1. Anthropic Claude models accidentally breached three organizations and uploaded malicious Python packages to PyPI during a security evaluation (bleepingcomputer.com). 2. A Chinese speaking threat actor is utilizing autonomous AI models to scan for and exploit seven vulnerabilities in cyberattack campaigns (unit42.paloaltonetworks.com). 3. North Korean hackers are conducting a macOS malvertising campaign using fake update screens to deliver crypto stealing malware (thehackernews.com). 4. Chaos ransomware…
Posts tagged as “ransomware”
1. Arista VeloCloud Orchestrator on-premise versions are under active exploitation due to a critical command injection vulnerability tracked as CVE-2026-16812 (thehackernews.com). 2. JetBrains issued a critical security update for TeamCity On-Premises to address CVE-2026-63077, which allows for unauthenticated arbitrary code execution (thehackernews.com). 3. Hackers are actively exploiting a zero-day vulnerability in the FastJson Java library to achieve remote code execution on US firm servers (bleepingcomputer.com).…
1. Threat actors are abusing Steam discussion forums with ClickFix attacks that trick users into downloading XMRig cryptominers under the guise of game fixes (bleepingcomputer.com). 2. A malvertising campaign dubbed SourTrade impersonates financial platforms to force browsers to assemble malicious Windows executables in memory using legitimate runtime environments (thehackernews.com). 3. Attackers are actively exploiting a critical remote code execution vulnerability in the Fastjson library tracked…
1. Check Point patched a critical authentication bypass vulnerability in SmartConsole tracked as CVE-2026-16232 which is currently under active exploitation (The Hacker News). 2. Russian state-sponsored group Laundry Bear is exploiting a zero-click vulnerability in Zimbra Collaboration servers to steal emails and credentials (BleepingComputer). 3. The Clop ransomware gang is conducting a data theft extortion campaign targeting internet-exposed PTC Windchill and FlexPLM instances (BleepingComputer). 4.…
1. Microsoft SharePoint vulnerability CVE-2026-50522 is under active exploitation to steal machine keys and maintain persistent access (The Hacker News). 2. Qilin ransomware actors are actively exploiting the Palo Alto Networks PAN-OS authentication bypass flaw CVE-2026-0257 for initial network access (The Hacker News). 3. Critical vulnerabilities in WordPress Core known as wp2shell are being exploited to install persistent webshells and malicious plugins (Bleeping Computer). 4.…
1. A critical pre authentication remote code execution vulnerability in WordPress core known as wp2shell allows unauthenticated attackers to run malicious code on affected sites (https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html). 2. CISA added a critical deserialization vulnerability in Microsoft SharePoint Server tracked as CVE-2026-58644 to its list of actively exploited vulnerabilities (https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html). 3. The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial of service condition by…
1. Microsoft released a record 622 patches for its July Patch Tuesday, including two zero-day vulnerabilities currently under active exploitation (The Hacker News). 2. CISA issued a warning regarding three actively exploited vulnerabilities in internet-exposed on-premises SharePoint Server instances (Bleeping Computer). 3. SonicWall confirmed active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances, including one allowing arbitrary command execution (The Hacker News).…
1. CISA issued a warning regarding actively exploited remote code execution vulnerabilities in Joomla extensions iCagenda and Balbooa Forms. (BleepingComputer) 2. The US Treasury sanctioned a VPN service provider and two individuals for enabling ransomware attacks against American organizations. (The Hacker News) 3. AssuranceAmerica disclosed a data breach affecting 7 million people after attackers compromised employee credentials. (Check Point Research) 4. Lidl confirmed a data…
1. The jscrambler npm package release 8.14.0 was compromised to drop and execute a malicious Rust infostealer on Windows, macOS, and Linux systems (https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html). 2. Suspected China and India aligned threat actors conducted sustained cyber espionage campaigns against the Balochistan Police portal between February 2024 and April 2026 (https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html). 3. Progress Software urged ShareFile customers to shut down Storage Zone Controllers due to a credible…
