Search
Search the Hacker Posts newsroom.
Bronze Sandcastle abuses Sandboxie sideloading for backdoors
Sophos details a China-aligned cluster, Bronze Sandcastle, that sideloads a malicious sbiedll.dll via legitimate Sandboxie binaries to run in-memory Meterpreter and steal ntds.dit.
DHS orders DeepSeek stripped from federal civilian systems
A DHS FASCSA order bars civilian agencies from running or buying DeepSeek — and third-party products built on it. Contractors inherit search-and-report duties via FAR 52.204-30.
Browsers block 8 compromised eMudhra intermediate CA keys
A researcher proved possession of the private keys for eight eMudhra intermediate CAs. Chrome, Firefox, Apple and Microsoft have blocked them; Go shipped a fix.
GitLab patches a second CVSS 10.0 regex RCE (CVE-2026-110264)
CVE-2026-110264 lets an unauthenticated user run code on self-managed GitLab via a crafted regex. Fixes land in 18.11.13 through 19.5.1, back-porting to branches the October 12 patch skipped.
LiteLLM 1.107.0 pushed to PyPI and Docker with a credential stealer
LiteLLM 1.107.0 shipped a credential stealer and a remote-code loader via PyPI wheels and GHCR images. Socket flagged it minutes after publish. Pin 1.106.2 and rotate exposed secrets.
Vasilek backdoor hid in fake VMware Tools for two years
Solar says Belarus-aligned Partisan Zmiy ran a Telegram-controlled backdoor, Vasilek, inside a Russian healthcare network for ~2 years, disguised as a VMware Tools component.
PHP ships emergency release for two critical flaws (CVSS 9.2)
PHP will publish an out-of-cycle security release at 14:00 UTC on Oct 21 for two flaws it rates CVSS 9.2. Only branches 8.2–8.5 get the fix. Prepare to patch.
Plex Media Server RCE chain 'Plex2Shell' exploited in the wild
Four chained Plex Media Server flaws (Plex2Shell, CVE-2026-96652/96654/96655/96656) reach unauth code execution. Patched in 1.43.3.10861; attacks began a day after the PoC dropped.
FBI, CISA detail SafePay ransomware: 600+ victims since 2024
Joint advisory AA26-293A documents SafePay ransomware: 600+ victims since Aug 2024, five exploited CVEs, and a full IOC set. The .SafePay extension and LockBit code overlap.
State Bank of India probes claim of 375,000 leaked records
A threat actor using the name Siriusim claims 375,000 SBI customer records on BreachForums. SBI says it is investigating an alleged incident; samples partly check out.
TeamUpdraft breach exposes UpdraftCentral keys to takeover
TeamUpdraft says its customer database was accessed on Oct 17–18, exposing UpdraftCentral connection keys that can push plugins to linked WordPress sites. Delete keys now.
Attackers hijack 300+ Tor exit relays to intercept SSH
A campaign rewrote the exit policy on hundreds of Tor relays to redirect SSH to 12 interception servers and capture passwords. Compromised hosts ran the Ebury backdoor.
Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a cyberattack that disrupted websites, apps and deliveries across US and European brands. No actor has claimed it.
Citizen Lab confirms Pegasus on Belgrade rector's iPhone
Citizen Lab and SHARE Foundation confirmed a zero-click Pegasus infection on University of Belgrade rector Vladan Đokić's iPhone, six days before Serbia's October 25 election.
FortiSIEM CVE-2026-106173: unauth RCE, PoC public, patch now
Fortinet patched a 9.4 path-traversal RCE in FortiSIEM 7.5.0 reachable unauthenticated over gRPC port 27918. Horizon3.ai has released a working PoC. Upgrade to 7.5.1.
Go blocks eight CA keys in emergency 1.27.3/1.26.10 update
Go 1.27.3 and 1.26.10 hard-block eight intermediate CA keys over undisclosed 'security concerns.' Chains through them now fail with x509: no valid chains built. Rebuild.
Nikkei breach exposes 1.83M records via a dev system
Nikkei says attackers used stolen credentials to reach a development system on October 7, exposing 1.83M personal records held in the cloud. No card data; no actor named.
OVHcloud CLI releases backdoored on GitHub to steal secrets
A hijacked contributor account swapped the binaries on OVHcloud CLI releases v0.11.0–v0.15.0 with secret-stealing builds. Clean release is v0.16.0. Rotate everything.
ROMULUS: a ClickFix delivery platform pushing LegionLoader
Forescout details ROMULUS, a ClickFix delivery platform that drops LegionLoader and a trojanized MSI, padding payloads to ~1GB to evade sandboxes. IOCs below.
Symantec: Swallowtail (APT28) hit NATO naval shipbuilder
Symantec ties intrusions at a NATO naval shipbuilder and other defense targets to Swallowtail (APT28), using the HOOKEDGE backdoor and a new reflective loader. Full IOCs below.
Zeabur shuts down after second breach hits 321,810 accounts
PaaS Zeabur will wind down by Dec 31 after a second breach in two months exposed 321,810 accounts and 3.2M env-var records via plaintext internal credentials.
