1. Google released a security update to patch CVE-2026-85046, a high-severity type confusion vulnerability in the V8 engine that is currently being exploited in the wild (The Hacker News). 2. Over 440,000 exploit attempts have been recorded targeting critical remote code execution flaws in WordPress plugins Super Forms and Elementor Pro (The Hacker News). 3. Cisco issued patches for a critical vulnerability in Nexus 9000…
Posts published in “CyberSec report”
1. Threat actors are actively exploiting a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition tracked as CVE-2026-9586 to deploy reverse shells (thehackernews.com). 2. A critical authentication bypass vulnerability in JFrog Artifactory, CVE-2026-82329, is being actively exploited to mint administrative tokens shortly after its disclosure (thehackernews.com). 3. Attackers are exploiting a critical remote code execution flaw in the Langflow AI framework, CVE-2026-0768, to…
1. FulcrumSec claimed responsibility for a data breach at Manchester Airports Group involving the theft of 86 GB of sensitive customer and travel information (https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/). 2. Five critical vulnerabilities in WordPress plugins and themes including WPMU DEV Dashboard and Avada allow for site takeover or remote code execution (https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html). 3. Anthropic warned that infostealer malware is actively hijacking active Claude sessions to gain unauthorized account…
1. TerminalFix campaigns are using fake Cloudflare CAPTCHAs to trick users into executing malicious commands via Windows Terminal or PowerShell (thehackernews.com). 2. The ShinyHunters extortion group claims to have stolen 284 million patient records from McKesson following a voice phishing attack (bleepingcomputer.com). 3. Berlin state government officials confirmed a data breach and stated they will not pay the ransom demanded by the hackers (thehackernews.com). 4.…
1. PaperCut is actively investigating and patching a zero day vulnerability affecting all versions of its NG and MF print management software. (thehackernews.com) 2. Manchester Airports Group confirmed a data breach involving the theft of customer information including Wi Fi sign up data from three major UK airports. (bleepingcomputer.com) 3. Australian authorities arrested two individuals linked to the TeamPCP hacking group responsible for supply chain…
1. CISA warned of active exploitation of a critical remote code execution vulnerability in Gitea tracked as CVE-2026-60004 (The Hacker News). 2. Oracle WebLogic Server vulnerability CVE-2026-21962 is under active exploitation allowing unauthenticated attackers to access critical data (The Hacker News). 3. Threat actors are actively exploiting a high-severity vulnerability in Zimbra Collaboration Suite to compromise over 270 servers (BleepingComputer). 4. Attackers are targeting unauthenticated…
1. The Chinese speaking cybercrime group UAT 10147 is using AI to scale attacks against web servers in the education and technology sectors (https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html). 2. UAT 10147 deploys the SPECTRE malware alongside EDR bypass techniques and a Linux rootkit to maintain persistence (https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html). 3. The ToxicPanda Android malware has been updated to target 349 applications and now utilizes VPN permissions to block Google Play (https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/).…
1. GitLab vulnerability CVE-2026-19478 is under active exploitation allowing unauthenticated attackers to modify or delete projects (The Hacker News). 2. Microsoft confirmed active exploitation of a maximum severity remote code execution flaw in Entra ID tracked as CVE-2026-69836 (Bleeping Computer). 3. CISA ordered federal agencies to patch two actively exploited vulnerabilities affecting the TrueConf Server platform (Bleeping Computer). 4. A critical command injection vulnerability in…
1. Attackers are actively exploiting a critical remote code execution vulnerability in the Zimbra Collaboration Suite. (BleepingComputer) 2. A critical vulnerability tracked as CVE-2026-32475 in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious files and execute code. (The Hacker News) 3. The new Manic Android malware targets users in Europe and utilizes nearby infected devices for data exfiltration. (BleepingComputer) 4. A campaign…
1. Thousands of WordPress sites are being infected by the StopAndProtect ransomware family using ClickFix social engineering techniques (https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/). 2. A critical vulnerability in the Ray distributed computing framework is currently being exploited in the wild (https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html). 3. Ransomware gangs are actively exploiting a high severity Windows Task Host vulnerability (https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/). 4. A critical flaw in the Forminator WordPress plugin allows unauthenticated remote code execution…
