1. CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog including a critical path traversal flaw in Adobe ColdFusion. (thehackernews.com) 2. Federal agencies were ordered by CISA to prioritize patching an actively exploited authentication bypass vulnerability in the Langflow AI framework. (bleepingcomputer.com) 3. Researchers disclosed GhostLock CVE-2026-43499 a 15-year-old Linux kernel flaw that allows unprivileged users to gain root access and escape…
Posts published in “CyberSec report”
1. CISA issued a warning regarding the active exploitation of a Linux kernel zero day vulnerability identified as CVE 2026 43456 (reddit.com). 2. Researchers discovered the TrojPix attack which exfiltrates data from air gapped systems by manipulating screen pixels to radiate radio signals via video cables (thehackernews.com). 3. A new Java based remote access trojan named QuimaRAT is being distributed under a malware as a…
1. CISA confirmed that a remote code execution vulnerability in Microsoft SharePoint is currently being actively exploited (Reddit). 2. Google and the FBI disrupted the NetNut residential proxy network, cutting off access for approximately 2 million compromised devices (BleepingComputer). 3. A new Linux kernel vulnerability named Bad Epoll tracked as CVE-2026-46242 allows unprivileged users to gain root access on servers and Android devices (The Hacker…
1. CISA added the critical SharePoint remote code execution vulnerability CVE-2026-45659 to its Known Exploited Vulnerabilities catalog following reports of active exploitation (The Hacker News). 2. Security researchers identified the first end-to-end ransomware attack executed by an AI agent, which exploited a Langflow remote code execution flaw to encrypt a production database (The Hacker News). 3. The FortiBleed campaign, which compromised 75000 Fortinet firewalls, has…
1. A critical vulnerability in Progress Kemp LoadMaster tracked as CVE-2026-8037 allows unauthenticated attackers to execute arbitrary commands as root (thehackernews.com). 2. The Oracle E-Business Suite vulnerability CVE-2026-46817 is currently being exploited in the wild to take over susceptible instances (thehackernews.com). 3. Ransomware gangs are actively exploiting the Windows BlueHammer privilege escalation flaw in Microsoft Defender (bleepingcomputer.com). 4. The Blackfield ransomware group has demanded a…
1. Russian intelligence services are conducting a long-running campaign using fake support messages to steal credentials from government and military officials in Ukraine, the U.S., and Europe (The Hacker News). 2. The FBI and CISA warned that Russian hackers are now targeting Signal Backup Recovery Keys to gain access to historical message data (Bleeping Computer). 3. A critical remote code execution vulnerability in PTC Windchill…
1. Attackers are actively exploiting a critical vulnerability in Cisco Unified CM and Unified CM SME deployments that enables server side request forgery and privilege escalation to root (Dark Reading). 2. A critical code injection vulnerability in Lantronix EDS5000 series devices tracked as CVE 2025 67038 is being actively exploited in the wild (The Hacker News). 3. Threat actors exploited the Cisco Catalyst SD WAN…
1. Threat actors are actively exploiting a critical vulnerability in Cisco Unified Communications Manager tracked as CVE-2026-20230 to achieve remote file writes (thehackernews.com). 2. The FortiBleed campaign has targeted over 430,000 FortiGate firewalls globally to harvest approximately 110 million credentials (thehackernews.com). 3. Two members of the Scattered Spider cybercrime group pleaded guilty to charges related to the 2024 cyberattack on Transport for London (bleepingcomputer.com). 4.…
1. The Canadian Security Intelligence Service utilized a first of its kind threat reduction warrant to neutralize two foreign run botnets by accessing infected servers and routers on Canadian soil (The Hacker News). 2. A new malware family identified as AryStinger has compromised at least 4300 legacy routers to establish a distributed reconnaissance and proxy network (The Hacker News). 3. Researchers report that AryStinger is…
1. CISA added a critical Splunk Enterprise remote code execution vulnerability CVE-2026-20253 to its known exploited vulnerabilities catalog after reports of active exploitation (https://www.reddit.com/r/cybersecurity/comments/1ua3npz/cisa_adds_splunk_enterprise_rce_cve202620253_to/). 2. International law enforcement agencies disrupted the SocGholish botnet infrastructure and cleaned nearly 15000 infected WordPress sites in an operation linked to the Evil Corp cybercrime group (https://thehackernews.com/2026/06/operation-endgame-disrupts-socgholish.html). 3. CISA issued a warning regarding the FortiBleed campaign which has compromised over…
