Ukrainian forces conducted a significant underground advance near Kupyansk, while Russian ballistic missile strikes targeted Kyiv’s Southern Bridge and energy infrastructure. Houthi forces claimed a ballistic missile strike on Saudi Arabia’s largest oil refinery. 1. Kinetic Strike Log (5W) [Ukraine | Day] Where: Kharkiv, Slobozhanskyi district Who/With What: Russian forces / UAV Effect: Damage to the ‘Budmen’ construction hypermarket, including walls, roof, glazing, and interior.…
Posts tagged as “phishing”
1. ConnectWise suspended its Cloud Backup service after attackers compromised application identities and breached Microsoft 365 tenants, with one credential used to sign in to 173 tenants (The Hacker News, BleepingComputer). 2. A suspected Chinese state-backed group is exploiting a BeyondTrust Remote Support zero-day in espionage attacks, with patches now available after exploitation since August (The Record, Dark Reading). 3. Drupal patched two critical remote…
1. Citrix released emergency patches for CVE-2026-88779, a high-severity NetScaler ADC and Gateway memory overflow vulnerability exploited in targeted zero-day attacks that can knock SAML deployments offline, with researchers investigating potential remote code execution. (BleepingComputer, The Hacker News) 2. Attackers are actively exploiting CVE-2026-61500, a critical Rejetto HTTP File Server flaw with a CVSS score of 9.3, which allows admin session forgery via a weak…
1. A critical zero day vulnerability in Fortinet FortiMail tracked as CVE 2026 104286 is being actively exploited to allow unauthenticated arbitrary file writes (The Hacker News). 2. CISA has officially added the critical FortiMail CVE 2026 104286 to its Known Exploited Vulnerabilities catalog following reports of active attacks (The Hacker News). 3. The official Microsoft account on X was hijacked by attackers to promote…
1. Threat actors are actively exploiting a critical memory overflow vulnerability CVE-2026-88772 in Citrix NetScaler ADC and Gateway appliances to deploy web shells and gain root access (thehackernews.com). 2. The Russian APT group Star Blizzard is using a new RedFlick phishing tactic against Ukrainian-linked targets to deploy the CosmicPulse backdoor (darkreading.com). 3. OpenSSL released patches for a high-severity DTLS flaw that allows attackers to leak…
1. Region: Ukraine. Ukrainian forces conducted long-range drone strikes on the Lukoil-Permnefteorgsintez oil refinery in Perm, located over 1,500 kilometers from the border, and the Iskra electronics plant in Ulyanovsk. Source: Kyiv Independent. 2. Region: Ukraine. Russian forces launched a massive overnight aerial attack on Kyiv, Odesa, and other regions using approximately 600 strike UAVs and dozens of ballistic and cruise missiles. Source: Military Summary.…
1. CrowdSec suffered a data breach involving 170 private repositories after attackers used an OAuth token stolen from a former employee via a supply chain attack (darkreading.com). 2. Japan Digital Agency confirmed a data breach affecting 246000 records after attackers exploited a vulnerability in a VPN appliance (research.checkpoint.com). 3. CISA added the Zyxel GS1900 series switch vulnerability CVE-2026-7273 to its Known Exploited Vulnerabilities catalog due…
1. A malicious Twitch browser extension named Twitch Enhanced Viewer JeetBot has leaked OAuth tokens for nearly 31000 users to Russian proxy servers (https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html). 2. Fintech company Revolut disclosed a data breach involving the exposure of customer financial information and passports after an employee was tricked by a threat actor impersonating a government agency (https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/). 3. CISA warned that hackers are actively exploiting a maximum…
1. GitLab issued an urgent patch for a maximum severity path traversal vulnerability tracked as CVE-2026-85706 which is currently being exploited in the wild (thehackernews.com). 2. Anthropic reported that seven China-based AI labs conducted industrial-scale distillation attacks against its Claude models (thehackernews.com). 3. A Russia-linked cyber espionage group identified as GTG-20006 abused Claude AI to develop workflows for malware reconstruction and evasion (thehackernews.com). 4. Threat…
1. Adobe released patches for a critical zero day vulnerability in Magento and Adobe Commerce tracked as CVE 2026 75650 which is being actively exploited to deploy backdoors (thehackernews.com). 2. A Vietnam linked database leak exposed 220 million traveler and crew records including passport numbers and flight details via a cloud path using default credentials (bleepingcomputer.com). 3. The BigBear 2.0 phishing as a service framework…