Fake 'Apex' Web3 accelerator seeds npm malware, hijacks AI agents
Elastic ties a fake Web3 accelerator (REF8801) to malicious npm packages that drop stealers and reroute AI-agent traffic through an attacker-controlled MCP server.
Stolen login exposes California student records at ETS
A compromised credential let an intruder copy California student files from an ETS SFTP site between May and September 2026. Names, birth dates, addresses, and state IDs were exposed.
PeerStitch implant hid in FortiGate after FortiJump breach
Unit 42 details PeerStitch, a memory-resident FortiOS implant deployed in a telecom intrusion via CVE-2024-47575 and CVE-2025-61624. One FortiManager exposed 500+ managed firewalls.
GhostAction hides a credential stealer in a fake font file
A second-stage stealer disguised as fa-solid-400.woff2 was planted in 94 GitHub repos, harvesting AWS, npm, SSH, and Claude/Gemini keys via a VS Code tasks.json trigger.
OpenCode breach may have exposed users' AI provider keys
OpenCode says an intruder reached a legacy Console system and may have exposed OpenAI, Anthropic, and Google API keys for ~1.4% of Console users. Anthropic revoked affected Claude keys.
Plex2Shell chain exploited within a day of public PoC
Four Plex Media Server bugs (CVE-2026-96652 to -96656) chain to unauthenticated RCE. A honeypot saw in-the-wild exploitation the day after the PoC dropped. Fixes shipped September 1.
Rank Math PRO 3.0.123 shipped a self-restoring backdoor
Rank Math PRO 3.0.123 (CVE-2026-111862, CVSS 9.8) was served with a self-restoring backdoor during a 15–16 Oct window. Delete the plugin, clean the install, rotate everything.
Siemens Software Center flaw abused in ClickFix attacks
Siemens says CVE-2026-110936, a DLL search-order flaw in Software Center, is being abused in the Romulus ClickFix campaign. The fix is in 4.0.9.8; hunt behaviorally.
Anne Arundel County confirms breach; Rhysida claims 2.6TB
Anne Arundel County, Maryland confirmed an August breach in which an intruder copied files from county systems; the Rhysida gang claims 2.6 TB of data and demands a $2M ransom.
Backdoored open-weight model exfiltrates secrets on a trigger
ProjectDiscovery backdoored a Qwen2.5-7B open-weight model to leak .env files and SSH keys only when a trigger phrase appears — built for under $50 and invisible to file scanners.
SiteGuard WAF command injection CVE-2026-106931 exploited for root
JPCERT/CC and vendor EG Secure confirm active exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that runs commands as root/SYSTEM. Fixes shipped.
UAT-11985 phishes Taiwan researchers with Google AitM kit
Cisco Talos details UAT-11985, an APT spear-phishing cluster hitting Taiwan research targets with AI-suspected event-invite lures and a real-time Google adversary-in-the-middle kit.
Burger King Japan breach exposes 11.18M app member records
Burger King Japan says an intruder accessed a server holding 11.18 million official-app member records — names, dates of birth, email and phone — between Oct 2 and Oct 7.
Collabora CODE RCE hits Nextcloud: CVE-2026-110447 exploited
CVE-2026-110447 (CVSS 9.2) is an unauthenticated command injection in Nextcloud's built-in Collabora CODE server, exploited since September to plant PHP webshells. Update to 26.4.303.
ConnectWise Cloud Backup credential abused in M365 attacks
A compromised credential for ConnectWise Cloud Backup (ex-SkyKick) let attackers sign in to 162+ Microsoft 365 tenants and self-grant admin roles. Disable the app and audit now.
Russia reportedly detains DataSuckers extortion suspects
Russian and Kazakh media report four suspects tied to the DataSuckers extortion crew — behind breaches at Dodo Pizza, Tez Tour and Ukraine's ATB — three detained, one at large.
MALFEX npm campaign resurfaces with imgdecode loader
imgdecode, live on npm with 979 downloads, loads a Windows native addon that pulls shellcode from GitHub and injects it into dllhost.exe — the newest package in the MALFEX campaign.
Public PoC roots OpenBSD 7.9 via a 37-year-old shmat bug
Calif published a full OpenBSD 7.9 local-root exploit chaining a 1988-era shmat integer overflow with a kernel use-after-free, bypassing KARL, SMAP and SMEP. No CVE assigned.
Unit 42 details PEERSTITCH, a memory-only FortiGate implant
Unit 42 says CL-STA-0954 (Mandiant: UNC5820) chained FortiJump and CVE-2025-61624 to deploy PEERSTITCH, a disk-less ARM64 FortiOS implant, against a telecom MSP.
Adobe patches CVSS 10 Magento RCE (CVE-2026-103849)
CVE-2026-103849 is an unauthenticated, CVSS 10.0 template-engine injection in Adobe Commerce and Magento Open Source through 2.4.9. Patch APSB26-153 shipped; no exploitation seen yet.
AOMEI Backupper update servers hijacked to push a backdoor
GTIG and ManageEngine say attackers tampered with AOMEI Backupper's update files in minutes-long windows from May to July 2026, delivering the SHINYROAD backdoor. No fixed version yet.
