1. Attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access, and CISA has added two of them to its Known Exploited Vulnerabilities catalog following active exploitation (thehackernews.com). 2. A malicious ChatGPT share link could run attacker code in a logged-in session and read private chats; OpenAI fixed the flaw eight days after it was reported and rated it P1 (thehackernews.com). 3.…
Posts published in “CyberSec report”
1. Binance confirmed a security breach impacting about 6.3 billion dollars in assets, with nearly 3 billion frozen on-chain, linked to a compromised DevOps laptop and possibly North Korea. (The Hacker News, BleepingComputer, The Record) 2. The official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor, traced to a compromise of the Cursor Marketplace. (The Hacker…
1. CISA added CVE-2026-111497 for Adobe Commerce and Magento and a critical Brotli decoder flaw known as Node2Shell to its Known Exploited Vulnerabilities catalog, citing active exploitation that has breached hundreds of stores. (thehackernews.com) 2. The critical Oracle PeopleSoft bug exploited by ShinyHunters since May is actually three chained flaws, including an SSRF, all patched under CVE-2026-35273. (thehackernews.com) 3. Japan’s GMO Internet Group is offering…
1. The Gheist campaign weaponizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets from private repositories via Actions logs, affecting thousands of developer repos and GitHub Enterprise environments (Dark Reading, The Hacker News). 2. Microsoft 365 token-replay attacks using adversary-in-the-middle relays compromised 97 accounts across 79 organizations between July and September 2026, with 497 successful sign-in events detected (The Hacker News). 3. Two…
1. CISA added two actively exploited critical flaws to its KEV catalog, CVE-2026-110447 in Collabora Online CODE Server and a VeloCloud Orchestrator issue, urging immediate patching (thehackernews.com). 2. A Brotli decoder memory-corruption flaw, CVE-2026-111497, enables remote code execution in Node.js, Bun, Python Brotli packages, and Envoy, with a proof-of-concept named Node2Shell demonstrated (thehackernews.com). 3. Attackers attempted to exploit PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to deploy…
1. PHP released emergency patches for two critical PHP2Shell remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, with exploit attempts detected before public disclosure. (The Hacker News) 2. Exploit attempts for PHP2Shell were detected on October 17, four days before patches were released, with scanners carrying Mirai-style loaders. (The Hacker News) 3. GitLab fixed a critical flaw with a CVSS score of 10.0 allowing unauthenticated remote…
1. Hackers abused the AI penetration testing tool Cairn to automate attacks compromising hundreds of websites, including those of John Deere, SharkNinja, and Cummins (Dark Reading). 2. Threat actors hijacked five OVHcloud CLI releases on GitHub for up to 94 minutes, replacing archives with secret-stealing malware via a compromised contributor account (The Hacker News). 3. ClickFix attackers exploited a high-severity DLL sideloading vulnerability CVE-2026-110936 in…
1. ConnectWise suspended its Cloud Backup service after attackers compromised application identities and breached Microsoft 365 tenants, with one credential used to sign in to 173 tenants (The Hacker News, BleepingComputer). 2. A suspected Chinese state-backed group is exploiting a BeyondTrust Remote Support zero-day in espionage attacks, with patches now available after exploitation since August (The Record, Dark Reading). 3. Drupal patched two critical remote…
1. China-linked group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since late August to take over servers (The Hacker News). 2. BeyondTrust patched the critical flaw, warning customers of active exploitation in attacks since late August (BleepingComputer). 3. Suspected advanced threat actor exploited FortiOS flaw CVE-2025-61624 to deploy new PEERSTITCH malware bypassing VPN session checks (The Hacker News). 4. Critical Linux kernel vulnerability PwnEscape…
1. Microsoft patched a record 1413 vulnerabilities in October 2026 Patch Tuesday, including one actively exploited Windows Shell bug and two publicly disclosed zero-days (BleepingComputer, The Hacker News, KrebsOnSecurity). 2. An attacker chained three Ivanti Connect Secure zero-days to gain root access without logging in; Ivanti patched two flaws, with a fix for the third pending (The Hacker News). 3. A critical Linux kernel flaw…
1. Attackers are actively exploiting CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, allowing unauthenticated remote code execution via arbitrary PHP file uploads (thehackernews.com). 2. A campaign named CyberXero, using Anthropic Claude Code and Cobalt Strike, stole over 628,000 Ukrainian records from WordPress sites and critical infrastructure entities (thehackernews.com). 3. Nippon Columbia malware incident exposed over 8.6 million karaoke fan records, affecting customers…
