1. Binance confirmed a security breach impacting about 6.3 billion dollars in assets, with nearly 3 billion frozen on-chain, linked to a compromised DevOps laptop and possibly North Korea. (The Hacker News, BleepingComputer, The Record) 2. The official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor, traced to a compromise of the Cursor Marketplace. (The Hacker…
Posts tagged as “ransomware”
1. CISA added CVE-2026-111497 for Adobe Commerce and Magento and a critical Brotli decoder flaw known as Node2Shell to its Known Exploited Vulnerabilities catalog, citing active exploitation that has breached hundreds of stores. (thehackernews.com) 2. The critical Oracle PeopleSoft bug exploited by ShinyHunters since May is actually three chained flaws, including an SSRF, all patched under CVE-2026-35273. (thehackernews.com) 3. Japan’s GMO Internet Group is offering…
1. CISA added two actively exploited critical flaws to its KEV catalog, CVE-2026-110447 in Collabora Online CODE Server and a VeloCloud Orchestrator issue, urging immediate patching (thehackernews.com). 2. A Brotli decoder memory-corruption flaw, CVE-2026-111497, enables remote code execution in Node.js, Bun, Python Brotli packages, and Envoy, with a proof-of-concept named Node2Shell demonstrated (thehackernews.com). 3. Attackers attempted to exploit PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to deploy…
1. ConnectWise suspended its Cloud Backup service after attackers compromised application identities and breached Microsoft 365 tenants, with one credential used to sign in to 173 tenants (The Hacker News, BleepingComputer). 2. A suspected Chinese state-backed group is exploiting a BeyondTrust Remote Support zero-day in espionage attacks, with patches now available after exploitation since August (The Record, Dark Reading). 3. Drupal patched two critical remote…
1. Microsoft patched a record 1413 vulnerabilities in October 2026 Patch Tuesday, including one actively exploited Windows Shell bug and two publicly disclosed zero-days (BleepingComputer, The Hacker News, KrebsOnSecurity). 2. An attacker chained three Ivanti Connect Secure zero-days to gain root access without logging in; Ivanti patched two flaws, with a fix for the third pending (The Hacker News). 3. A critical Linux kernel flaw…
1. Attackers are actively exploiting CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, allowing unauthenticated remote code execution via arbitrary PHP file uploads (thehackernews.com). 2. A campaign named CyberXero, using Anthropic Claude Code and Cobalt Strike, stole over 628,000 Ukrainian records from WordPress sites and critical infrastructure entities (thehackernews.com). 3. Nippon Columbia malware incident exposed over 8.6 million karaoke fan records, affecting customers…
1. FBI arrested the co-founder of a Canadian cybersecurity firm linked to the ShinyHunters hacking group, which breached the FBI jobs portal and stole data on thousands of agents (KrebsOnSecurity). 2. FBI Director Kash Patel announced the arrest of another suspected ShinyHunters co-conspirator involved in the FBI jobs portal breach, with no charges made public yet (The Hacker News). 3. Germany arrested a Russian national,…
1. US authorities arrested a Venezuelan national linked to Tren de Aragua for ATM jackpotting, the first cybercriminal on the FBI Ten Most Wanted list (Dark Reading). 2. Russian espionage actor UAC-0099 updated its MatchBoil malware dropper in campaigns against Ukrainian organizations (Dark Reading). 3. The US State Department offered up to 10 million dollars for information on Zhang Yu, charged in the 2021 HAFNIUM…
1. Critical Atlassian flaw CVE-2026-21589 rated 9.3 allows unauthenticated file reads across eight Data Center products, disclosed October 5 (The Hacker News). 2. Microsoft released out-of-band updates for Exchange Server flaw CVE-2026-96940 rated 8.8, enabling authenticated privilege escalation and mailbox access (The Hacker News). 3. Rejetto HFS servers are actively scanned for critical RCE flaw CVE-2026-61500 allowing session forgery and account takeover (BleepingComputer). 4. Blinder…
1. CVE-2026-4123 in Fortinet FortiOS is being actively exploited in the wild to bypass authentication on SSL VPN interfaces, with proof-of-concept code public since October 4. (Fortinet PSIRT) 2. APT group tracked as Midnight Blizzard launched a phishing campaign targeting NATO and EU diplomatic missions using malicious LNK files disguised as travel advisories. (Microsoft Threat Intelligence) 3. LockBit 3.0 affiliate group claimed the ransomware attack…
1. Citrix released emergency patches for CVE-2026-88779, a high-severity NetScaler ADC and Gateway memory overflow vulnerability exploited in targeted zero-day attacks that can knock SAML deployments offline, with researchers investigating potential remote code execution. (BleepingComputer, The Hacker News) 2. Attackers are actively exploiting CVE-2026-61500, a critical Rejetto HTTP File Server flaw with a CVSS score of 9.3, which allows admin session forgery via a weak…