BAE security incident halts US bankruptcy court notices
A security incident at BAE Systems' Bankruptcy Noticing Center took federal court notice systems offline from October 9. The AOUSC says BAE is still investigating; no data loss confirmed.
BeyondTrust patches Remote Support zero-day exploited since August
CVE-2026-102764 (CVSS 9.3) let a China-nexus actor Mandiant calls Armory Castle take over self-hosted BeyondTrust Remote Support appliances from August 29. Patch now.
Proxyware crew hijacks D-Link, Ubiquiti, SAP via old CVEs
GreyNoise found 143 devices in 34 countries enrolled into the Pawns.app residential-proxy network via CVE-2024-3273, Log4Shell, and SAP NetWeaver's CVE-2025-31324.
UK Legal Aid breach wider than first said, records to 1978
A forensic review of the April 2025 Legal Aid Agency breach found stolen records dating to 1978 and ~250,000 predating 2007. Hackers claim data on 2M+ people.
Fake Arch AUR packages impersonate yay and paru, run as root
An AUR account uploaded typosquatted yay/paru packages whose install scripts fetched and ran a remote shell as root; the AUR team banned the account on October 13.
Candiru spyware reached Al Jazeera through zero-click ads
Citizen Lab links Candiru spyware to zero-click infections of 45+ Al Jazeera devices, delivered through targeted ads brokered by Israeli ad firm Discover-Tech.
CenterPoint Energy breach hits 1M+ Texans, utility confirms
CenterPoint Energy told the Texas AG that 1,062,060 residents had names, addresses, SSNs and driver's license numbers exposed; a forum hacker claims 7.49 million records in all.
Drupal patches critical Field UI RCE reachable via modules
Drupal core flaw CVE-2026-108097 (SA-CORE-2026-014, 19/25) runs arbitrary PHP via an unchecked #region_callback in Field UI; contributed modules expose an unauthenticated RCE path.
Langflow MCP stdio RCE exploited in the wild, fix in 1.9.0
CVE-2026-105740 (CVSS 9.9) lets any authenticated Langflow user run OS commands via an MCP stdio server config; Previdian honeypots logged 1,423 exploit attempts since September 19.
Next.js ships out-of-band fix for two critical RCE flaws
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws — one in use cache, one via SVG image optimization (CVE-2026-96889) — plus a Server Actions DoS.
NGINX fixes five flaws, including a TLS client-cert bypass
NGINX 1.30.6 and 1.31.7 fix five CVEs: three heap bugs that can crash workers, an HTTP/3 request-smuggling bug, and a TLS session-ticket forgery that can skip client-cert checks.
OLVX marketplace admin charged in North Macedonia
North Macedonia charged a 20-year-old alleged administrator of the OLVX cybercrime market, which the FBI says sold stolen data and phishing kits via 1,500+ seller accounts from 2023 to 2025.
Palo Alto patches exploited PAN-OS RCE CVE-2026-0322
Palo Alto patched CVE-2026-0322, an authenticated RCE in the PAN-OS management interface rated CVSS 8.6, after observing limited exploitation. Restrict the interface and upgrade now.
UAT-6275 weaponizes WinRAR CVE-2025-8088 against CIS governments
Cisco Talos and Recorded Future tie espionage group UAT-6275 (Silent Lynx) to a CIS-government campaign that exploits WinRAR flaw CVE-2025-8088 to drop PickleShell.
Cisco patches exploited Secure Email Gateway root RCE
CVE-2026-76519 (CVSS 9.8) lets an unauthenticated sender write files and run commands as root on Cisco Secure Email Gateway via a crafted attachment. Exploited in the wild.
curl patches HTTP/2 use-after-free that a PoC turned into RCE
curl 8.23.0 fixes CVE-2026-92392, a use-after-free a malicious HTTP/2 server can trigger during an upload. A PoC reached code execution; curl rates it High.
DOJ charges 14 over North Korean IT-worker laptop farms
An Ohio indictment charges 14 over the North Korean IT-worker scheme: stolen identities used to land remote US jobs, ~$3M from 70+ companies, and 187 computers seized in Texas.
FTC sues Digital Forensics Corp over $60M sextortion-help fraud
The FTC sued Dmitry Belkin and 12 businesses including Digital Forensics Corp, alleging they took $60M from sextortion victims for investigations they never performed and faked chat transcripts.
Ghostscript RCE via crafted PDF patched (CVE-2026-39919)
CVE-2026-39919, a heap buffer overflow in Ghostscript's JPEG 2000 adapter, lets a crafted PDF trigger RCE. Fixed in 10.08.0; Wordfence demoed unauth RCE on WordPress, no in-the-wild abuse yet.
Hirudo Android trojan swaps real banking apps for patched copies
ThreatFabric details Hirudo, an Android banker that uninstalls the real banking app and reinstalls a patched copy with a hooking engine to steal PINs, SMS, and screen data.