1. FBI arrested the co-founder of a Canadian cybersecurity firm linked to the ShinyHunters hacking group, which breached the FBI jobs portal and stole data on thousands of agents (KrebsOnSecurity). 2. FBI Director Kash Patel announced the arrest of another suspected ShinyHunters co-conspirator involved in the FBI jobs portal breach, with no charges made public yet (The Hacker News). 3. Germany arrested a Russian national,…
1. US authorities arrested a Venezuelan national linked to Tren de Aragua for ATM jackpotting, the first cybercriminal on the FBI Ten Most Wanted list (Dark Reading). 2. Russian espionage actor UAC-0099 updated its MatchBoil malware dropper in campaigns against Ukrainian organizations (Dark Reading). 3. The US State Department offered up to 10 million dollars for information on Zhang Yu, charged in the 2021 HAFNIUM…
1. Critical Atlassian flaw CVE-2026-21589 rated 9.3 allows unauthenticated file reads across eight Data Center products, disclosed October 5 (The Hacker News). 2. Microsoft released out-of-band updates for Exchange Server flaw CVE-2026-96940 rated 8.8, enabling authenticated privilege escalation and mailbox access (The Hacker News). 3. Rejetto HFS servers are actively scanned for critical RCE flaw CVE-2026-61500 allowing session forgery and account takeover (BleepingComputer). 4. Blinder…
1. CVE-2026-4123 in Fortinet FortiOS is being actively exploited in the wild to bypass authentication on SSL VPN interfaces, with proof-of-concept code public since October 4. (Fortinet PSIRT) 2. APT group tracked as Midnight Blizzard launched a phishing campaign targeting NATO and EU diplomatic missions using malicious LNK files disguised as travel advisories. (Microsoft Threat Intelligence) 3. LockBit 3.0 affiliate group claimed the ransomware attack…
1. Citrix released emergency patches for CVE-2026-88779, a high-severity NetScaler ADC and Gateway memory overflow vulnerability exploited in targeted zero-day attacks that can knock SAML deployments offline, with researchers investigating potential remote code execution. (BleepingComputer, The Hacker News) 2. Attackers are actively exploiting CVE-2026-61500, a critical Rejetto HTTP File Server flaw with a CVSS score of 9.3, which allows admin session forgery via a weak…
1. A critical zero day vulnerability in Fortinet FortiMail tracked as CVE 2026 104286 is being actively exploited to allow unauthenticated arbitrary file writes (The Hacker News). 2. CISA has officially added the critical FortiMail CVE 2026 104286 to its Known Exploited Vulnerabilities catalog following reports of active attacks (The Hacker News). 3. The official Microsoft account on X was hijacked by attackers to promote…
1. Threat actors are actively exploiting a critical memory overflow vulnerability CVE-2026-88772 in Citrix NetScaler ADC and Gateway appliances to deploy web shells and gain root access (thehackernews.com). 2. The Russian APT group Star Blizzard is using a new RedFlick phishing tactic against Ukrainian-linked targets to deploy the CosmicPulse backdoor (darkreading.com). 3. OpenSSL released patches for a high-severity DTLS flaw that allows attackers to leak…
1. Two critical remote code execution vulnerabilities in Citrix NetScaler identified as CVE-2026-88771 and CVE-2026-88772 are currently under active exploitation in the wild (BleepingComputer). 2. CISA has issued an emergency directive requiring U.S. federal agencies to apply security patches for the exploited Citrix NetScaler vulnerabilities by Wednesday (BleepingComputer). 3. The JadePuffer AI threat actor successfully compromised an Azure tenant, resulting in the destructive deletion of…
1. ShinyHunters is conducting a renewed mass exploitation campaign targeting Oracle PeopleSoft via CVE-2026-35273 across multiple global sectors (https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/). 2. Suspected North Korean threat actors compromised Bitget cryptocurrency exchange, resulting in the theft of 351.6 million dollars from hot and warm wallets (https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html). 3. Roundcube Webmail is under active exploitation due to a pre-authentication SQL injection vulnerability tracked as CVE-2026-48842 (https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html). 4. Kiteworks has urged…