1. Google released a security update to patch CVE-2026-85046, a high-severity type confusion vulnerability in the V8 engine that is currently being exploited in the wild (The Hacker News). 2. Over 440,000 exploit attempts have been recorded targeting critical remote code execution flaws in WordPress plugins Super Forms and Elementor Pro (The Hacker News). 3. Cisco issued patches for a critical vulnerability in Nexus 9000…
1. Threat actors are actively exploiting a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition tracked as CVE-2026-9586 to deploy reverse shells (thehackernews.com). 2. A critical authentication bypass vulnerability in JFrog Artifactory, CVE-2026-82329, is being actively exploited to mint administrative tokens shortly after its disclosure (thehackernews.com). 3. Attackers are exploiting a critical remote code execution flaw in the Langflow AI framework, CVE-2026-0768, to…
1. TerminalFix campaigns are using fake Cloudflare CAPTCHAs to trick users into executing malicious commands via Windows Terminal or PowerShell (thehackernews.com). 2. The ShinyHunters extortion group claims to have stolen 284 million patient records from McKesson following a voice phishing attack (bleepingcomputer.com). 3. Berlin state government officials confirmed a data breach and stated they will not pay the ransom demanded by the hackers (thehackernews.com). 4.…
1. CISA warned of active exploitation of a critical remote code execution vulnerability in Gitea tracked as CVE-2026-60004 (The Hacker News). 2. Oracle WebLogic Server vulnerability CVE-2026-21962 is under active exploitation allowing unauthenticated attackers to access critical data (The Hacker News). 3. Threat actors are actively exploiting a high-severity vulnerability in Zimbra Collaboration Suite to compromise over 270 servers (BleepingComputer). 4. Attackers are targeting unauthenticated…
1. GitLab vulnerability CVE-2026-19478 is under active exploitation allowing unauthenticated attackers to modify or delete projects (The Hacker News). 2. Microsoft confirmed active exploitation of a maximum severity remote code execution flaw in Entra ID tracked as CVE-2026-69836 (Bleeping Computer). 3. CISA ordered federal agencies to patch two actively exploited vulnerabilities affecting the TrueConf Server platform (Bleeping Computer). 4. A critical command injection vulnerability in…
1. Attackers are actively exploiting a critical remote code execution vulnerability in the Zimbra Collaboration Suite. (BleepingComputer) 2. A critical vulnerability tracked as CVE-2026-32475 in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious files and execute code. (The Hacker News) 3. The new Manic Android malware targets users in Europe and utilizes nearby infected devices for data exfiltration. (BleepingComputer) 4. A campaign…
1. A critical zero day vulnerability in Metabase software is being actively exploited in the wild to allow unauthenticated remote attackers to inject arbitrary SQL and gain administrative access (The Hacker News). 2. CISA added a critical command injection flaw in Progress Kemp LoadMaster tracked as CVE 2026 8037 to its Known Exploited Vulnerabilities catalog following active exploitation reports (The Hacker News). 3. A new…
1. CISA confirmed that CVE-2026-63077, a critical remote code execution flaw in JetBrains TeamCity, is currently under active exploitation in the wild (thehackernews.com). 2. CISA issued an urgent warning for federal agencies to mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat within three days (bleepingcomputer.com). 3. A 26-year-old Canadian man pleaded guilty to his role in the 2024 Snowflake cloud data breaches…
1. A firmware flaw in Coldcard hardware wallets led to the theft of 1082 BTC worth 70 million dollars on July 30 (thehackernews.com). 2. Rails patched a critical Active Storage vulnerability that allows unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (bleepingcomputer.com). 3. Adobe released a fix for a maximum severity CVSS 10.0 vulnerability in Campaign Classic that enables arbitrary code…
1. Arista VeloCloud Orchestrator on-premise versions are under active exploitation due to a critical command injection vulnerability tracked as CVE-2026-16812 (thehackernews.com). 2. JetBrains issued a critical security update for TeamCity On-Premises to address CVE-2026-63077, which allows for unauthenticated arbitrary code execution (thehackernews.com). 3. Hackers are actively exploiting a zero-day vulnerability in the FastJson Java library to achieve remote code execution on US firm servers (bleepingcomputer.com).…