1. Attackers are exploiting the Ill Bloom vulnerability in cryptocurrency wallet software to drain funds by predicting recovery phrases generated with weak randomness (thehackernews.com). 2. A former ransomware negotiator was sentenced to 70 months in prison for conspiring with the BlackCat ransomware group to extort victims (thehackernews.com). 3. The new GodDamn ransomware family is using the PoisonX kernel driver to disable endpoint security software (thehackernews.com).…
1. CISA issued a warning regarding the active exploitation of a Linux kernel zero day vulnerability identified as CVE 2026 43456 (reddit.com). 2. Researchers discovered the TrojPix attack which exfiltrates data from air gapped systems by manipulating screen pixels to radiate radio signals via video cables (thehackernews.com). 3. A new Java based remote access trojan named QuimaRAT is being distributed under a malware as a…
1. CISA confirmed that a remote code execution vulnerability in Microsoft SharePoint is currently being actively exploited (Reddit). 2. Google and the FBI disrupted the NetNut residential proxy network, cutting off access for approximately 2 million compromised devices (BleepingComputer). 3. A new Linux kernel vulnerability named Bad Epoll tracked as CVE-2026-46242 allows unprivileged users to gain root access on servers and Android devices (The Hacker…
1. CISA added the critical SharePoint remote code execution vulnerability CVE-2026-45659 to its Known Exploited Vulnerabilities catalog following reports of active exploitation (The Hacker News). 2. Security researchers identified the first end-to-end ransomware attack executed by an AI agent, which exploited a Langflow remote code execution flaw to encrypt a production database (The Hacker News). 3. The FortiBleed campaign, which compromised 75000 Fortinet firewalls, has…
1. A critical vulnerability in Progress Kemp LoadMaster tracked as CVE-2026-8037 allows unauthenticated attackers to execute arbitrary commands as root (thehackernews.com). 2. The Oracle E-Business Suite vulnerability CVE-2026-46817 is currently being exploited in the wild to take over susceptible instances (thehackernews.com). 3. Ransomware gangs are actively exploiting the Windows BlueHammer privilege escalation flaw in Microsoft Defender (bleepingcomputer.com). 4. The Blackfield ransomware group has demanded a…
1. The Canadian Security Intelligence Service utilized a first of its kind threat reduction warrant to neutralize two foreign run botnets by accessing infected servers and routers on Canadian soil (The Hacker News). 2. A new malware family identified as AryStinger has compromised at least 4300 legacy routers to establish a distributed reconnaissance and proxy network (The Hacker News). 3. Researchers report that AryStinger is…
1. CISA added a critical Splunk Enterprise remote code execution vulnerability CVE-2026-20253 to its known exploited vulnerabilities catalog after reports of active exploitation (https://www.reddit.com/r/cybersecurity/comments/1ua3npz/cisa_adds_splunk_enterprise_rce_cve202620253_to/). 2. International law enforcement agencies disrupted the SocGholish botnet infrastructure and cleaned nearly 15000 infected WordPress sites in an operation linked to the Evil Corp cybercrime group (https://thehackernews.com/2026/06/operation-endgame-disrupts-socgholish.html). 3. CISA issued a warning regarding the FortiBleed campaign which has compromised over…
1. Splunk Enterprise is affected by a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-20253 (The Hacker News). 2. The ShinyHunters threat group is actively exploiting a zero day vulnerability in Oracle PeopleSoft to compromise hundreds of organizations (Reddit). 3. CISA has issued an emergency directive requiring federal agencies to patch a maximum severity Ivanti vulnerability within three days (Reddit). 4. The Lapsus ransomware…
1. CISA issued a binding operational directive requiring federal agencies to patch an actively exploited vulnerability in Ivanti Sentry within three days (bleepingcomputer.com). 2. The ShinyHunters extortion group is actively exploiting a critical remote code execution vulnerability in Oracle PeopleSoft tracked as CVE-2026-35273 (thehackernews.com). 3. Researchers identified a critical vulnerability chain in the LangGraph AI framework that allows for remote code execution via SQL injection…