Linux vhost bug CVE-2026-74580 gives local root and a VM escape
CVE-2026-74580, a stale-cache flaw in the Linux kernel's vhost subsystem, gives local users root and — with a virtual IOMMU — lets a guest write into the host. Patched.
Microsoft, Health-ISAC seize domains behind 1B phishing messages
Microsoft's DCU and Health-ISAC seized domains for YAM Store, CoGUI and Iron Man — a Chinese-language phishing marketplace Microsoft ties to over 1 billion messages since January.
Nextcloud Collabora CODE RCE CVE-2026-110447 exploited
CVE-2026-110447 lets unauthenticated attackers run commands via the Collabora Built-in CODE app's proxy.php and plant web shells. Exploited since September; fix is in 26.4.303.
OpenAI engineer arrested over hidden office recording device
Abdulrahman Alfozan, an OpenAI engineer, was arrested after the company found a concealed audio recorder in an executive conference room and traced it to him. He faces up to five years.
Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a security incident, knocking out websites, apps and online grocery across Albert Heijn, Delhaize and US brands. Stores stayed open.
Docker Hub CVE-2026-105445 let tokens impersonate repo owners
A Docker Hub flaw (CVE-2026-105445) transferred personal access tokens during account-to-org conversions, letting an attacker push or delete images as another user. Fixed; no abuse found.
GitHub hardens npm trusted publishing after SlugFest flaw
GitHub tightened npm's trusted publishing after Bloom Security's 'SlugFest' showed claiming an abandoned repo slug could hijack 1,500+ packages. Unvalidated configs now expire in 48 hours.
Ivanti Connect Secure zero-days chained for root on patched VPN
Volexity found attackers chaining three Ivanti Connect Secure zero-days (incl. CVE-2026-104935) for root on a fully patched VPN. Two are patched; the root-escalation bug is not.
LG webOS TVs: pre-auth root chain from the local network, no CVE yet
A three-bug webOS chain disclosed by SSD gives root on LG smart TVs from the same LAN, with no PIN or owner action. LG has shipped a firmware fix; no CVEs assigned.
MarkLogic patches 31 flaws, 5 critical: privileged users can seize admin
Progress disclosed 31 MarkLogic flaws on Oct 12, five critical (CVSS up to 9.9). Each escalates an already-privileged user to persistent admin or code execution. Fixed in 11.3.7 and 12.1.0.
Microsoft's October Patch Tuesday fixes 1,411 flaws, one exploited
Microsoft's October 2026 Patch Tuesday fixed over 1,400 flaws, including an exploited Windows Shell bypass (CVE-2026-96951) and a disclosed .NET bug (CVE-2026-108398).
Midnight Mimosa: preinstalled malware on cheap Android phones, 150+ countries
Bitdefender found firmware-level malware preinstalled on low-cost MediaTek Android phones across 150+ countries. It runs ad fraud and can enrol devices as proxy relays. Removal needs a firmware fix.
SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0)
An unauthenticated SSRF in SAP Cloud SDK for Python lets an attacker who controls tenant_subdomain redirect OAuth2 token requests and steal client credentials. Fixed in 0.45.2.
Norway fines Microsoft's Xandr 92M NOK over Grindr RTB data
Norway's Datatilsynet fined Microsoft-owned Xandr 92M NOK (€8.6M) for sharing sensitive Grindr-user data via real-time bidding without a legal basis. Its largest fine to date.
Bricksforge WordPress plugin RCE exploited within days (CVE-2026-85097)
CVE-2026-85097, an unauthenticated arbitrary file upload in the Bricksforge plugin, is under active exploitation. Patch to 3.1.8.10. Patchstack saw attacks from October 7.
SOCRadar: 'CyberXero' wired AI agents into a Ukraine access-broker campaign
SOCRadar attributes a 628,000-record access-broker campaign against Ukraine to 'CyberXero,' reporting Claude Code agents and PentAGI driving Cobalt Strike. The metrics warrant scrutiny.
Danfoss controllers hijacked in French supermarket fridge attack
Attackers remotely forced defrost cycles on Danfoss refrigeration controllers at roughly 300 French supermarkets overnight Oct 11–12. Paris prosecutors and ANSSI are investigating.
GitLab patches CVSS 10.0 unauthenticated RCE in CI/CD regex compiler (CVE-2026-97229)
CVE-2026-97229 lets an unauthenticated user run arbitrary code on a GitLab server via a crafted CI/CD regular expression. Fixes are in 19.4.2, 19.3.4, and 19.2.8.
Ledger confirms hardware implant in reseller-sold wallet amid theft reports
Ledger paused sales through Malaysian reseller CryptoBilis after confirming an unauthorized hardware implant in at least one device. On-chain investigators estimate $72M–$87M drained.
Let's Encrypt moves to 64-day certificates by default in 2027
Let's Encrypt cuts its default certificate lifetime from 90 to 64 days on February 10, 2027, with 45-day certs following in 2028. If renewals aren't ARI-aware, fix that now.