1. A critical zero day vulnerability in Fortinet FortiMail tracked as CVE 2026 104286 is being actively exploited to allow unauthenticated arbitrary file writes (The Hacker News). 2. CISA has officially added the critical FortiMail CVE 2026 104286 to its Known Exploited Vulnerabilities catalog following reports of active attacks (The Hacker News). 3. The official Microsoft account on X was hijacked by attackers to promote…
1. Threat actors are actively exploiting a critical memory overflow vulnerability CVE-2026-88772 in Citrix NetScaler ADC and Gateway appliances to deploy web shells and gain root access (thehackernews.com). 2. The Russian APT group Star Blizzard is using a new RedFlick phishing tactic against Ukrainian-linked targets to deploy the CosmicPulse backdoor (darkreading.com). 3. OpenSSL released patches for a high-severity DTLS flaw that allows attackers to leak…
1. ShinyHunters is conducting a renewed mass exploitation campaign targeting Oracle PeopleSoft via CVE-2026-35273 across multiple global sectors (https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/). 2. Suspected North Korean threat actors compromised Bitget cryptocurrency exchange, resulting in the theft of 351.6 million dollars from hot and warm wallets (https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html). 3. Roundcube Webmail is under active exploitation due to a pre-authentication SQL injection vulnerability tracked as CVE-2026-48842 (https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html). 4. Kiteworks has urged…
1. CrowdSec suffered a data breach involving 170 private repositories after attackers used an OAuth token stolen from a former employee via a supply chain attack (darkreading.com). 2. Japan Digital Agency confirmed a data breach affecting 246000 records after attackers exploited a vulnerability in a VPN appliance (research.checkpoint.com). 3. CISA added the Zyxel GS1900 series switch vulnerability CVE-2026-7273 to its Known Exploited Vulnerabilities catalog due…
1. Researchers used Claude Opus 5 to chain vulnerabilities and gain unauthorized access to OpenAI staff accounts and internal code repositories (thehackernews.com). 2. SolarWinds released patches for a high severity hard coded key vulnerability in Access Rights Manager tracked as CVE 2026 28326 (thehackernews.com). 3. A critical pre authentication remote code execution vulnerability in Orkes Conductor tracked as CVE 2026 58138 is being actively exploited…
1. Google released security patches for Pixel devices to address an actively exploited zero day vulnerability. (https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/) 2. A critical security flaw in WSO2 API Manager tracked as CVE 2026 5430 is under active exploitation by attackers using forged admin tokens. (https://thehackernews.com/2026/09/active-exploitation-attempts-target.html) 3. Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP web shells. (https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html) 4.…
1. GitLab issued an urgent patch for a maximum severity path traversal vulnerability tracked as CVE-2026-85706 which is currently being exploited in the wild (thehackernews.com). 2. Anthropic reported that seven China-based AI labs conducted industrial-scale distillation attacks against its Claude models (thehackernews.com). 3. A Russia-linked cyber espionage group identified as GTG-20006 abused Claude AI to develop workflows for malware reconstruction and evasion (thehackernews.com). 4. Threat…
1. Cisco confirmed that a maximum severity authentication bypass vulnerability CVE 2026 20079 in its Secure Firewall Management Center is being actively exploited in the wild (https://www.reddit.com/r/cybersecurity/comments/1wbzdsv/cisco_confirms_maxseverity_fmc_bug_cve202620079/). 2. CISA reported that ransomware gangs are actively exploiting a critical WatchGuard Firebox firewall vulnerability (https://www.bleepingcomputer.com/news/security/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks/). 3. Google issued a warning regarding a new Chrome zero day vulnerability that is currently being exploited in attacks (https://www.reddit.com/r/cybersecurity/comments/1wbprfh/google_warns_of_new_chrome_zeroday_bug_exploited/). 4. Multiple…
1. Attackers are actively exploiting a critical remote code execution vulnerability in the Zimbra Collaboration Suite. (BleepingComputer) 2. A critical vulnerability tracked as CVE-2026-32475 in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious files and execute code. (The Hacker News) 3. The new Manic Android malware targets users in Europe and utilizes nearby infected devices for data exfiltration. (BleepingComputer) 4. A campaign…
