.cosmicbytez.ca/news/2026-09-30-google-ai-is-changing-the-pace-and-profile-of-vulnerability-discovery https://labs.cosmicbytez.ca/news/2026-09-30-google-ai-is-changing-the-pace-and-profile-of-vulnerability-discovery Wed, 30 Sep 2026 00:00:00 GMT news AI Vulnerability Management GTIG Google CVE Threat Intelligence <![CDATA[Citrix NetScaler Zero-Days Exploited for Weeks Against Government, Finance Targets]]> https://labs.cosmicbytez.ca/news/2026-09-30-government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks https://labs.cosmicbytez.ca/news/2026-09-30-government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks Wed, 30 Sep 2026 00:00:00 GMT news Zero-Day Citrix NetScaler Nation-State Government Financial Services <![CDATA[High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL]]> https://labs.cosmicbytez.ca/news/2026-09-30-high-severity-vulnerabilities-patched-in-openssl-wolfssl https://labs.cosmicbytez.ca/news/2026-09-30-high-severity-vulnerabilities-patched-in-openssl-wolfssl Wed, 30 Sep 2026 00:00:00 GMT news Security Updates OpenSSL WolfSSL TLS DTLS Certificate Validation <![CDATA[Kiteworks Lifts Shutdown Advisory After 'Credible Threat Intelligence' From Federal Authorities]]> https://labs.cosmicbytez.ca/news/2026-09-30-kiteworks-lifts-shutdown-advisory-after-credible-threat-intelligence-from-federal-authorities https://labs.cosmicbytez.ca/news/2026-09-30-kiteworks-lifts-shutdown-advisory-after-credible-threat-intelligence-from-federal-authorities Wed, 30 Sep 2026 00:00:00 GMT news Vulnerability Security Updates Kiteworks Managed File Transfer Zero-Day <![CDATA[Know Your Enemy: Browser-Based Attack Techniques in 2026]]> https://labs.cosmicbytez.ca/news/2026-09-30-know-your-enemy-browser-based-attack-techniques-in-2026 https://labs.cosmicbytez.ca/news/2026-09-30-know-your-enemy-browser-based-attack-techniques-in-2026 Wed, 30 Sep 2026 00:00:00 GMT news Browser Security Phishing AiTM Session Hijacking Malicious Extensions OAuth Abuse <![CDATA[WSL Containers Reaches General Availability, Bringing Native Linux Containers to Windows]]> https://labs.cosmicbytez.ca/news/2026-09-30-microsoft-is-rolling-out-linux-container-support-to-wsl https://labs.cosmicbytez.ca/news/2026-09-30-microsoft-is-rolling-out-linux-container-support-to-wsl Wed, 30 Sep 2026 00:00:00 GMT news Microsoft Windows Linux WSL Containers <![CDATA[Russian APT Star Blizzard Uses 'RedFlick' Infection Chain in Recent Attacks]]> https://labs.cosmicbytez.ca/news/2026-09-30-russian-apt-star-blizzard-redflick-infection-chain https://labs.cosmicbytez.ca/news/2026-09-30-russian-apt-star-blizzard-redflick-infection-chain Wed, 30 Sep 2026 00:00:00 GMT news Star Blizzard Russia FSB Phishing Nation-State Ukraine <![CDATA[South Africa Seeks Help After Cyberattack Targets Air Traffic Control]]> https://labs.cosmicbytez.ca/news/2026-09-30-south-africa-seeks-help-after-cyberattack-targets-air-traffic-control https://labs.cosmicbytez.ca/news/2026-09-30-south-africa-seeks-help-after-cyberattack-targets-air-traffic-control Wed, 30 Sep 2026 00:00:00 GMT news Ransomware Cybercrime Critical Infrastructure Aviation Security Operational Technology Data Exfiltration <![CDATA[CVE-2023-54400: Fumasoft Fumeng Cloud Unauthenticated SQL Injection]]> https://labs.cosmicbytez.ca/security/cve-2023-54400 https://labs.cosmicbytez.ca/security/cve-2023-54400 Wed, 30 Sep 2026 00:00:00 GMT security Fumasoft CVE-2023-54400 SQL Injection Cloud Security <![CDATA[CVE-2026-76718: HPE OneView Cross-Site Scripting Flaw Enables Session Hijacking]]> https://labs.cosmicbytez.ca/security/cve-2026-76718 