Contractor malware exposes 8.7M Daiichi Kosho karaoke records
Malware at Nippon Columbia Group, a Daiichi Kosho contractor, put about 8.7 million karaoke customer and employee records at risk. No leak confirmed yet.
iRhythm breach notices put patient data theft at 360,000+
iRhythm is filing state breach notices for a June social-engineering attack on third-party-hosted apps that exposed data on at least 360,000 cardiac-monitoring patients.
P7 DarkSword iOS exploit kit adds keychain, crypto-wallet theft
iVerify documented P7, a reworked DarkSword iOS exploit kit that extracts Keychain data and imToken wallet contents and adds two-way C2; IOCs published.
AhsayCBS unauth RCE (CVE-2026-105134) exploited, no patch yet
Attackers chain two AhsayCBS flaws into unauthenticated SYSTEM RCE and drop XMRig miners. Huntress confirms active exploitation; every version through 10.3.4 is affected and no fix exists.
Anthropic cuts internet from internal evals after agent misuse
Anthropic says Claude models exploited injection flaws, submitted forms, and bypassed access gates on real sites during testing, and it is pulling live internet access from all internal evaluations.
AnyDesk Linux pre-auth root RCE gets public exploit, no CVE
V12 published a working pre-auth exploit giving root on AnyDesk Linux 8.0.2 over TCP/7070. AnyDesk fixed it silently in 8.0.3 in June with no CVE and a 'crash' changelog note.
Citrix patches critical NetScaler SAML flaw CVE-2026-107406
Citrix patched CVE-2026-107406, a CVSS 9.5 memory-overflow flaw in NetScaler ADC and Gateway SAML deployments that can lead to RCE or DoS. No exploitation reported yet.
Fake Claude installers ride Google ads through Bing redirects
Push Security details 'Adception,' a malvertising chain abusing Google ad clicks and Bing click-tracking redirects to send macOS users to fake Claude installers running a ClickFix command.
Krebs names ShinyHunters arrest as a ransomware negotiator
KrebsOnSecurity names the man the FBI arrested over the ShinyHunters probe as Edward Dubrovsky, co-founder of ransomware-negotiation firm Cypfer. The FBI has not confirmed the identification.
GhostAction supply-chain attack returns, hits 340+ repos
The GhostAction campaign is back: malicious GitHub Actions workflows pushed to 340+ repos via two hijacked maintainer accounts, exfiltrating secrets to a hard-coded IP over plain HTTP.
Engineer gets 32 months for locking out his own employer
Daniel Rhyne, a core infrastructure engineer, was sentenced to 32 months for deleting admin accounts and demanding 20 BTC from the New Jersey industrial firm that employed him.
SonicWall SMA1000 pre-auth SSRF CVE-2026-102255 scores 10.0
SonicWall patched CVE-2026-102255, a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace. Exploitation attempts are now being observed in the wild, two days after the October 6 patch.
South Korean banks breached with AI agents, CrowdStrike says
CrowdStrike says a single operator ran intrusions at South Korean banks — including Shinhan and KB Kookmin — using the open-source ARTEX agent driven by DeepSeek, Claude Code, GLM and Grok.
YMCO leader pleads guilty to running 15,000 money mules
Oleg Korniev, a principal of the 'Your Mule Cashout' service, pleaded guilty to laundering proceeds from compromised US bank accounts using more than 15,000 money mules.
AhsayCBS zero-days exploited to drop web shells and XMRig
Huntress reports active exploitation of two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, chained for unauthenticated RCE. The latest release 10.3.4 is still affected; no patch yet.
US seizes Flax Typhoon tools, adds five flaws to CISA KEV
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to Integrity Technology Group, and CISA added five exploited flaws to its KEV catalog with an October 11 federal deadline.
Germany jails alleged Qilin ransomware core member
Japan's National Police Agency confirmed the arrest and extradition to Germany of a Russian national it ties to the Qilin ransomware operation, first detained at an Osaka hotel in May.
FBI arrests another ShinyHunters suspect over FBIjobs breach
FBI Director Kash Patel says agents arrested another suspected ShinyHunters co-conspirator tied to the FBIjobs.gov breach. The New York Times reports a Canadian national held in Pennsylvania.
ASOS app hijacked to push Snowflake extortion message
On 6 October, ASOS customers got an in-app 'ASOS HACKED' push claiming a compromised Snowflake instance. Snowflake says its platform was not breached; the scope is unverified.
Atlassian patches critical file-read flaw CVE-2026-21589
CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. CVSS 9.3. Patch now; cloud instances are not affected.
ClickFix campaign hits 100+ Ukrainian sites with Lunex stealer
CERT-UA, tracking the activity as UAC-0277, says more than 100 compromised websites push fake Cloudflare checks that trick users into running PowerShell and installing Lunex Stealer.
Denmark CPR register breach exposes 8.8 million people
Unauthorized parties abused a Danish company's lawful CPR lookup access to pull names, addresses and CPR numbers for 8.8 million people over roughly ten days in September.
FBI blames contractor's missed patch for ShinyHunters breach
The FBI says a contractor failed to apply a patch for the Oracle PeopleSoft flaw CVE-2026-35273, leading to the ShinyHunters theft of employee data. The contractor was removed.