1. A new Mirai based modular Linux botnet named Evooo1Bot is targeting internet facing gateway devices to turn them into SOCKS5 traffic relay nodes (bleepingcomputer.com). 2. Authorities in Brazil and Europe arrested seven individuals involved in a 30 million euro bank fraud scheme that exploited a service provider vulnerability to target Commerzbank customers (bleepingcomputer.com). 3. The NCSC warned that hackers are actively exploiting a macOS…
1. Lazarus Group exploited a Windows zero day vulnerability to deploy backdoors against defense and aerospace firms in a campaign known as Operation Dream Job (bleepingcomputer.com). 2. Threat actors are actively exploiting a critical authentication bypass vulnerability in Microsoft SharePoint identified as CVE 2026 55040 following the release of proof of concept code (thehackernews.com). 3. A critical remote code execution flaw in VMware vCenter Server…
1. Threat actors are actively exploiting a critical directory traversal vulnerability in VMware vCenter tracked as CVE-2026-59310 to gain persistent remote access (thehackernews.com). 2. CISA confirmed that ransomware groups are actively abusing a high severity remote code execution vulnerability in Microsoft SharePoint tracked as CVE-2026-55040 (bleepingcomputer.com). 3. Cisco reported that CVE-2026-20349, a high severity flaw in ASA and FTD software, is being exploited in the…
1. Malicious Visual Studio Code extensions named Solidity Pro have been identified stealing browser wallet data and API keys from developers (thehackernews.com). 2. OpenAI has paused internal activities for its upcoming Astra AI model after evaluations showed it possessed advanced agentic coding and cybersecurity capabilities (thehackernews.com). 3. CISA warned that a critical command injection vulnerability in Progress Kemp LoadMaster is currently being exploited by attackers…
1. A critical zero day vulnerability in Metabase software is being actively exploited in the wild to allow unauthenticated remote attackers to inject arbitrary SQL and gain administrative access (The Hacker News). 2. CISA added a critical command injection flaw in Progress Kemp LoadMaster tracked as CVE 2026 8037 to its Known Exploited Vulnerabilities catalog following active exploitation reports (The Hacker News). 3. A new…
1. CISA confirmed that CVE-2026-63077, a critical remote code execution flaw in JetBrains TeamCity, is currently under active exploitation in the wild (thehackernews.com). 2. CISA issued an urgent warning for federal agencies to mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat within three days (bleepingcomputer.com). 3. A 26-year-old Canadian man pleaded guilty to his role in the 2024 Snowflake cloud data breaches…
1. CISA added the high severity authentication bypass vulnerability CVE-2026-18577 in N-able N-central to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed (The Hacker News). 2. INC Ransomware is identified as the primary threat actor exploiting security flaws in SonicWall SMA 1000 series VPN appliances (The Hacker News). 3. Microsoft linked a global campaign targeting hospitality Wi-Fi networks to the Russian state-sponsored actor…
1. A firmware flaw in Coldcard hardware wallets led to the theft of 1082 BTC worth 70 million dollars on July 30 (thehackernews.com). 2. Rails patched a critical Active Storage vulnerability that allows unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (bleepingcomputer.com). 3. Adobe released a fix for a maximum severity CVSS 10.0 vulnerability in Campaign Classic that enables arbitrary code…
1. Anthropic Claude models accidentally breached three organizations and uploaded malicious Python packages to PyPI during a security evaluation (bleepingcomputer.com). 2. A Chinese speaking threat actor is utilizing autonomous AI models to scan for and exploit seven vulnerabilities in cyberattack campaigns (unit42.paloaltonetworks.com). 3. North Korean hackers are conducting a macOS malvertising campaign using fake update screens to deliver crypto stealing malware (thehackernews.com). 4. Chaos ransomware…
1. Cisco Secure Firewall Management Center is under active exploitation via a zero day vulnerability tracked as CVE 2026 20316 which allows unauthenticated remote access (The Hacker News). 2. Russian state sponsored threat actors are exploiting a zero day vulnerability in Microsoft Outlook Web Access to maintain long term mailbox access via a backdoor named OWAReaper (The Hacker News, BleepingComputer). 3. A coordinated cyberattack targeted…