https://labs.cosmicbytez.ca/security/cve-2026-76718 Wed, 30 Sep 2026 00:00:00 GMT security HPE CVE-2026-76718 OneView Cross-Site Scripting Session Hijacking Infrastructure Management <![CDATA[DMARC Aggregate Report Monitoring with ParseDMARC, Elasticsearch, and Grafana]]> https://labs.cosmicbytez.ca/projects/2026-09-30-dmarc-email-security-monitoring-parsedmarc https://labs.cosmicbytez.ca/projects/2026-09-30-dmarc-email-security-monitoring-parsedmarc Wed, 30 Sep 2026 00:00:00 GMT project DMARC Email Security SPF DKIM ParseDMARC Elasticsearch Grafana Homelab <![CDATA[101 Malicious npm Packages Hijack Developer WhatsApp Accounts via Baileys Library]]> https://labs.cosmicbytez.ca/news/2026-09-29-101-malicious-npm-packages-add-developers-whatsapp-accounts-to-groups-without-co https://labs.cosmicbytez.ca/news/2026-09-29-101-malicious-npm-packages-add-developers-whatsapp-accounts-to-groups-without-co Tue, 29 Sep 2026 00:00:00 GMT news npm Supply Chain Attack WhatsApp Baileys Malicious Packages OX Security <![CDATA[Apple Patches Meta-Reported Zero-Day Tied to 'Extremely Sophisticated' Attack]]> https://labs.cosmicbytez.ca/news/2026-09-29-apple-patches-zero-day-cve-2026-86950 https://labs.cosmicbytez.ca/news/2026-09-29-apple-patches-zero-day-cve-2026-86950 Tue, 29 Sep 2026 00:00:00 GMT news Apple Zero-Day iOS macOS Meta CoreGraphics <![CDATA[Apple Zero-Day Vulnerability Weaponized in Targeted Attacks]]> https://labs.cosmicbytez.ca/news/2026-09-29-apple-zero-day-vulnerability-weaponized-in-targeted-attacks https://labs.cosmicbytez.ca/news/2026-09-29-apple-zero-day-vulnerability-weaponized-in-targeted-attacks Tue, 29 Sep 2026 00:00:00 GMT news Apple Zero-Day Spyware CISA KEV Mobile Security Meta <![CDATA[Arizona Supreme Court Says Hackers Stole Residents' Personal Data]]> https://labs.cosmicbytez.ca/news/2026-09-29-arizona-supreme-court-says-hackers-stole-residents-personal-data https://labs.cosmicbytez.ca/news/2026-09-29-arizona-supreme-court-says-hackers-stole-residents-personal-data Tue, 29 Sep 2026 00:00:00 GMT news Data Breach Arizona Phishing Government Court Systems Protective Orders <![CDATA[Mandiant: Suspected State Hackers Exploited NetScaler Zero-Day for Three-Plus Weeks Undetected]]> https://labs.cosmicbytez.ca/news/2026-09-29-attackers-exploited-citrix-netscaler-zero-day-for-at-least-three-weeks-undetecte https://labs.cosmicbytez.ca/news/2026-09-29-attackers-exploited-citrix-netscaler-zero-day-for-at-least-three-weeks-undetecte Tue, 29 Sep 2026 00:00:00 GMT news Citrix NetScaler Mandiant Nation-State Zero-Day Incident Response <![CDATA[Automated AI Agent Used to Breach Cybersecurity Nonprofit DIVD]]> https://labs.cosmicbytez.ca/news/2026-09-29-automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd https://labs.cosmicbytez.ca/news/2026-09-29-automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd Tue, 29 Sep 2026 00:00:00 GMT news AI Agentic AI Data Breach Incident Response Netherlands Vulnerability Disclosure <![CDATA[Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers]]> https://labs.cosmicbytez.ca/news/2026-09-29-dual-netscaler-zero-days-trigger-chaos-for-citrix-customers https://labs.cosmicbytez.ca/news/2026-09-29-dual-netscaler-zero-days-trigger-chaos-for-citrix-customers Tue, 29 Sep 2026 00:00:00 GMT news Citrix NetScaler Zero-Day CVE-2026-88771 RCE CISA KEV <![CDATA[Former US Air Force Members Sentenced to 189 Months Combined Over BEC Scheme]]> https://labs.cosmicbytez.ca/news/2026-09-29-former-us-air-force-members-sent-to-prison-over-bec-attacks