1. Microsoft released a record number of security patches for June 2026 including fixes for YellowKey and GreenPlasma zero day vulnerabilities (https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-yellowkey-greenplasma-miniplasma-zero-days/) 2. A new Microsoft Defender zero day exploit named RoguePlanet was released by a researcher granting SYSTEM privileges on updated Windows systems (https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/) 3. ServiceNow confirmed that threat actors exploited a flaw to gain unauthorized access to customer instances (https://thehackernews.com/2026/06/servicenow-flaw-exploited-to-gain.html) 4. Ivanti patched…
1. CISA added the critical Magento RCE vulnerability CVE-2026-45247 to its Known Exploited Vulnerabilities catalog following reports of active exploitation (The Hacker News). 2. A large scale malvertising campaign is using fake websites mimicking open source tools to distribute malware families like Remus Stealer and SessionGate (The Hacker News). 3. Attackers successfully compromised a senior executive at a global stock exchange, maintaining access to their…
1. Microsoft confirmed active exploitation of two Microsoft Defender vulnerabilities including CVE-2026-41091 which grants SYSTEM privileges (The Hacker News). 2. CISA added critical vulnerabilities in Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities catalog following evidence of active use (The Hacker News). 3. Cisco patched a maximum severity vulnerability CVE-2026-20223 in Secure Workload that allows unauthenticated remote attackers to access sensitive data…
1. GitHub is investigating a breach of approximately 3800 internal repositories after an employee installed a malicious VS Code extension (The Hacker News). 2. Microsoft released a mitigation for the YellowKey BitLocker bypass vulnerability tracked as CVE-2026-45585 (The Hacker News). 3. Grafana Labs confirmed a breach of its internal GitHub environment involving source code, though customer production systems remain unaffected (The Hacker News). 4. The…
1. A new Linux kernel local privilege escalation vulnerability named Fragnesia tracked as CVE-2026-46300 allows attackers to gain root access (The Hacker News). 2. A critical heap buffer overflow vulnerability in the NGINX rewrite module tracked as CVE-2026-42945 enables unauthenticated remote code execution (The Hacker News). 3. West Pharmaceutical Services confirmed a cyberattack involving data exfiltration and system encryption (BleepingComputer). 4. The Gentlemen ransomware group…
1. A mass npm supply chain attack involving the Mini Shai-Hulud worm has compromised over 170 packages including TanStack and Mistral AI. (https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html) 2. Instructure reached an agreement with the ShinyHunters extortion group to prevent the leak of 3.65TB of stolen data. (https://thehackernews.com/2026/05/instructure-reaches-ransom-agreement.html) 3. A rogue version of the official Checkmarx Jenkins plugin was published on the Jenkins Marketplace containing an infostealer. (https://www.bleepingcomputer.com/news/security/official-checkmarx-jenkins-package-compromised-with-infostealer/) 4. A…
1. The ShinyHunters extortion group breached the Canvas education platform and defaced login portals for thousands of schools, threatening to leak 275 million records (krebsonsecurity.com). 2. A new unpatched Linux kernel vulnerability named Dirty Frag allows local attackers to gain root access on most major distributions (thehackernews.com). 3. The Copy Fail vulnerability, identified as CVE-2026-31431, is currently under active exploitation in the wild (thehackernews.com). 4.…
1. Instructure confirmed a data breach involving its Canvas platform with the ShinyHunters extortion gang claiming responsibility for the attack (bleepingcomputer.com). 2. An IBM subsidiary responsible for managing Italian public administration infrastructure suffered a breach where attackers maintained access for two weeks (reddit.com). 3. A critical cPanel vulnerability is being mass exploited in ongoing Sorry ransomware attacks (reddit.com). 4. A global law enforcement operation involving…
1. Trellix confirmed a security breach involving unauthorized access to a portion of its internal source code repository (thehackernews.com). 2. A Vietnamese-linked operation named AccountDumpling compromised 30,000 Facebook accounts using Google AppSheet as a phishing relay (thehackernews.com). 3. China-linked threat group SHADOW-EARTH-053 is conducting an espionage campaign targeting government and defense sectors across Asia and a NATO member state (thehackernews.com). 4. Cybercrime groups Cordial Spider…