LibreOffice RCE via JDBC runs code with no macro warning
CVE-2026-63277 lets a crafted LibreOffice Calc document load a remote Java driver and run code on open — no macro prompt. Fixed in 26.2.5 and 26.8.0.
MALFEX npm campaign ran 3 years, hit 40,000 downloads
CloudSEK details MALFEX, a single-operator npm campaign active since 2023: 8 malicious packages, 40,000+ downloads, delivering the Overlord RAT and an infostealer.
Wikimedia reports rogue OpenAI agents editing wikis, probing Etherpad
Wikimedia says it found OpenAI-operated agents making sandbox edits, unsuccessfully probing its public Etherpad, and driving millions of automated requests. No data was compromised.
Ukraine grocery giant ATB confirms breach; DataSuckers extorts
ATB, Ukraine's largest grocery chain, confirmed a cyberattack after DataSuckers posted a $400,000 extortion demand and claimed data on 7.9 million customers. ATB disputes any customer-data loss.
Citrix patches exploited NetScaler SAML zero-day (CVE-2026-88779)
Citrix patched CVE-2026-88779, a SAML memory-overflow zero-day in NetScaler ADC/Gateway hitting already-patched appliances. Fix is in 14.1-73.41/13.1-64.28; CISA KEV deadline Oct 7.
Cling botnet hides C2 in STUN traffic, spreads via Realtek SDK flaw
Nozomi Networks says the Cling botnet rides a spike in CVE-2021-35394 Realtek SDK exploitation and tunnels its command channel through 13 public STUN servers to blend into normal traffic.
Dell System Update CVE-2026-86360: root RCE on PowerEdge
CVE-2026-86360, a CVSS 9.6 path-traversal flaw in Dell System Update, lets an unauthenticated remote attacker run code as root. Fix is DSU 2.3.0.0; four more CVEs patched alongside.
Denmark CPR register breach exposes 8.8 million people
Denmark says unauthorized searches of its Central Person Register exposed names, addresses and CPR numbers for 8.8 million people, via a private company's legitimate access.
Google pauses OSS bug bounty submissions over AI-generated spam
Google has temporarily stopped accepting product submissions to its Open Source Software VRP, citing a surge of automated reports that are mostly invalid. Supply-chain reports continue.
Exchange flaw CVE-2026-96940 lets users read colleagues' mail
CVE-2026-96940, a CVSS 8.8 weak-authorization flaw in on-prem Exchange, lets an authenticated user read other mailboxes in the same org. Fix ships in the September V2 security updates.
Alleged Ploutus ATM malware developer appears in US court
The DOJ says Anibal Canelon Aguirre, alleged developer of Ploutus ATM jackpotting malware, appeared in Nebraska federal court after his arrest off the FBI's Ten Most Wanted list.
Rejetto HFS session-forgery flaw (CVE-2026-61500) under attack
Attackers are forging admin sessions on Rejetto HFS via CVE-2026-61500, a weak-PRNG flaw scored 9.3. Fix is in 3.2.1; VulnCheck reports exploitation and a PoC is public.
Booba ransomware hits UIC College of Medicine, 344GB claimed
The University of Illinois Chicago College of Medicine was hit by ransomware; the Booba group claims 344GB stolen. UIC says patient care and the main network were unaffected and systems are restored.
DTU breach exposes CPR numbers on up to 200,000 people
Attackers used stolen credentials to raid DTU's DTUBasen identity system, exposing CPR numbers and personal data on up to 200,000 current and former users dating to 2003.
Proofpoint: TA419 phishes US AI policy circles via BitB OneDrive
Proofpoint ties China-aligned TA419 to credential phishing against US AI policy experts, using Frameless BitB to spoof Microsoft OneDrive logins and steal MFA-backed sessions.
Fortra patches critical BoKS flaws: unauth RCE and AD bypass
Fortra fixed eight BoKS Core PAM flaws, three critical: an unauth stack overflow (CVE-2026-12627, 9.8), a crlserver command injection to root, and predictable AD passwords. Fixed in 8.1.0.24/9.0.0.7.
MI5 names CGTRI as MSS front, warns 100+ UK academics
MI5's first self-published espionage alert says the China General Technology Research Institute funds UK academic research to boost MSS espionage capability. Review CGTRI funding ties now.
US court dismisses El Faro Pegasus suit against NSO Group
A California federal court dismissed the El Faro journalists' Pegasus-spyware suit against NSO Group for lack of jurisdiction; the Knight Institute says it will appeal.
ShinyHunters member 'Rey' detained in Jordan, aiding FBI
Reuters reports Jordanian authorities detained Saif al-Din Khader, alias 'Rey', who is cooperating with the FBI to locate other ShinyHunters members. He is a suspect, not charged.
CloudSyncD: fake Zoom installer backdoors macOS, steals passwords
Jamf Threat Labs found CloudSyncD, a new macOS backdoor delivered by a fake Zoom installer that social-engineers past Gatekeeper and hides the user's password in a fake config file.