https://labs.cosmicbytez.ca/news/2026-09-29-former-us-air-force-members-sent-to-prison-over-bec-attacks Tue, 29 Sep 2026 00:00:00 GMT news BEC Business Email Compromise Phishing Cybercrime Wire Fraud DOJ <![CDATA[Hackers Exploit Citrix NetScaler Zero-Day to Deploy Web Shells]]> https://labs.cosmicbytez.ca/news/2026-09-29-hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells https://labs.cosmicbytez.ca/news/2026-09-29-hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells Tue, 29 Sep 2026 00:00:00 GMT news Citrix NetScaler Zero-Day Web Shells Root Access Mandiant <![CDATA[JadePuffer: Agentic AI Threat Actor Hits Microsoft Azure, Destroys Cloud Resources in Minutes]]> https://labs.cosmicbytez.ca/news/2026-09-29-jadepuffer-agentic-ai-azure-attack https://labs.cosmicbytez.ca/news/2026-09-29-jadepuffer-agentic-ai-azure-attack Tue, 29 Sep 2026 00:00:00 GMT news Agentic AI Microsoft Azure Ransomware Cloud Security Storm-3168 Credential Theft <![CDATA[Kiteworks Patches Critical Flaw, Brings Customer Systems Online]]> https://labs.cosmicbytez.ca/news/2026-09-29-kiteworks-patches-critical-flaw-brings-customer-systems-online https://labs.cosmicbytez.ca/news/2026-09-29-kiteworks-patches-critical-flaw-brings-customer-systems-online Tue, 29 Sep 2026 00:00:00 GMT news Kiteworks Vulnerability BleepingComputer Security Updates Patch Advanced Forms <![CDATA[New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks]]> https://labs.cosmicbytez.ca/news/2026-09-29-new-spectre-v2-variant-exposes-intel-amd-arm-cpus-to-data-leaks https://labs.cosmicbytez.ca/news/2026-09-29-new-spectre-v2-variant-exposes-intel-amd-arm-cpus-to-data-leaks Tue, 29 Sep 2026 00:00:00 GMT news Spectre CPU Vulnerability Side-Channel Attack Intel AMD Arm <![CDATA[OpenAI Apologizes After AI Agents Breached Four Australian Government Websites]]> https://labs.cosmicbytez.ca/news/2026-09-29-openai-apologizes-for-agents-breaching-australian-government-websites-without-au https://labs.cosmicbytez.ca/news/2026-09-29-openai-apologizes-for-agents-breaching-australian-government-websites-without-au Tue, 29 Sep 2026 00:00:00 GMT news OpenAI AI Agents Australia Medicare Data Breach AI Safety <![CDATA[OpenAI Pauses Tool-Use Training After Agent Exploits DNS Loophole to Reach External Chatbot]]> https://labs.cosmicbytez.ca/news/2026-09-29-openai-pauses-tool-use-after-agent-bypasses-internet-controls https://labs.cosmicbytez.ca/news/2026-09-29-openai-pauses-tool-use-after-agent-bypasses-internet-controls Tue, 29 Sep 2026 00:00:00 GMT news OpenAI AI Safety Reinforcement Learning DNS AI Agents Misalignment <![CDATA[Poper Blocker: Chrome Web Store 'Ad Blocker' Caught Spying on Millions]]> https://labs.cosmicbytez.ca/news/2026-09-29-poper-blocker-chrome-store-spyware https://labs.cosmicbytez.ca/news/2026-09-29-poper-blocker-chrome-store-spyware Tue, 29 Sep 2026 00:00:00 GMT news Chrome Web Store Spyware Browser Extensions Data Exfiltration Google Big Star Labs <![CDATA[RemoteThreat Launches With $7 Million for Offensive Operations Platform]]> https://labs.cosmicbytez.ca/news/2026-09-29-remotethreat-launches-with-7-million-for-offensive-operations-platform https://labs.cosmicbytez.ca/news/2026-09-29-remotethreat-launches-with-7-million-for-offensive-operations-platform Tue, 29 Sep 2026 00:00:00 GMT news Offensive Security Red Team Startup Funding Cyber Operations AI Government Contracting <![CDATA[One Packet, No Password: High-Severity TDengine Zero-Day Threatens Industrial Servers]]> https://labs.cosmicbytez.ca/news/2026-09-29-tdengine-ot-zero-day-industrial-servers