1. Threat actors are actively exploiting a critical remote code execution vulnerability in WordPress tracked as CVE-2026-87902 (The Hacker News). 2. Check Point confirmed active exploitation of a pre-authentication remote code execution flaw in its Security Gateway VPN products tracked as CVE-2026-85102 (BleepingComputer). 3. A vulnerability chain dubbed MikroTrick allows attackers to gain full administrative control over internet-exposed MikroTik routers without requiring passwords or SSH…
1. CrowdSec suffered a data breach involving 170 private repositories after attackers used an OAuth token stolen from a former employee via a supply chain attack (darkreading.com). 2. Japan Digital Agency confirmed a data breach affecting 246000 records after attackers exploited a vulnerability in a VPN appliance (research.checkpoint.com). 3. CISA added the Zyxel GS1900 series switch vulnerability CVE-2026-7273 to its Known Exploited Vulnerabilities catalog due…
1. Researchers used Claude Opus 5 to chain vulnerabilities and gain unauthorized access to OpenAI staff accounts and internal code repositories (thehackernews.com). 2. SolarWinds released patches for a high severity hard coded key vulnerability in Access Rights Manager tracked as CVE 2026 28326 (thehackernews.com). 3. A critical pre authentication remote code execution vulnerability in Orkes Conductor tracked as CVE 2026 58138 is being actively exploited…
1. Cisco issued a warning regarding an actively exploited zero day vulnerability in Identity Services Engine tracked as CVE 2026 76460 with a CVSS score of 10.0. (The Hacker News) 2. A critical vulnerability in Check Point Security Management and Log Servers allows unauthenticated attackers to execute code as root. (The Hacker News) 3. Docker warned of a critical vulnerability CVE 2026 77179 that allows…
1. Google released security patches for Pixel devices to address an actively exploited zero day vulnerability. (https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/) 2. A critical security flaw in WSO2 API Manager tracked as CVE 2026 5430 is under active exploitation by attackers using forged admin tokens. (https://thehackernews.com/2026/09/active-exploitation-attempts-target.html) 3. Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP web shells. (https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html) 4.…
1. A malicious Twitch browser extension named Twitch Enhanced Viewer JeetBot has leaked OAuth tokens for nearly 31000 users to Russian proxy servers (https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html). 2. Fintech company Revolut disclosed a data breach involving the exposure of customer financial information and passports after an employee was tricked by a threat actor impersonating a government agency (https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/). 3. CISA warned that hackers are actively exploiting a maximum…
1. GitLab issued an urgent patch for a maximum severity path traversal vulnerability tracked as CVE-2026-85706 which is currently being exploited in the wild (thehackernews.com). 2. Anthropic reported that seven China-based AI labs conducted industrial-scale distillation attacks against its Claude models (thehackernews.com). 3. A Russia-linked cyber espionage group identified as GTG-20006 abused Claude AI to develop workflows for malware reconstruction and evasion (thehackernews.com). 4. Threat…
1. Cisco confirmed that a maximum severity authentication bypass vulnerability CVE 2026 20079 in its Secure Firewall Management Center is being actively exploited in the wild (https://www.reddit.com/r/cybersecurity/comments/1wbzdsv/cisco_confirms_maxseverity_fmc_bug_cve202620079/). 2. CISA reported that ransomware gangs are actively exploiting a critical WatchGuard Firebox firewall vulnerability (https://www.bleepingcomputer.com/news/security/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks/). 3. Google issued a warning regarding a new Chrome zero day vulnerability that is currently being exploited in attacks (https://www.reddit.com/r/cybersecurity/comments/1wbprfh/google_warns_of_new_chrome_zeroday_bug_exploited/). 4. Multiple…
1. Adobe released patches for a critical zero day vulnerability in Magento and Adobe Commerce tracked as CVE 2026 75650 which is being actively exploited to deploy backdoors (thehackernews.com). 2. A Vietnam linked database leak exposed 220 million traveler and crew records including passport numbers and flight details via a cloud path using default credentials (bleepingcomputer.com). 3. The BigBear 2.0 phishing as a service framework…
1. Attackers are actively exploiting MikroTik routers by targeting internet exposed SSH services to gain full administrative control without authentication (The Hacker News). 2. A new unpatched zero day vulnerability in Magento and Adobe Commerce dubbed StyleSmuggler is being exploited to inject malicious code into online stores (The Hacker News). 3. JetBrains confirmed that threat actors exploited a critical vulnerability in TeamCity to breach its…