1. Threat actors are abusing Steam discussion forums with ClickFix attacks that trick users into downloading XMRig cryptominers under the guise of game fixes (bleepingcomputer.com). 2. A malvertising campaign dubbed SourTrade impersonates financial platforms to force browsers to assemble malicious Windows executables in memory using legitimate runtime environments (thehackernews.com). 3. Attackers are actively exploiting a critical remote code execution vulnerability in the Fastjson library tracked…
1. Microsoft SharePoint vulnerability CVE-2026-50522 is under active exploitation to steal machine keys and maintain persistent access (The Hacker News). 2. Qilin ransomware actors are actively exploiting the Palo Alto Networks PAN-OS authentication bypass flaw CVE-2026-0257 for initial network access (The Hacker News). 3. Critical vulnerabilities in WordPress Core known as wp2shell are being exploited to install persistent webshells and malicious plugins (Bleeping Computer). 4.…
1. Microsoft released a record 622 patches for its July Patch Tuesday, including two zero-day vulnerabilities currently under active exploitation (The Hacker News). 2. CISA issued a warning regarding three actively exploited vulnerabilities in internet-exposed on-premises SharePoint Server instances (Bleeping Computer). 3. SonicWall confirmed active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances, including one allowing arbitrary command execution (The Hacker News).…
1. CISA issued a warning regarding actively exploited remote code execution vulnerabilities in Joomla extensions iCagenda and Balbooa Forms. (BleepingComputer) 2. The US Treasury sanctioned a VPN service provider and two individuals for enabling ransomware attacks against American organizations. (The Hacker News) 3. AssuranceAmerica disclosed a data breach affecting 7 million people after attackers compromised employee credentials. (Check Point Research) 4. Lidl confirmed a data…
1. The jscrambler npm package release 8.14.0 was compromised to drop and execute a malicious Rust infostealer on Windows, macOS, and Linux systems (https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html). 2. Suspected China and India aligned threat actors conducted sustained cyber espionage campaigns against the Balochistan Police portal between February 2024 and April 2026 (https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html). 3. Progress Software urged ShareFile customers to shut down Storage Zone Controllers due to a credible…
1. Attackers are exploiting the Ill Bloom vulnerability in cryptocurrency wallet software to drain funds by predicting recovery phrases generated with weak randomness (thehackernews.com). 2. A former ransomware negotiator was sentenced to 70 months in prison for conspiring with the BlackCat ransomware group to extort victims (thehackernews.com). 3. The new GodDamn ransomware family is using the PoisonX kernel driver to disable endpoint security software (thehackernews.com).…
1. CISA confirmed that a remote code execution vulnerability in Microsoft SharePoint is currently being actively exploited (Reddit). 2. Google and the FBI disrupted the NetNut residential proxy network, cutting off access for approximately 2 million compromised devices (BleepingComputer). 3. A new Linux kernel vulnerability named Bad Epoll tracked as CVE-2026-46242 allows unprivileged users to gain root access on servers and Android devices (The Hacker…
1. A critical vulnerability in Progress Kemp LoadMaster tracked as CVE-2026-8037 allows unauthenticated attackers to execute arbitrary commands as root (thehackernews.com). 2. The Oracle E-Business Suite vulnerability CVE-2026-46817 is currently being exploited in the wild to take over susceptible instances (thehackernews.com). 3. Ransomware gangs are actively exploiting the Windows BlueHammer privilege escalation flaw in Microsoft Defender (bleepingcomputer.com). 4. The Blackfield ransomware group has demanded a…
1. Russian intelligence services are conducting a long-running campaign using fake support messages to steal credentials from government and military officials in Ukraine, the U.S., and Europe (The Hacker News). 2. The FBI and CISA warned that Russian hackers are now targeting Signal Backup Recovery Keys to gain access to historical message data (Bleeping Computer). 3. A critical remote code execution vulnerability in PTC Windchill…
1. Attackers are actively exploiting a critical vulnerability in Cisco Unified CM and Unified CM SME deployments that enables server side request forgery and privilege escalation to root (Dark Reading). 2. A critical code injection vulnerability in Lantronix EDS5000 series devices tracked as CVE 2025 67038 is being actively exploited in the wild (The Hacker News). 3. Threat actors exploited the Cisco Catalyst SD WAN…