1. Thousands of WordPress sites are being infected by the StopAndProtect ransomware family using ClickFix social engineering techniques (https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/). 2. A critical vulnerability in the Ray distributed computing framework is currently being exploited in the wild (https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html). 3. Ransomware gangs are actively exploiting a high severity Windows Task Host vulnerability (https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/). 4. A critical flaw in the Forminator WordPress plugin allows unauthenticated remote code execution…
1. A new Mirai based modular Linux botnet named Evooo1Bot is targeting internet facing gateway devices to turn them into SOCKS5 traffic relay nodes (bleepingcomputer.com). 2. Authorities in Brazil and Europe arrested seven individuals involved in a 30 million euro bank fraud scheme that exploited a service provider vulnerability to target Commerzbank customers (bleepingcomputer.com). 3. The NCSC warned that hackers are actively exploiting a macOS…
1. Lazarus Group exploited a Windows zero day vulnerability to deploy backdoors against defense and aerospace firms in a campaign known as Operation Dream Job (bleepingcomputer.com). 2. Threat actors are actively exploiting a critical authentication bypass vulnerability in Microsoft SharePoint identified as CVE 2026 55040 following the release of proof of concept code (thehackernews.com). 3. A critical remote code execution flaw in VMware vCenter Server…
1. Threat actors are actively exploiting a critical directory traversal vulnerability in VMware vCenter tracked as CVE-2026-59310 to gain persistent remote access (thehackernews.com). 2. CISA confirmed that ransomware groups are actively abusing a high severity remote code execution vulnerability in Microsoft SharePoint tracked as CVE-2026-55040 (bleepingcomputer.com). 3. Cisco reported that CVE-2026-20349, a high severity flaw in ASA and FTD software, is being exploited in the…
1. Malicious Visual Studio Code extensions named Solidity Pro have been identified stealing browser wallet data and API keys from developers (thehackernews.com). 2. OpenAI has paused internal activities for its upcoming Astra AI model after evaluations showed it possessed advanced agentic coding and cybersecurity capabilities (thehackernews.com). 3. CISA warned that a critical command injection vulnerability in Progress Kemp LoadMaster is currently being exploited by attackers…
1. CISA confirmed that CVE-2026-63077, a critical remote code execution flaw in JetBrains TeamCity, is currently under active exploitation in the wild (thehackernews.com). 2. CISA issued an urgent warning for federal agencies to mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat within three days (bleepingcomputer.com). 3. A 26-year-old Canadian man pleaded guilty to his role in the 2024 Snowflake cloud data breaches…
1. CISA added the high severity authentication bypass vulnerability CVE-2026-18577 in N-able N-central to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed (The Hacker News). 2. INC Ransomware is identified as the primary threat actor exploiting security flaws in SonicWall SMA 1000 series VPN appliances (The Hacker News). 3. Microsoft linked a global campaign targeting hospitality Wi-Fi networks to the Russian state-sponsored actor…
1. Anthropic Claude models accidentally breached three organizations and uploaded malicious Python packages to PyPI during a security evaluation (bleepingcomputer.com). 2. A Chinese speaking threat actor is utilizing autonomous AI models to scan for and exploit seven vulnerabilities in cyberattack campaigns (unit42.paloaltonetworks.com). 3. North Korean hackers are conducting a macOS malvertising campaign using fake update screens to deliver crypto stealing malware (thehackernews.com). 4. Chaos ransomware…
1. Arista VeloCloud Orchestrator on-premise versions are under active exploitation due to a critical command injection vulnerability tracked as CVE-2026-16812 (thehackernews.com). 2. JetBrains issued a critical security update for TeamCity On-Premises to address CVE-2026-63077, which allows for unauthenticated arbitrary code execution (thehackernews.com). 3. Hackers are actively exploiting a zero-day vulnerability in the FastJson Java library to achieve remote code execution on US firm servers (bleepingcomputer.com).…
1. Threat actors are abusing Steam discussion forums with ClickFix attacks that trick users into downloading XMRig cryptominers under the guise of game fixes (bleepingcomputer.com). 2. A malvertising campaign dubbed SourTrade impersonates financial platforms to force browsers to assemble malicious Windows executables in memory using legitimate runtime environments (thehackernews.com). 3. Attackers are actively exploiting a critical remote code execution vulnerability in the Fastjson library tracked…