https://labs.cosmicbytez.ca/news/2026-09-29-tdengine-ot-zero-day-industrial-servers Tue, 29 Sep 2026 00:00:00 GMT news TDengine Zero-Day OT Security ICS Denial of Service IoT <![CDATA[Former US Air Force Members Sentenced to Prison for $2 Million Cyber Fraud Scheme]]> https://labs.cosmicbytez.ca/news/2026-09-29-us-air-force-members-given-over-6-years-in-prison-for-cyber-theft-of-more-than-2 https://labs.cosmicbytez.ca/news/2026-09-29-us-air-force-members-given-over-6-years-in-prison-for-cyber-theft-of-more-than-2 Tue, 29 Sep 2026 00:00:00 GMT news Business Email Compromise Phishing Wire Fraud US Air Force DOJ Cybercrime <![CDATA[US, UK, and Dutch Agencies Warn of Actively Exploited Citrix NetScaler Zero-Days]]> https://labs.cosmicbytez.ca/news/2026-09-29-us-uk-warn-citrix-netscaler-zero-day https://labs.cosmicbytez.ca/news/2026-09-29-us-uk-warn-citrix-netscaler-zero-day Tue, 29 Sep 2026 00:00:00 GMT news Citrix NetScaler Zero-Day CISA NCSC RCE <![CDATA[Vietnamese National Charged in $16 Million 'Pig Butchering' Crypto Scam]]> https://labs.cosmicbytez.ca/news/2026-09-29-vietnamese-man-charged-in-16-million-pig-butchering-crypto-scam https://labs.cosmicbytez.ca/news/2026-09-29-vietnamese-man-charged-in-16-million-pig-butchering-crypto-scam Tue, 29 Sep 2026 00:00:00 GMT news BleepingComputer General Cryptocurrency Cybercrime Pig Butchering Money Laundering DOJ <![CDATA[Critical Stack Overflow in FAST FAC1200R Routers Has Public Exploit]]> https://labs.cosmicbytez.ca/security/cve-2026-101037 https://labs.cosmicbytez.ca/security/cve-2026-101037 Tue, 29 Sep 2026 00:00:00 GMT security Router IoT CVE-2026-101037 Buffer Overflow RCE Network Security <![CDATA[CVE-2026-101074: Netcore NR289-GE Pre-Authentication Stack Buffer Overflow]]> https://labs.cosmicbytez.ca/security/cve-2026-101074 https://labs.cosmicbytez.ca/security/cve-2026-101074 Tue, 29 Sep 2026 00:00:00 GMT security Netcore CVE-2026-101074 Router Security Buffer Overflow IoT <![CDATA[CVE-2026-101075: Netcore NR289-GE Unauthenticated OS Command Injection]]> https://labs.cosmicbytez.ca/security/cve-2026-101075 https://labs.cosmicbytez.ca/security/cve-2026-101075 Tue, 29 Sep 2026 00:00:00 GMT security Netcore CVE-2026-101075 Router Security Command Injection RCE IoT <![CDATA[CVE-2026-101076: Netcore NR289-GE Router Unauthenticated OS Command Injection]]> https://labs.cosmicbytez.ca/security/cve-2026-101076 https://labs.cosmicbytez.ca/security/cve-2026-101076 Tue, 29 Sep 2026 00:00:00 GMT security Netcore CVE-2026-101076 Router Security Command Injection RCE IoT <![CDATA[CVE-2026-101077: Netcore NR289-GE Authentication Bypass in the boa_temp Handler]]> https://labs.cosmicbytez.ca/security/cve-2026-101077 https://labs.cosmicbytez.ca/security/cve-2026-101077 Tue, 29 Sep 2026 00:00:00 GMT security Netcore CVE-2026-101077 Router Security Authentication Bypass IoT <![CDATA[CVE-2026-12342: SailPoint IdentityIQ Unauthenticated Remote Code Execution]]> https://labs.cosmicbytez.ca/security/cve-2026-12342 https://labs.cosmicbytez.ca/security/cve-2026-12342 Tue, 29 Sep 2026 00:00:00 GMT security IdentityIQ CVE-2026-12342 Identity Governance RCE Enterprise Security <![CDATA[CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution]]> https://labs.cosmicbytez.ca/security/cve-2026-86950-apple-multiple-products-out-of-bounds-write-vulnerability https://labs.cosmicbytez.ca/security/cve-2026-86950-apple-multiple-products-out-of-bounds-write-vulnerability Tue, 29 Sep 2026 00:00:00 GMT security Apple CVE-2026-86950 CoreGraphics iOS Memory Corruption Zero-Day <![CDATA[CVE-2026-102268: PyJWT is_pem_format PEM Validation Bypass]]> https://labs.cosmicbytez.ca/security/pyjwt-pem-format-validation-bypass-cve-2026-102268 https://labs.cosmicbytez.ca/security/pyjwt-pem-format-validation-bypass-cve-2026-102268 Tue, 29 Sep 2026 00:00:00 GMT security PyJWT CVE-2026-102268 JWT Algorithm Confusion Python Supply Chain Critical Vulnerability <![CDATA[CVE-2026-101187: Ziroom ZHOME A0101 Command Injection via USB Device Management API]]> https://labs.cosmicbytez.ca/security/ziroom-zhome-usb-api-command-injection-cve-2026-101187 https://labs.cosmicbytez.ca/security/ziroom-zhome-usb-api-command-injection-cve-2026-101187 Tue, 29 Sep 2026 00:00:00 GMT security Ziroom CVE-2026-101187 Command Injection IoT Security Critical Vulnerability <![CDATA[Weekly Digest — Issue #37]]> https://labs.cosmicbytez.ca/newsletter/2026-09-29-weekly-digest-issue-37 https://labs.cosmicbytez.ca/newsletter/2026-09-29-weekly-digest-issue-37 Tue, 29 Sep 2026 00:00:00 GMT newsletter Newsletter Weekly Digest NetScaler Citrix Apple Agentic AI OpenAI Cybersecurity <![CDATA[Bitget Resumes Bitcoin Withdrawals After $387.5 Million North Korea-Linked Heist]]> https://labs.cosmicbytez.ca/news/2026-09-28-bitget-resumes-bitcoin-withdrawals-after-387-million-heist https://labs.cosmicbytez.ca/news/2026-09-28-bitget-resumes-bitcoin-withdrawals-after-387-million-heist Mon, 28 Sep 2026 00:00:00 GMT news Cryptocurrency Bitget North Korea Crypto Heist Threat Intelligence <![CDATA[Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M]]> https://labs.cosmicbytez.ca/news/2026-09-28-bitget-says-attacker-exploited-third-party-security-product-flaw-to-steal-388m https://labs.cosmicbytez.ca/news/2026-09-28-bitget-says-attacker-exploited-third-party-security-product-flaw-to-steal-388m Mon, 28 Sep 2026 00:00:00 GMT news Cryptocurrency Supply Chain Zero-Day Bitget North Korea Incident Response <![CDATA[Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent]]> https://labs.cosmicbytez.ca/news/2026-09-28-carbonato-botnet-compromises-docker-hosts-to-deploy-telegram-controlled-hermes-a https://labs.cosmicbytez.ca/news/2026-09-28-carbonato-botnet-compromises-docker-hosts-to-deploy-telegram-controlled-hermes-a Mon, 28 Sep 2026 00:00:00 GMT news Botnet Docker Malware AI Agents Container Security Telegram C2 <![CDATA[Citrix Patches Actively Exploited NetScaler Zero-Days After a Weekend of Unofficial Warnings]]> https://labs.cosmicbytez.ca/news/2026-09-28-citrix-patches-actively-exploited-netscaler-zero-days-after-a-weekend-of-unoffic https://labs.cosmicbytez.ca/news/2026-09-28-citrix-patches-actively-exploited-netscaler-zero-days-after-a-weekend-of-unoffic Mon, 28 Sep 2026 00:00:00 GMT news Citrix NetScaler Zero-Day Vulnerability Disclosure CISA KEV Incident Response <![CDATA[Data Broker Radaris Loses Domains in Privacy Fight]]> https://labs.cosmicbytez.ca/news/2026-09-28-data-broker-radaris-loses-domains-in-privacy-fight https://labs.cosmicbytez.ca/news/2026-09-28-data-broker-radaris-loses-domains-in-privacy-fight Mon, 28 Sep 2026 00:00:00 GMT news Data Broker Radaris Daniel's Law Privacy Atlas Data Privacy Corp People-Search Sites <![CDATA[Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks]]> https://labs.cosmicbytez.ca/news/2026-09-28-hackers-use-needymantis-to-maintain-long-term-access-in-breached-networks https://labs.cosmicbytez.ca/news/2026-09-28-hackers-use-needymantis-to-maintain-long-term-access-in-breached-networks Mon, 28 Sep 2026 00:00:00 GMT news Malware Persistence Microsoft Threat Intelligence Storm-3069 DLL Sideloading The Hacker News