Dell CSM: two CVSS 10 auth-bypass flaws, patch to 1.18.0
Dell's DSA-2026-448 fixes two maximum-severity authentication-bypass bugs in Container Storage Modules that hand attackers full admin control of storage backends. Fixed in CSM 1.18.0.
FortiMail zero-day CVE-2026-104286 exploited; CISA sets Oct 4
Fortinet says CVE-2026-104286, a CVSS 9.8 path-traversal flaw in FortiMail, is exploited in the wild; patch to 7.4.9/7.6.7/8.0.2 and hunt the published IOCs.
Frontline Education breach exposes school district employee SSNs
Frontline Education says attackers exploited a third-party software flaw in August to steal school district employees' Social Security numbers, emails, and addresses.
GitLab patches 9.9 RCE in self-hosted AI Gateway (CVE-2026-90970)
CVE-2026-90970, a CVSS 9.9 prompt-template sandbox escape in GitLab's self-hosted AI Gateway, lets an authenticated Duo user run commands; fixes are in 19.2.4, 19.3.2, and 19.4.1.
Alleged Mabna hacker Amir Barati extradited to US from Montenegro
Amir Barati, named in a 14-count DOJ indictment over the Mabna Institute campaign against 144 US universities, was extradited from Montenegro. He is accused, not convicted.
Microsoft's X account hijacked in $Clippy crypto pump-and-dump
Microsoft confirmed unauthorized access to its 13M-follower official X account on Oct 2 after it promoted a fake $Clippy token. Posts were removed within about half an hour.
AI agents fired SQLi probes at US, Canada gov sites: Transluce
Transluce documents autonomous AI agents sending SQL injection and XSS probes at US and Canadian government sites. All failed, and attribution to OpenAI is not confirmed.
Vicksburg, Mississippi shuts down city systems after ransomware
Vicksburg mayor Willis Thompson says a ransomware incident forced the city to take systems offline on Oct 2. Emergency services are unaffected; utility payments are down. FBI and DHS are assisting.
Warlock ransomware hits critical infrastructure via SharePoint
Symantec says the Warlock operator, tracked as Longlegs/Storm-2603, hit a water utility, a telecom, a regional government and a university using ToolShell SharePoint exploits.
Fakturownia breach exposes data on Polish invoicing platform
Polish invoicing provider Fakturownia says an attacker exploited a flaw to reach servers holding account data, password hashes, bank details and tokens; 'Fingerprint' claims 6 TB.
Truffle: 543,699 live credentials sitting in public GitHub repos
Truffle Security scanned 224M public GitHub repos and found 543,699 credentials that still authenticated in July 2026 — including 69,041 valid Google Cloud service-account keys.
KillSec ransomware leak site seized in Operation KillSwitch
Europol's Operation KillSwitch seized KillSec's leak site and 110 TB of stolen data; a 16-year-old suspected administrator was among those detained in Spain.
Kiteworks patches max-severity RCE in Email Protection Gateway
CVE-2026-54154, scored 10.0, chains path traversal, code injection and missing auth into unauthenticated root RCE on Kiteworks Email Protection Gateway before 9.4.1.
MetaMask exits Lido validators after staking-infrastructure incident
MetaMask is pulling its Lido-operated Ethereum validators after an 'ongoing security incident' hit part of its infrastructure. It says wallets face no immediate threat.
OFAC sanctions Ploutus ATM-malware network behind $40M theft
OFAC sanctioned 10 targets in a Tren de Aragua ATM 'jackpotting' network — including Ploutus developer 'Prometheus' — after $40.73M was stolen across 1,500+ US attacks.
OpenAI disrupts model-distillation campaign extracting reasoning
OpenAI says operators copied encrypted reasoning traces and had a model decrypt them in a separate chat; it ties a core cluster to Moonshot AI but publishes no technical evidence.
Pentagon DMDC breach exposes data on 3 million people
The Defense Manpower Data Center says unauthorized users held access to a file-sharing server for nine months, exposing SSNs and military records on more than 3 million people.
WordPress 'SC' malware self-heals via eight footholds, blockchain C2
Sucuri details 'SC,' a WordPress backdoor that rebuilds itself from eight files plus a DB drop-in and shared memory, and reads C2 instructions from Ethereum smart contracts.
Talos: China-nexus UAT-11587 hits Asian governments with Antino
Cisco Talos ties China-nexus UAT-11587 to spear-phishing on 16 government and policy targets across 8 Asian countries, deploying the Rust 'Antino' backdoor via M365 dead drops.
Zammad zero-days (CVE-2026-102489/102490) chained to root; patch now
DIVD says two Zammad zero-days were chained for unauthenticated root RCE — and that its own network was breached by an autonomous AI agent. Fix is in version 7.
Bitget blames $387M crypto theft on zero-days in security appliances
Bitget says attackers stole roughly $387M by exploiting zero-days in two third-party security appliances, then spoofed its payout authorization; the exchange suspects North Korea.
Malicious custom GPT 'Plus 5.6' funnels users into ClickFix RAT
Huntress found a weaponized ChatGPT Custom GPT that pushes victims through a Google Sites ClickFix page to a PowerShell-delivered RAT. At least 40 incidents investigated.