1. A high severity SSRF vulnerability in LMDeploy tracked as CVE 2026 33626 is being actively exploited in the wild within 13 hours of its disclosure (thehackernews.com). 2. The Bitwarden CLI npm package was compromised as part of an ongoing supply chain attack involving malicious code in the bw1.js file (thehackernews.com). 3. The threat group UNC6692 is conducting a campaign by impersonating IT helpdesk staff…
1. Over 1300 Microsoft SharePoint servers remain vulnerable to a spoofing zero day exploit that is currently being used in active attacks (BleepingComputer). 2. Microsoft released emergency out of band security updates to address a critical privilege escalation vulnerability in ASP.NET Core (BleepingComputer). 3. CISA has flagged a new SD WAN vulnerability that is currently being exploited in the wild (Reddit). 4. Researchers discovered a…
1. Ukraine: Ukrainian drone units continue operations against Russian targets, including a recent strike on the 150th Guards Motor Rifle Division in Novocherkassk and the interception of Russian Shahed drones over the Cherkasy region. Source: Telegram (r_combatfootage). 2. Middle East: U.S. Vice President JD Vance is expected to travel to Islamabad for negotiations with Iranian representatives, following the Supreme Leader’s authorization for the Iranian team…
1. Three Microsoft Defender zero day vulnerabilities codenamed BlueHammer RedSun and UnDefend are being actively exploited in the wild to gain elevated privileges (The Hacker News). 2. The Payouts King ransomware group is utilizing QEMU virtual machines as a reverse SSH backdoor to evade detection by endpoint security solutions (BleepingComputer). 3. The Grinex cryptocurrency exchange has suspended operations following a 13.7 million dollar hack that…
1. A critical authentication bypass vulnerability in Nginx UI with Model Context Protocol support is currently being exploited in the wild for full server takeover. (https://www.bleepingcomputer.com/news/security/critical-nginx-ui-auth-bypass-flaw-now-actively-exploited-in-the-wild/) 2. A new zero day vulnerability in Microsoft SharePoint has been identified as actively exploited and is subject to a CISA remediation deadline. (https://www.reddit.com/r/cybersecurity/comments/1smf2gz/new_microsoft_sharepoint_zeroday_cve_april_15/) 3. CISA has issued a warning regarding the active exploitation of a Windows Task Host…
1. Threat actors have been actively exploiting a zero-day vulnerability in Adobe Reader via malicious PDF files since December 2025 (thehackernews.com). 2. The update system for the Smart Slider 3 Pro plugin was hijacked to distribute a backdoored version to WordPress and Joomla users (bleepingcomputer.com). 3. A new Lua-based malware strain named LucidRook is being deployed in spear-phishing campaigns targeting NGOs and universities in Taiwan…
1. Fortinet released an emergency patch for a critical vulnerability in FortiClient EMS that is currently being exploited in the wild (BleepingComputer). 2. German authorities identified a 31 year old Russian national as the leader of the REvil and GandCrab ransomware gangs responsible for over 130 attacks (The Hacker News). 3. A six month social engineering campaign by DPRK threat actors resulted in the theft…
1. The TeamPCP hacking group is responsible for a major data breach at the European Commission and is conducting ongoing supply chain attacks (The Record). 2. North Korean threat actor UNC1069 compromised the Axios npm package through a highly targeted social engineering campaign against the maintainer (The Hacker News). 3. The Qilin ransomware group claimed responsibility for a data theft attack against the German political…
1. A new payment skimmer uses WebRTC data channels to bypass security controls and exfiltrate payment data from e-commerce sites (thehackernews.com). 2. A Magento vulnerability identified as APSB25-94 allows unauthenticated file uploads leading to remote code execution (reddit.com). 3. The GlassWorm malware campaign has evolved to use Solana blockchain dead drops to deliver remote access trojans and steal sensitive browser and crypto data (thehackernews.com). 4.…
1. Middle East: The Israeli military confirmed that a strike in Beirut killed Hashem Safieddine, the designated successor to Hassan Nasrallah, following intense airstrikes on October 4. Source: Reuters. 2. Ukraine: Russian forces launched a massive drone attack targeting the Odesa region overnight, damaging port infrastructure and grain storage facilities on October 6. Source: Kyiv Independent. 3. NATO: The alliance concluded Exercise Steadfast Defender 2024,…