1. Attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access, and CISA has added two of them to its Known Exploited Vulnerabilities catalog following active exploitation (thehackernews.com). 2. A malicious ChatGPT share link could run attacker code in a logged-in session and read private chats; OpenAI fixed the flaw eight days after it was reported and rated it P1 (thehackernews.com). 3.…
Posts tagged as “exploit”
1. Binance confirmed a security breach impacting about 6.3 billion dollars in assets, with nearly 3 billion frozen on-chain, linked to a compromised DevOps laptop and possibly North Korea. (The Hacker News, BleepingComputer, The Record) 2. The official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor, traced to a compromise of the Cursor Marketplace. (The Hacker…
1. CISA added CVE-2026-111497 for Adobe Commerce and Magento and a critical Brotli decoder flaw known as Node2Shell to its Known Exploited Vulnerabilities catalog, citing active exploitation that has breached hundreds of stores. (thehackernews.com) 2. The critical Oracle PeopleSoft bug exploited by ShinyHunters since May is actually three chained flaws, including an SSRF, all patched under CVE-2026-35273. (thehackernews.com) 3. Japan’s GMO Internet Group is offering…
1. The Gheist campaign weaponizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets from private repositories via Actions logs, affecting thousands of developer repos and GitHub Enterprise environments (Dark Reading, The Hacker News). 2. Microsoft 365 token-replay attacks using adversary-in-the-middle relays compromised 97 accounts across 79 organizations between July and September 2026, with 497 successful sign-in events detected (The Hacker News). 3. Two…
1. Ukraine: Ukrainian forces struck the Proton plant in Oryol, Russia, with four Storm Shadow cruise missiles on Oct. 23, killing at least 13 people, including 11 women. The plant produces components for Iskander-M missiles and Pantsir-S1 air defense systems. Source: NOELREPORTS. 2. Ukraine: Ukrainian drones attacked the Tolyattikauchuk chemical plant in Tolyatti, Samara Oblast, on Oct. 24, causing a large fire. The plant produces…
1. Ukraine: Ukrainian forces struck the Proton plant in Oryol, Russia, with Storm Shadow cruise missiles, killing at least 13 people, including 11 women. The plant produces components for Iskander-M missiles and Pantsir-S1 air defense systems. Source: NOELREPORTS. 2. Ukraine: Russia reported shooting down 616 Ukrainian drones overnight, with attacks targeting energy infrastructure in Krasnodar Krai, causing a blackout across Crimea. The Taman 500 kV…
1. Ukraine: Ukrainian forces struck the Proton plant in Oryol, Russia, with Storm Shadow cruise missiles, killing at least 13 people, including 11 women. The plant produces components for Iskander-M missiles and Pantsir-S1 air defense systems. Source: NOELREPORTS. 2. Ukraine: Russia reported shooting down 616 Ukrainian drones overnight, with attacks targeting energy infrastructure in Krasnodar Krai, causing a blackout across Crimea. The Taman 500 kV…
1. CISA added two actively exploited critical flaws to its KEV catalog, CVE-2026-110447 in Collabora Online CODE Server and a VeloCloud Orchestrator issue, urging immediate patching (thehackernews.com). 2. A Brotli decoder memory-corruption flaw, CVE-2026-111497, enables remote code execution in Node.js, Bun, Python Brotli packages, and Envoy, with a proof-of-concept named Node2Shell demonstrated (thehackernews.com). 3. Attackers attempted to exploit PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to deploy…
1. Ukraine: Ukrainian drones struck the Tolyattikauchuk chemical plant in Tolyatti, Samara Oblast, causing a large fire. The plant produces synthetic rubbers used in rocket fuel. Source: AMK Mapping. 2. Ukraine: A Ukrainian drone strike hit the Omsky Kauchuk chemical plant in Omsk, over 2,500 km from Ukraine, causing a massive fire. The facility produces components for solid rocket fuel. Source: ClashReport. 3. Ukraine: Ukrainian…
1. PHP released emergency patches for two critical PHP2Shell remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, with exploit attempts detected before public disclosure. (The Hacker News) 2. Exploit attempts for PHP2Shell were detected on October 17, four days before patches were released, with scanners carrying Mirai-style loaders. (The Hacker News) 3. GitLab fixed a critical flaw with a CVSS score of 10.0 allowing unauthenticated remote…