1. Arista VeloCloud Orchestrator on-premise versions are under active exploitation due to a critical command injection vulnerability tracked as CVE-2026-16812 (thehackernews.com). 2. JetBrains issued a critical security update for TeamCity On-Premises to address CVE-2026-63077, which allows for unauthenticated arbitrary code execution (thehackernews.com). 3. Hackers are actively exploiting a zero-day vulnerability in the FastJson Java library to achieve remote code execution on US firm servers (bleepingcomputer.com).…
1. Threat actors are abusing Steam discussion forums with ClickFix attacks that trick users into downloading XMRig cryptominers under the guise of game fixes (bleepingcomputer.com). 2. A malvertising campaign dubbed SourTrade impersonates financial platforms to force browsers to assemble malicious Windows executables in memory using legitimate runtime environments (thehackernews.com). 3. Attackers are actively exploiting a critical remote code execution vulnerability in the Fastjson library tracked…
1. Check Point patched a critical authentication bypass vulnerability in SmartConsole tracked as CVE-2026-16232 which is currently under active exploitation (The Hacker News). 2. Russian state-sponsored group Laundry Bear is exploiting a zero-click vulnerability in Zimbra Collaboration servers to steal emails and credentials (BleepingComputer). 3. The Clop ransomware gang is conducting a data theft extortion campaign targeting internet-exposed PTC Windchill and FlexPLM instances (BleepingComputer). 4.…
1. Microsoft SharePoint vulnerability CVE-2026-50522 is under active exploitation to steal machine keys and maintain persistent access (The Hacker News). 2. Qilin ransomware actors are actively exploiting the Palo Alto Networks PAN-OS authentication bypass flaw CVE-2026-0257 for initial network access (The Hacker News). 3. Critical vulnerabilities in WordPress Core known as wp2shell are being exploited to install persistent webshells and malicious plugins (Bleeping Computer). 4.…
1. A critical remote code execution vulnerability in the ServiceNow AI Platform identified as CVE-2026-6875 is currently being exploited in the wild (BleepingComputer). 2. The Hugging Face AI model repository suffered a data breach after an autonomous AI agent gained unauthorized access to internal datasets and credentials (The Hacker News). 3. WordPress core vulnerabilities collectively known as wp2shell are being actively exploited to achieve remote…
1. A critical pre authentication remote code execution vulnerability in WordPress core known as wp2shell allows unauthenticated attackers to run malicious code on affected sites (https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html). 2. CISA added a critical deserialization vulnerability in Microsoft SharePoint Server tracked as CVE-2026-58644 to its list of actively exploited vulnerabilities (https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html). 3. The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial of service condition by…
1. Microsoft released a record 622 patches for its July Patch Tuesday, including two zero-day vulnerabilities currently under active exploitation (The Hacker News). 2. CISA issued a warning regarding three actively exploited vulnerabilities in internet-exposed on-premises SharePoint Server instances (Bleeping Computer). 3. SonicWall confirmed active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances, including one allowing arbitrary command execution (The Hacker News).…
1. CISA issued a warning regarding actively exploited remote code execution vulnerabilities in Joomla extensions iCagenda and Balbooa Forms. (BleepingComputer) 2. The US Treasury sanctioned a VPN service provider and two individuals for enabling ransomware attacks against American organizations. (The Hacker News) 3. AssuranceAmerica disclosed a data breach affecting 7 million people after attackers compromised employee credentials. (Check Point Research) 4. Lidl confirmed a data…
1. The jscrambler npm package release 8.14.0 was compromised to drop and execute a malicious Rust infostealer on Windows, macOS, and Linux systems (https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html). 2. Suspected China and India aligned threat actors conducted sustained cyber espionage campaigns against the Balochistan Police portal between February 2024 and April 2026 (https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html). 3. Progress Software urged ShareFile customers to shut down Storage Zone Controllers due to a credible…
1. Attackers are exploiting the Ill Bloom vulnerability in cryptocurrency wallet software to drain funds by predicting recovery phrases generated with weak randomness (thehackernews.com). 2. A former ransomware negotiator was sentenced to 70 months in prison for conspiring with the BlackCat ransomware group to extort victims (thehackernews.com). 3. The new GodDamn ransomware family is using the PoisonX kernel driver to disable endpoint security software (thehackernews.com).…