1. CISA has issued an urgent directive for federal agencies to patch a maximum severity vulnerability in the Widget Factory Joomla Content Editor plugin, which is currently being exploited in the wild (The Hacker News). 2. Microsoft is developing a patch for a zero day privilege escalation vulnerability in the Defender Malware Protection Engine codenamed RoguePlanet (The Hacker News). 3. Threat actors are actively exploiting…
1. Cisco released security updates for a vulnerability in Catalyst SD-WAN Manager tracked as CVE-2026-20262 which is currently being exploited in the wild (thehackernews.com). 2. CISA added the LiteSpeed cPanel Plugin vulnerability CVE-2026-54420 to its Known Exploited Vulnerabilities catalog due to active exploitation for root privilege escalation (thehackernews.com). 3. Threat actors are actively exploiting multiple critical vulnerabilities in the Fortinet FortiSandbox platform to compromise systems…
1. Splunk Enterprise is affected by a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-20253 (The Hacker News). 2. The ShinyHunters threat group is actively exploiting a zero day vulnerability in Oracle PeopleSoft to compromise hundreds of organizations (Reddit). 3. CISA has issued an emergency directive requiring federal agencies to patch a maximum severity Ivanti vulnerability within three days (Reddit). 4. The Lapsus ransomware…
1. CISA issued a binding operational directive requiring federal agencies to patch an actively exploited vulnerability in Ivanti Sentry within three days (bleepingcomputer.com). 2. The ShinyHunters extortion group is actively exploiting a critical remote code execution vulnerability in Oracle PeopleSoft tracked as CVE-2026-35273 (thehackernews.com). 3. Researchers identified a critical vulnerability chain in the LangGraph AI framework that allows for remote code execution via SQL injection…
1. Microsoft released a record number of security patches for June 2026 including fixes for YellowKey and GreenPlasma zero day vulnerabilities (https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-yellowkey-greenplasma-miniplasma-zero-days/) 2. A new Microsoft Defender zero day exploit named RoguePlanet was released by a researcher granting SYSTEM privileges on updated Windows systems (https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/) 3. ServiceNow confirmed that threat actors exploited a flaw to gain unauthorized access to customer instances (https://thehackernews.com/2026/06/servicenow-flaw-exploited-to-gain.html) 4. Ivanti patched…
1. Miasma malware has impacted 73 Microsoft GitHub repositories leading to security concerns regarding repository integrity (Reddit). 2. Threat actor UNC3753 is conducting a financially motivated data theft and extortion campaign against U.S. professional and financial services (The Hacker News). 3. Over 20000 Instagram accounts were hijacked after attackers abused Meta AI support systems to reset user passwords (Bleeping Computer). 4. Hackers are actively exploiting…
1. CISA added the high severity SolarWinds Serv-U denial of service vulnerability CVE-2026-28318 to its Known Exploited Vulnerabilities catalog following reports of active exploitation (The Hacker News). 2. Cisco warned that the high severity vulnerability CVE-2026-20245 in Catalyst SD-WAN Manager is currently being exploited in the wild with no patch yet available (The Hacker News). 3. The Miasma self-replicating supply chain attack has compromised 73…
1. CISA added the critical Magento RCE vulnerability CVE-2026-45247 to its Known Exploited Vulnerabilities catalog following reports of active exploitation (The Hacker News). 2. A large scale malvertising campaign is using fake websites mimicking open source tools to distribute malware families like Remus Stealer and SessionGate (The Hacker News). 3. Attackers successfully compromised a senior executive at a global stock exchange, maintaining access to their…
1. A supply chain attack compromised Red Hat npm packages to distribute the Miasma credential stealing worm (thehackernews.com). 2. A critical Windows Netlogon remote code execution vulnerability is being actively exploited in the wild (bleepingcomputer.com). 3. Nearly 2000 WordPress sites were infected with malware using Steam profiles as command and control infrastructure (bleepingcomputer.com). 4. The Pakistan linked SideCopy group is targeting the Afghanistan Ministry of…
1. Palo Alto Networks confirmed that CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect, is under active exploitation in the wild. (The Hacker News) 2. Attackers are actively exploiting the GlobalProtect authentication bypass flaw to establish unauthorized VPN connections to corporate networks. (BleepingComputer) 3. A new local privilege escalation vulnerability named CIFSwitch has been identified in the Linux kernel, allowing attackers to gain root access…
