1. CISA added CVE-2026-111497 for Adobe Commerce and Magento and a critical Brotli decoder flaw known as Node2Shell to its Known Exploited Vulnerabilities catalog, citing active exploitation that has breached hundreds of stores. (thehackernews.com) 2. The critical Oracle PeopleSoft bug exploited by ShinyHunters since May is actually three chained flaws, including an SSRF, all patched under CVE-2026-35273. (thehackernews.com) 3. Japan’s GMO Internet Group is offering…
Posts tagged as “malware”
1. The Gheist campaign weaponizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets from private repositories via Actions logs, affecting thousands of developer repos and GitHub Enterprise environments (Dark Reading, The Hacker News). 2. Microsoft 365 token-replay attacks using adversary-in-the-middle relays compromised 97 accounts across 79 organizations between July and September 2026, with 497 successful sign-in events detected (The Hacker News). 3. Two…
1. PHP released emergency patches for two critical PHP2Shell remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, with exploit attempts detected before public disclosure. (The Hacker News) 2. Exploit attempts for PHP2Shell were detected on October 17, four days before patches were released, with scanners carrying Mirai-style loaders. (The Hacker News) 3. GitLab fixed a critical flaw with a CVSS score of 10.0 allowing unauthenticated remote…
1. Hackers abused the AI penetration testing tool Cairn to automate attacks compromising hundreds of websites, including those of John Deere, SharkNinja, and Cummins (Dark Reading). 2. Threat actors hijacked five OVHcloud CLI releases on GitHub for up to 94 minutes, replacing archives with secret-stealing malware via a compromised contributor account (The Hacker News). 3. ClickFix attackers exploited a high-severity DLL sideloading vulnerability CVE-2026-110936 in…
1. China-linked group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since late August to take over servers (The Hacker News). 2. BeyondTrust patched the critical flaw, warning customers of active exploitation in attacks since late August (BleepingComputer). 3. Suspected advanced threat actor exploited FortiOS flaw CVE-2025-61624 to deploy new PEERSTITCH malware bypassing VPN session checks (The Hacker News). 4. Critical Linux kernel vulnerability PwnEscape…
1. Attackers are actively exploiting CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, allowing unauthenticated remote code execution via arbitrary PHP file uploads (thehackernews.com). 2. A campaign named CyberXero, using Anthropic Claude Code and Cobalt Strike, stole over 628,000 Ukrainian records from WordPress sites and critical infrastructure entities (thehackernews.com). 3. Nippon Columbia malware incident exposed over 8.6 million karaoke fan records, affecting customers…
1. US authorities arrested a Venezuelan national linked to Tren de Aragua for ATM jackpotting, the first cybercriminal on the FBI Ten Most Wanted list (Dark Reading). 2. Russian espionage actor UAC-0099 updated its MatchBoil malware dropper in campaigns against Ukrainian organizations (Dark Reading). 3. The US State Department offered up to 10 million dollars for information on Zhang Yu, charged in the 2021 HAFNIUM…
1. Threat actors are actively exploiting a critical memory overflow vulnerability CVE-2026-88772 in Citrix NetScaler ADC and Gateway appliances to deploy web shells and gain root access (thehackernews.com). 2. The Russian APT group Star Blizzard is using a new RedFlick phishing tactic against Ukrainian-linked targets to deploy the CosmicPulse backdoor (darkreading.com). 3. OpenSSL released patches for a high-severity DTLS flaw that allows attackers to leak…
1. Two critical remote code execution vulnerabilities in Citrix NetScaler identified as CVE-2026-88771 and CVE-2026-88772 are currently under active exploitation in the wild (BleepingComputer). 2. CISA has issued an emergency directive requiring U.S. federal agencies to apply security patches for the exploited Citrix NetScaler vulnerabilities by Wednesday (BleepingComputer). 3. The JadePuffer AI threat actor successfully compromised an Azure tenant, resulting in the destructive deletion of…
1. ShinyHunters is conducting a renewed mass exploitation campaign targeting Oracle PeopleSoft via CVE-2026-35273 across multiple global sectors (https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/). 2. Suspected North Korean threat actors compromised Bitget cryptocurrency exchange, resulting in the theft of 351.6 million dollars from hot and warm wallets (https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html). 3. Roundcube Webmail is under active exploitation due to a pre-authentication SQL injection vulnerability tracked as CVE-2026-48842 (https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html). 4. Kiteworks has urged…
