TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
2026-08-30T19:23:59Z•18bef5f9faa249c38da167dfaf92aed97d4eaf6e8c24d8c342bf9f665b192a10
CVE-2023-49105CVE-2026-65643CVE-2026-74232CVE-2026-74233CVE-2026-75604CVE-2026-76581CVE-2026-76639CVE-2026-76640AI securityAPT28ClickFixCosmos EVMIoTNext.jsPaperCutPowerShellServiceNowWordPressactive exploitationauthentication bypassbackdoorcPanelcrypto theftmalwareownCloudprivilege escalationprompt injectionremote code executionreverse tunnelrouterssocial engineeringsupply chainzero-day
What happened
Security news digest covering active exploitation, critical vulnerabilities, malware campaigns, supply-chain attacks, cloud and AI security risks, and infrastructure compromises. Notable items include TerminalFix social engineering, critical WordPress, ServiceNow, Next.js, cPanel, PaperCut, ownCloud, router, robot, and Cosmos EVM flaws; ransomware/extortion against Berlin; APT28-linked HOOKEDGE; crypto-stealing browser extensions; and GPU Rowhammer privilege escalation.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 18bef5f9faa249c38da167dfaf92aed97d4eaf6e8c24d8c342bf9f665b192a10
- Enrichment time
- 2026-08-30T19:23:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.