Over the past 24 hours, Russian forces launched 86 air strikes, dropping 302 guided aerial bombs, and employed 9757 kamikaze drones, conducting 2735 shelling incidents. Ukrainian air defense intercepted/suppressed 150 out of 186 UAVs, including 63 jet-powered Shahed variants. Engagements occurred across 269 combat clashes. Total Russian losses reported by Ukraine include 1820 personnel, 11 tanks, 16 armored combat vehicles, 44 artillery systems, 1 MLRS,…
1. Hackers abused the AI penetration testing tool Cairn to automate attacks compromising hundreds of websites, including those of John Deere, SharkNinja, and Cummins (Dark Reading). 2. Threat actors hijacked five OVHcloud CLI releases on GitHub for up to 94 minutes, replacing archives with secret-stealing malware via a compromised contributor account (The Hacker News). 3. ClickFix attackers exploited a high-severity DLL sideloading vulnerability CVE-2026-110936 in…
1. China-linked group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since late August to take over servers (The Hacker News). 2. BeyondTrust patched the critical flaw, warning customers of active exploitation in attacks since late August (BleepingComputer). 3. Suspected advanced threat actor exploited FortiOS flaw CVE-2025-61624 to deploy new PEERSTITCH malware bypassing VPN session checks (The Hacker News). 4. Critical Linux kernel vulnerability PwnEscape…
1. Microsoft patched a record 1413 vulnerabilities in October 2026 Patch Tuesday, including one actively exploited Windows Shell bug and two publicly disclosed zero-days (BleepingComputer, The Hacker News, KrebsOnSecurity). 2. An attacker chained three Ivanti Connect Secure zero-days to gain root access without logging in; Ivanti patched two flaws, with a fix for the third pending (The Hacker News). 3. A critical Linux kernel flaw…
1. Attackers are actively exploiting CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, allowing unauthenticated remote code execution via arbitrary PHP file uploads (thehackernews.com). 2. A campaign named CyberXero, using Anthropic Claude Code and Cobalt Strike, stole over 628,000 Ukrainian records from WordPress sites and critical infrastructure entities (thehackernews.com). 3. Nippon Columbia malware incident exposed over 8.6 million karaoke fan records, affecting customers…
1. US authorities arrested a Venezuelan national linked to Tren de Aragua for ATM jackpotting, the first cybercriminal on the FBI Ten Most Wanted list (Dark Reading). 2. Russian espionage actor UAC-0099 updated its MatchBoil malware dropper in campaigns against Ukrainian organizations (Dark Reading). 3. The US State Department offered up to 10 million dollars for information on Zhang Yu, charged in the 2021 HAFNIUM…
1. Citrix released emergency patches for CVE-2026-88779, a high-severity NetScaler ADC and Gateway memory overflow vulnerability exploited in targeted zero-day attacks that can knock SAML deployments offline, with researchers investigating potential remote code execution. (BleepingComputer, The Hacker News) 2. Attackers are actively exploiting CVE-2026-61500, a critical Rejetto HTTP File Server flaw with a CVSS score of 9.3, which allows admin session forgery via a weak…
1. A critical zero day vulnerability in Fortinet FortiMail tracked as CVE 2026 104286 is being actively exploited to allow unauthenticated arbitrary file writes (The Hacker News). 2. CISA has officially added the critical FortiMail CVE 2026 104286 to its Known Exploited Vulnerabilities catalog following reports of active attacks (The Hacker News). 3. The official Microsoft account on X was hijacked by attackers to promote…
1. Two critical remote code execution vulnerabilities in Citrix NetScaler identified as CVE-2026-88771 and CVE-2026-88772 are currently under active exploitation in the wild (BleepingComputer). 2. CISA has issued an emergency directive requiring U.S. federal agencies to apply security patches for the exploited Citrix NetScaler vulnerabilities by Wednesday (BleepingComputer). 3. The JadePuffer AI threat actor successfully compromised an Azure tenant, resulting in the destructive deletion of…
1. Threat actors are actively exploiting a critical remote code execution vulnerability in WordPress tracked as CVE-2026-87902 (The Hacker News). 2. Check Point confirmed active exploitation of a pre-authentication remote code execution flaw in its Security Gateway VPN products tracked as CVE-2026-85102 (BleepingComputer). 3. A vulnerability chain dubbed MikroTrick allows attackers to gain full administrative control over internet-exposed MikroTik routers without requiring passwords or SSH…
1. CrowdSec suffered a data breach involving 170 private repositories after attackers used an OAuth token stolen from a former employee via a supply chain attack (darkreading.com). 2. Japan Digital Agency confirmed a data breach affecting 246000 records after attackers exploited a vulnerability in a VPN appliance (research.checkpoint.com). 3. CISA added the Zyxel GS1900 series switch vulnerability CVE-2026-7273 to its Known Exploited Vulnerabilities catalog due…