1. Region: Ukraine. Ukrainian forces conducted long-range drone strikes on the Lukoil-Permnefteorgsintez oil refinery in Perm, located over 1,500 kilometers from the border, and the Iskra electronics plant in Ulyanovsk. Source: Kyiv Independent. 2. Region: Ukraine. Russian forces launched a massive overnight aerial attack on Kyiv, Odesa, and other regions using approximately 600 strike UAVs and dozens of ballistic and cruise missiles. Source: Military Summary.…
1. Threat actors are actively exploiting a critical remote code execution vulnerability in WordPress tracked as CVE-2026-87902 (The Hacker News). 2. Check Point confirmed active exploitation of a pre-authentication remote code execution flaw in its Security Gateway VPN products tracked as CVE-2026-85102 (BleepingComputer). 3. A vulnerability chain dubbed MikroTrick allows attackers to gain full administrative control over internet-exposed MikroTik routers without requiring passwords or SSH…
1. CrowdSec suffered a data breach involving 170 private repositories after attackers used an OAuth token stolen from a former employee via a supply chain attack (darkreading.com). 2. Japan Digital Agency confirmed a data breach affecting 246000 records after attackers exploited a vulnerability in a VPN appliance (research.checkpoint.com). 3. CISA added the Zyxel GS1900 series switch vulnerability CVE-2026-7273 to its Known Exploited Vulnerabilities catalog due…
1. Researchers used Claude Opus 5 to chain vulnerabilities and gain unauthorized access to OpenAI staff accounts and internal code repositories (thehackernews.com). 2. SolarWinds released patches for a high severity hard coded key vulnerability in Access Rights Manager tracked as CVE 2026 28326 (thehackernews.com). 3. A critical pre authentication remote code execution vulnerability in Orkes Conductor tracked as CVE 2026 58138 is being actively exploited…
1. Cisco issued a warning regarding an actively exploited zero day vulnerability in Identity Services Engine tracked as CVE 2026 76460 with a CVSS score of 10.0. (The Hacker News) 2. A critical vulnerability in Check Point Security Management and Log Servers allows unauthenticated attackers to execute code as root. (The Hacker News) 3. Docker warned of a critical vulnerability CVE 2026 77179 that allows…
1. Google released security patches for Pixel devices to address an actively exploited zero day vulnerability. (https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/) 2. A critical security flaw in WSO2 API Manager tracked as CVE 2026 5430 is under active exploitation by attackers using forged admin tokens. (https://thehackernews.com/2026/09/active-exploitation-attempts-target.html) 3. Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP web shells. (https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html) 4.…
1. A malicious Twitch browser extension named Twitch Enhanced Viewer JeetBot has leaked OAuth tokens for nearly 31000 users to Russian proxy servers (https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html). 2. Fintech company Revolut disclosed a data breach involving the exposure of customer financial information and passports after an employee was tricked by a threat actor impersonating a government agency (https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/). 3. CISA warned that hackers are actively exploiting a maximum…
1. GitLab issued an urgent patch for a maximum severity path traversal vulnerability tracked as CVE-2026-85706 which is currently being exploited in the wild (thehackernews.com). 2. Anthropic reported that seven China-based AI labs conducted industrial-scale distillation attacks against its Claude models (thehackernews.com). 3. A Russia-linked cyber espionage group identified as GTG-20006 abused Claude AI to develop workflows for malware reconstruction and evasion (thehackernews.com). 4. Threat…
1. Adobe released patches for a critical zero day vulnerability in Magento and Adobe Commerce tracked as CVE 2026 75650 which is being actively exploited to deploy backdoors (thehackernews.com). 2. A Vietnam linked database leak exposed 220 million traveler and crew records including passport numbers and flight details via a cloud path using default credentials (bleepingcomputer.com). 3. The BigBear 2.0 phishing as a service framework…
1. Attackers are actively exploiting MikroTik routers by targeting internet exposed SSH services to gain full administrative control without authentication (The Hacker News). 2. A new unpatched zero day vulnerability in Magento and Adobe Commerce dubbed StyleSmuggler is being exploited to inject malicious code into online stores (The Hacker News). 3. JetBrains confirmed that threat actors exploited a critical vulnerability in TeamCity to breach its…
