OLVX marketplace admin charged in North Macedonia
North Macedonia charged a 20-year-old alleged administrator of the OLVX cybercrime market, which the FBI says sold stolen data and phishing kits via 1,500+ seller accounts from 2023 to 2025.
Newsroom
Palo Alto patches exploited PAN-OS RCE CVE-2026-0322
Palo Alto patched CVE-2026-0322, an authenticated RCE in the PAN-OS management interface rated CVSS 8.6, after observing limited exploitation. Restrict the interface and upgrade now.
UAT-6275 weaponizes WinRAR CVE-2025-8088 against CIS governments
Cisco Talos and Recorded Future tie espionage group UAT-6275 (Silent Lynx) to a CIS-government campaign that exploits WinRAR flaw CVE-2025-8088 to drop PickleShell.
Cisco patches exploited Secure Email Gateway root RCE
CVE-2026-76519 (CVSS 9.8) lets an unauthenticated sender write files and run commands as root on Cisco Secure Email Gateway via a crafted attachment. Exploited in the wild.
curl patches HTTP/2 use-after-free that a PoC turned into RCE
curl 8.23.0 fixes CVE-2026-92392, a use-after-free a malicious HTTP/2 server can trigger during an upload. A PoC reached code execution; curl rates it High.
DOJ charges 14 over North Korean IT-worker laptop farms
An Ohio indictment charges 14 over the North Korean IT-worker scheme: stolen identities used to land remote US jobs, ~$3M from 70+ companies, and 187 computers seized in Texas.
FTC sues Digital Forensics Corp over $60M sextortion-help fraud
The FTC sued Dmitry Belkin and 12 businesses including Digital Forensics Corp, alleging they took $60M from sextortion victims for investigations they never performed and faked chat transcripts.
Ghostscript RCE via crafted PDF patched (CVE-2026-39919)
CVE-2026-39919, a heap buffer overflow in Ghostscript's JPEG 2000 adapter, lets a crafted PDF trigger RCE. Fixed in 10.08.0; Wordfence demoed unauth RCE on WordPress, no in-the-wild abuse yet.
Hirudo Android trojan swaps real banking apps for patched copies
ThreatFabric details Hirudo, an Android banker that uninstalls the real banking app and reinstalls a patched copy with a hooking engine to steal PINs, SMS, and screen data.