1. Researchers used Claude Opus 5 to chain vulnerabilities and gain unauthorized access to OpenAI staff accounts and internal code repositories (thehackernews.com). 2. SolarWinds released patches for a high severity hard coded key vulnerability in Access Rights Manager tracked as CVE 2026 28326 (thehackernews.com). 3. A critical pre authentication remote code execution vulnerability in Orkes Conductor tracked as CVE 2026 58138 is being actively exploited…
1. Cisco issued a warning regarding an actively exploited zero day vulnerability in Identity Services Engine tracked as CVE 2026 76460 with a CVSS score of 10.0. (The Hacker News) 2. A critical vulnerability in Check Point Security Management and Log Servers allows unauthenticated attackers to execute code as root. (The Hacker News) 3. Docker warned of a critical vulnerability CVE 2026 77179 that allows…
1. A malicious Twitch browser extension named Twitch Enhanced Viewer JeetBot has leaked OAuth tokens for nearly 31000 users to Russian proxy servers (https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html). 2. Fintech company Revolut disclosed a data breach involving the exposure of customer financial information and passports after an employee was tricked by a threat actor impersonating a government agency (https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/). 3. CISA warned that hackers are actively exploiting a maximum…
1. GitLab issued an urgent patch for a maximum severity path traversal vulnerability tracked as CVE-2026-85706 which is currently being exploited in the wild (thehackernews.com). 2. Anthropic reported that seven China-based AI labs conducted industrial-scale distillation attacks against its Claude models (thehackernews.com). 3. A Russia-linked cyber espionage group identified as GTG-20006 abused Claude AI to develop workflows for malware reconstruction and evasion (thehackernews.com). 4. Threat…
1. Cisco confirmed that a maximum severity authentication bypass vulnerability CVE 2026 20079 in its Secure Firewall Management Center is being actively exploited in the wild (https://www.reddit.com/r/cybersecurity/comments/1wbzdsv/cisco_confirms_maxseverity_fmc_bug_cve202620079/). 2. CISA reported that ransomware gangs are actively exploiting a critical WatchGuard Firebox firewall vulnerability (https://www.bleepingcomputer.com/news/security/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks/). 3. Google issued a warning regarding a new Chrome zero day vulnerability that is currently being exploited in attacks (https://www.reddit.com/r/cybersecurity/comments/1wbprfh/google_warns_of_new_chrome_zeroday_bug_exploited/). 4. Multiple…
1. Adobe released patches for a critical zero day vulnerability in Magento and Adobe Commerce tracked as CVE 2026 75650 which is being actively exploited to deploy backdoors (thehackernews.com). 2. A Vietnam linked database leak exposed 220 million traveler and crew records including passport numbers and flight details via a cloud path using default credentials (bleepingcomputer.com). 3. The BigBear 2.0 phishing as a service framework…
1. Attackers are actively exploiting MikroTik routers by targeting internet exposed SSH services to gain full administrative control without authentication (The Hacker News). 2. A new unpatched zero day vulnerability in Magento and Adobe Commerce dubbed StyleSmuggler is being exploited to inject malicious code into online stores (The Hacker News). 3. JetBrains confirmed that threat actors exploited a critical vulnerability in TeamCity to breach its…
1. Google released a security update to patch CVE-2026-85046, a high-severity type confusion vulnerability in the V8 engine that is currently being exploited in the wild (The Hacker News). 2. Over 440,000 exploit attempts have been recorded targeting critical remote code execution flaws in WordPress plugins Super Forms and Elementor Pro (The Hacker News). 3. Cisco issued patches for a critical vulnerability in Nexus 9000…
1. TerminalFix campaigns are using fake Cloudflare CAPTCHAs to trick users into executing malicious commands via Windows Terminal or PowerShell (thehackernews.com). 2. The ShinyHunters extortion group claims to have stolen 284 million patient records from McKesson following a voice phishing attack (bleepingcomputer.com). 3. Berlin state government officials confirmed a data breach and stated they will not pay the ransom demanded by the hackers (thehackernews.com). 4.…