1. Google released a security update to patch CVE-2026-85046, a high-severity type confusion vulnerability in the V8 engine that is currently being exploited in the wild (The Hacker News). 2. Over 440,000 exploit attempts have been recorded targeting critical remote code execution flaws in WordPress plugins Super Forms and Elementor Pro (The Hacker News). 3. Cisco issued patches for a critical vulnerability in Nexus 9000…
1. FulcrumSec claimed responsibility for a data breach at Manchester Airports Group involving the theft of 86 GB of sensitive customer and travel information (https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/). 2. Five critical vulnerabilities in WordPress plugins and themes including WPMU DEV Dashboard and Avada allow for site takeover or remote code execution (https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html). 3. Anthropic warned that infostealer malware is actively hijacking active Claude sessions to gain unauthorized account…
1. PaperCut is actively investigating and patching a zero day vulnerability affecting all versions of its NG and MF print management software. (thehackernews.com) 2. Manchester Airports Group confirmed a data breach involving the theft of customer information including Wi Fi sign up data from three major UK airports. (bleepingcomputer.com) 3. Australian authorities arrested two individuals linked to the TeamPCP hacking group responsible for supply chain…
1. The Chinese speaking cybercrime group UAT 10147 is using AI to scale attacks against web servers in the education and technology sectors (https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html). 2. UAT 10147 deploys the SPECTRE malware alongside EDR bypass techniques and a Linux rootkit to maintain persistence (https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html). 3. The ToxicPanda Android malware has been updated to target 349 applications and now utilizes VPN permissions to block Google Play (https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/).…
1. GitLab vulnerability CVE-2026-19478 is under active exploitation allowing unauthenticated attackers to modify or delete projects (The Hacker News). 2. Microsoft confirmed active exploitation of a maximum severity remote code execution flaw in Entra ID tracked as CVE-2026-69836 (Bleeping Computer). 3. CISA ordered federal agencies to patch two actively exploited vulnerabilities affecting the TrueConf Server platform (Bleeping Computer). 4. A critical command injection vulnerability in…
1. Attackers are actively exploiting a critical remote code execution vulnerability in the Zimbra Collaboration Suite. (BleepingComputer) 2. A critical vulnerability tracked as CVE-2026-32475 in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious files and execute code. (The Hacker News) 3. The new Manic Android malware targets users in Europe and utilizes nearby infected devices for data exfiltration. (BleepingComputer) 4. A campaign…
1. Malicious Visual Studio Code extensions named Solidity Pro have been identified stealing browser wallet data and API keys from developers (thehackernews.com). 2. OpenAI has paused internal activities for its upcoming Astra AI model after evaluations showed it possessed advanced agentic coding and cybersecurity capabilities (thehackernews.com). 3. CISA warned that a critical command injection vulnerability in Progress Kemp LoadMaster is currently being exploited by attackers…
1. A critical zero day vulnerability in Metabase software is being actively exploited in the wild to allow unauthenticated remote attackers to inject arbitrary SQL and gain administrative access (The Hacker News). 2. CISA added a critical command injection flaw in Progress Kemp LoadMaster tracked as CVE 2026 8037 to its Known Exploited Vulnerabilities catalog following active exploitation reports (The Hacker News). 3. A new…
1. CISA confirmed that CVE-2026-63077, a critical remote code execution flaw in JetBrains TeamCity, is currently under active exploitation in the wild (thehackernews.com). 2. CISA issued an urgent warning for federal agencies to mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat within three days (bleepingcomputer.com). 3. A 26-year-old Canadian man pleaded guilty to his role in the 2024 Snowflake cloud data breaches…
1. CISA added the high severity authentication bypass vulnerability CVE-2026-18577 in N-able N-central to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed (The Hacker News). 2. INC Ransomware is identified as the primary threat actor exploiting security flaws in SonicWall SMA 1000 series VPN appliances (The Hacker News). 3. Microsoft linked a global campaign targeting hospitality Wi-Fi networks to the Russian state-sponsored actor…