1. ConnectWise suspended its Cloud Backup service after attackers compromised application identities and breached Microsoft 365 tenants, with one credential used to sign in to 173 tenants (The Hacker News, BleepingComputer). 2. A suspected Chinese state-backed group is exploiting a BeyondTrust Remote Support zero-day in espionage attacks, with patches now available after exploitation since August (The Record, Dark Reading). 3. Drupal patched two critical remote…
Posts tagged as “zero-day”
1. China-linked group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since late August to take over servers (The Hacker News). 2. BeyondTrust patched the critical flaw, warning customers of active exploitation in attacks since late August (BleepingComputer). 3. Suspected advanced threat actor exploited FortiOS flaw CVE-2025-61624 to deploy new PEERSTITCH malware bypassing VPN session checks (The Hacker News). 4. Critical Linux kernel vulnerability PwnEscape…
1. Microsoft patched a record 1413 vulnerabilities in October 2026 Patch Tuesday, including one actively exploited Windows Shell bug and two publicly disclosed zero-days (BleepingComputer, The Hacker News, KrebsOnSecurity). 2. An attacker chained three Ivanti Connect Secure zero-days to gain root access without logging in; Ivanti patched two flaws, with a fix for the third pending (The Hacker News). 3. A critical Linux kernel flaw…
1. US authorities arrested a Venezuelan national linked to Tren de Aragua for ATM jackpotting, the first cybercriminal on the FBI Ten Most Wanted list (Dark Reading). 2. Russian espionage actor UAC-0099 updated its MatchBoil malware dropper in campaigns against Ukrainian organizations (Dark Reading). 3. The US State Department offered up to 10 million dollars for information on Zhang Yu, charged in the 2021 HAFNIUM…
1. Citrix released emergency patches for CVE-2026-88779, a high-severity NetScaler ADC and Gateway memory overflow vulnerability exploited in targeted zero-day attacks that can knock SAML deployments offline, with researchers investigating potential remote code execution. (BleepingComputer, The Hacker News) 2. Attackers are actively exploiting CVE-2026-61500, a critical Rejetto HTTP File Server flaw with a CVSS score of 9.3, which allows admin session forgery via a weak…
1. ShinyHunters is conducting a renewed mass exploitation campaign targeting Oracle PeopleSoft via CVE-2026-35273 across multiple global sectors (https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/). 2. Suspected North Korean threat actors compromised Bitget cryptocurrency exchange, resulting in the theft of 351.6 million dollars from hot and warm wallets (https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html). 3. Roundcube Webmail is under active exploitation due to a pre-authentication SQL injection vulnerability tracked as CVE-2026-48842 (https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html). 4. Kiteworks has urged…
1. Google released a security update to patch CVE-2026-85046, a high-severity type confusion vulnerability in the V8 engine that is currently being exploited in the wild (The Hacker News). 2. Over 440,000 exploit attempts have been recorded targeting critical remote code execution flaws in WordPress plugins Super Forms and Elementor Pro (The Hacker News). 3. Cisco issued patches for a critical vulnerability in Nexus 9000…
1. FulcrumSec claimed responsibility for a data breach at Manchester Airports Group involving the theft of 86 GB of sensitive customer and travel information (https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/). 2. Five critical vulnerabilities in WordPress plugins and themes including WPMU DEV Dashboard and Avada allow for site takeover or remote code execution (https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html). 3. Anthropic warned that infostealer malware is actively hijacking active Claude sessions to gain unauthorized account…
1. Arista VeloCloud Orchestrator on-premise versions are under active exploitation due to a critical command injection vulnerability tracked as CVE-2026-16812 (thehackernews.com). 2. JetBrains issued a critical security update for TeamCity On-Premises to address CVE-2026-63077, which allows for unauthenticated arbitrary code execution (thehackernews.com). 3. Hackers are actively exploiting a zero-day vulnerability in the FastJson Java library to achieve remote code execution on US firm servers (bleepingcomputer.com).…
1. A critical pre authentication remote code execution vulnerability in WordPress core known as wp2shell allows unauthenticated attackers to run malicious code on affected sites (https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html). 2. CISA added a critical deserialization vulnerability in Microsoft SharePoint Server tracked as CVE-2026-58644 to its list of actively exploited vulnerabilities (https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html). 3. The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial of service condition by…
1. Microsoft released a record 622 patches for its July Patch Tuesday, including two zero-day vulnerabilities currently under active exploitation (The Hacker News). 2. CISA issued a warning regarding three actively exploited vulnerabilities in internet-exposed on-premises SharePoint Server instances (Bleeping Computer). 3. SonicWall confirmed active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances, including one allowing arbitrary command execution (The Hacker News).…
1. Microsoft released a record number of security patches for June 2026 including fixes for YellowKey and GreenPlasma zero day vulnerabilities (https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-yellowkey-greenplasma-miniplasma-zero-days/) 2. A new Microsoft Defender zero day exploit named RoguePlanet was released by a researcher granting SYSTEM privileges on updated Windows systems (https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/) 3. ServiceNow confirmed that threat actors exploited a flaw to gain unauthorized access to customer instances (https://thehackernews.com/2026/06/servicenow-flaw-exploited-to-gain.html) 4. Ivanti patched…
1. Miasma malware has impacted 73 Microsoft GitHub repositories leading to security concerns regarding repository integrity (Reddit). 2. Threat actor UNC3753 is conducting a financially motivated data theft and extortion campaign against U.S. professional and financial services (The Hacker News). 3. Over 20000 Instagram accounts were hijacked after attackers abused Meta AI support systems to reset user passwords (Bleeping Computer). 4. Hackers are actively exploiting…
1. CISA added the high severity SolarWinds Serv-U denial of service vulnerability CVE-2026-28318 to its Known Exploited Vulnerabilities catalog following reports of active exploitation (The Hacker News). 2. Cisco warned that the high severity vulnerability CVE-2026-20245 in Catalyst SD-WAN Manager is currently being exploited in the wild with no patch yet available (The Hacker News). 3. The Miasma self-replicating supply chain attack has compromised 73…
1. A critical Linux local privilege escalation vulnerability named Copy Fail tracked as CVE-2026-31431 allows unprivileged users to obtain root access (The Hacker News). 2. Official SAP npm packages were compromised in a supply chain attack to steal developer credentials and authentication tokens (Bleeping Computer). 3. Google patched a maximum severity remote code execution flaw in the Gemini CLI npm package and GitHub Actions workflow…
1. A cluster of 108 malicious Google Chrome extensions was identified stealing user data and Telegram information from approximately 20000 users (thehackernews.com). 2. The critical ShowDoc remote code execution vulnerability CVE-2025-0520 is currently being actively exploited in the wild (thehackernews.com). 3. CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog including a critical SQL injection flaw in Fortinet FortiClient EMS tracked as CVE-2026-21643 (thehackernews.com).…
1. ShinyHunters compromised Cisco source code and AWS keys by exploiting a supply chain vulnerability in Trivy. The breach resulted in the unauthorized cloning of over 300 repositories (https://www.reddit.com/r/netsec/comments/1sa8nld/cisco_source_code_stolen_by_shinyhunters_via/). 2. Google released a patch for a high severity Chrome zero day vulnerability identified as CVE 2026 5281 which is currently under active exploitation (https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html). 3. Apple expanded the availability of iOS 18.7.7 and iPadOS 18.7.7…