1. Palo Alto Networks confirmed that CVE-2026-0257, an authentication bypass vulnerability in PAN-OS and Prisma Access, is currently under active exploitation (thehackernews.com). 2. Dutch authorities successfully dismantled a massive botnet consisting of 17 million infected devices and seized over 200 associated servers (bleepingcomputer.com). 3. A Russian-linked threat actor named GREYVIBE has been identified conducting persistent AI-powered cyberattacks against Ukrainian entities since August 2025 (thehackernews.com). 4.…
1. A new phishing campaign targeting Japanese online banking users is utilizing a domain and branding typo related to PayPoy (https://www.reddit.com/r/cybersecurity/comments/1tpvisr/new_phishing_campaign_targeting_japanese_online/). 2. Threat actor JINX-0164 is targeting cryptocurrency firms using fake recruiter lures and custom macOS malware to facilitate asset theft (https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html). 3. A malicious npm package named mouse5212-super-formatter was discovered stealing files from the local directory used by the Claude AI tool (https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html). 4.…
1. The ShinyHunters extortion group breached 7-Eleven systems and leaked a 9.4GB database containing personal information of over 183,000 individuals (BleepingComputer). 2. Threat actors are actively exploiting a critical SQL injection vulnerability in Ghost CMS, tracked as CVE-2026-26980, to compromise over 700 websites (The Hacker News). 3. CISA has issued an emergency directive for U.S. federal agencies to patch an actively exploited SQL injection vulnerability…
1. A critical SQL injection vulnerability in Drupal Core tracked as CVE-2026-9082 is being actively exploited with over 15000 attempts recorded across 6000 sites (The Hacker News). 2. The LiteSpeed User-End cPanel Plugin is under active exploitation via CVE-2026-48172 which allows attackers to execute arbitrary scripts with root privileges (The Hacker News). 3. The Megalodon campaign compromised over 5500 GitHub repositories within six hours by…
1. Microsoft confirmed active exploitation of two Microsoft Defender vulnerabilities including CVE-2026-41091 which grants SYSTEM privileges (The Hacker News). 2. CISA added critical vulnerabilities in Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities catalog following evidence of active use (The Hacker News). 3. Cisco patched a maximum severity vulnerability CVE-2026-20223 in Secure Workload that allows unauthenticated remote attackers to access sensitive data…
1. GitHub is investigating a breach of approximately 3800 internal repositories after an employee installed a malicious VS Code extension (The Hacker News). 2. Microsoft released a mitigation for the YellowKey BitLocker bypass vulnerability tracked as CVE-2026-45585 (The Hacker News). 3. Grafana Labs confirmed a breach of its internal GitHub environment involving source code, though customer production systems remain unaffected (The Hacker News). 4. The…
1. A critical heap buffer overflow vulnerability in NGINX tracked as CVE-2026-42945 is being actively exploited in the wild to cause worker crashes and potential remote code execution (The Hacker News). 2. Security researcher Chaotic Eclipse released a proof of concept for a Windows zero day exploit named MiniPlasma that grants attackers SYSTEM privileges on fully patched systems (Bleeping Computer). 3. The Tycoon2FA phishing kit…
1. Microsoft Exchange and Windows 11 were successfully compromised by researchers using zero day vulnerabilities during the Pwn2Own Berlin 2026 event (bleepingcomputer.com). 2. The Funnel Builder WordPress plugin is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages to steal credit card data (bleepingcomputer.com). 3. A critical supply chain attack targeting the TanStack library impacted two OpenAI employee devices, prompting immediate security containment…
1. A new Linux kernel local privilege escalation vulnerability named Fragnesia tracked as CVE-2026-46300 allows attackers to gain root access (The Hacker News). 2. A critical heap buffer overflow vulnerability in the NGINX rewrite module tracked as CVE-2026-42945 enables unauthenticated remote code execution (The Hacker News). 3. West Pharmaceutical Services confirmed a cyberattack involving data exfiltration and system encryption (BleepingComputer). 4. The Gentlemen ransomware group…
1. A mass npm supply chain attack involving the Mini Shai-Hulud worm has compromised over 170 packages including TanStack and Mistral AI. (https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html) 2. Instructure reached an agreement with the ShinyHunters extortion group to prevent the leak of 3.65TB of stolen data. (https://thehackernews.com/2026/05/instructure-reaches-ransom-agreement.html) 3. A rogue version of the official Checkmarx Jenkins plugin was published on the Jenkins Marketplace containing an infostealer. (https://www.bleepingcomputer.com/news/security/official-checkmarx-jenkins-package-compromised-with-infostealer/) 4. A…