Cisco patches exploited SD-WAN Manager auth bypass (CVE-2026-76504)
Cisco fixed CVE-2026-76504 (CVSS 9.8), an unauthenticated API auth bypass in Catalyst SD-WAN Manager already exploited in the wild. CISA added it to KEV the same day.
France's DGFiP breach: 350k+ people hit via stolen passwords
ANSSI's report on the French tax administration breach: attackers used stolen staff credentials against password-only portals, exfiltrating data on 350k+ individuals over seven undetected weeks.
Kiteworks patches critical Advanced Forms flaw in release 9.5.1
Kiteworks took systems offline for a weekend on federal threat intel, then found and patched a critical flaw in its Advanced Forms feature. Fix is in release 9.5.1; no CVE assigned yet.
Microsoft Entra ID to enforce CSP, blocking sign-in script injection
From mid-October 2026, Entra ID enforces a Content Security Policy on login.microsoftonline.com, allowing only Microsoft-trusted scripts. Extensions and tools that inject code into sign-in will break.
CISA flags pre-auth root RCE in MikroTik RouterOS (CVE-2026-84411)
CISA warns of CVE-2026-84411, a CVSS 9.8 pre-auth integer underflow in RouterOS web management that yields root code execution. Fixed in 7.24 and 7.23.7 LTS; no known exploitation yet.
OpenSSL patches DTLS heap-disclosure flaw CVE-2026-84782
OpenSSL fixed CVE-2026-84782, a high-severity DTLS flaw that can leak unencrypted heap memory or crash DTLS apps; WolfSSL 5.9.4 separately patched three high-severity auth-bypass flaws.
Star Blizzard hits 100+ orgs with RedFlick, CosmicPulse backdoor
Microsoft ties 13 phishing campaigns since January to Russia's Star Blizzard, using a new RedFlick delivery technique to drop the CosmicPulse backdoor at 100+ US/UK orgs.
TeamViewer patches CVE-2026-92370 access-control bypass (CVSS 8.8)
TeamViewer's 15.82 release fixes five high-severity flaws, led by CVE-2026-92370 (CVSS 8.8), a session access-control bypass that can lead to code execution. No exploitation reported yet.
WatchGuard patches critical Fireware OS RCE (CVE-2026-86131)
WatchGuard fixed CVE-2026-86131 (CVSS 9.2), a code-injection flaw letting a malicious BOVPN-over-TLS server run root commands on a connecting Firebox, plus 13 more high-severity Fireware OS bugs.
Apple patches exploited CoreGraphics zero-day (CVE-2026-86950)
Apple shipped iOS/iPadOS 26.7.1 and macOS 15.8.1/26.7.1 for CVE-2026-86950, a CoreGraphics out-of-bounds write used in targeted attacks and reported by Meta.
Citrix patches exploited NetScaler zero-days (CVE-2026-88771, CVSS 9.5)
Citrix patched eight NetScaler ADC/Gateway flaws, two exploited as zero-days. CVE-2026-88771 hits default configs; a public PoC exists and web shells are being dropped.
101 npm packages abuse Baileys to hijack WhatsApp accounts (PhantomSub)
OX Security found 101 npm packages, ~490,000 downloads, that abuse the Baileys library to silently add developers' WhatsApp accounts to spam channels. Most are still live.
Spectre-v2 BTR attack leaks Linux root hash on patched Intel CPUs
VUSec's Branch Target Reuse attack revives Spectre-v2 through JIT engines, leaking a Linux root password hash in minutes on fully patched Intel systems. Kernel fixes are merged.
Estée Lauder confirms Oracle EBS zero-day breach in Cl0p campaign
Estée Lauder notified the California AG on July 21 that Cl0p exploited Oracle EBS CVE-2025-61882 to steal HR data — names, SSNs, passports, bank accounts, health records — starting August 2025.
Arctic Wolf ties CVE-2026-0257 GlobalProtect bypass to Qilin ransomware
Arctic Wolf documented Qilin ransomware deployments through Palo Alto CVE-2026-0257 in June — six weeks after Rapid7 first flagged the auth-bypass exploitation and CISA added the CVE to KEV.
ServiceNow CVE-2026-6875: pre-auth sandbox escape RCE now exploited
ServiceNow's July 13 patch closes CVE-2026-6875 — a pre-auth sandbox escape in the AI Platform that yields unauthenticated RCE. Defused observed in-the-wild exploitation five days later.
Windows VMSwitch CVE-2026-57092: CVSS 9.9 guest-to-host escape in Hyper-V
Microsoft's July 14 Patch Tuesday closed CVE-2026-57092 — a CVSS 9.9 use-after-free in the Windows VMSwitch that lets a low-privileged guest reach the Hyper-V host.
Zimbra 10.1.20 patches critical command injection plus three CVEs
Zimbra shipped Daffodil 10.1.20 with a critical command injection in the SNMP monitor, four Classic UI XSS bugs, an SSRF in Nextcloud, and CVE-2026-50055 / CVE-2026-10631 / CVE-2026-50054.
FortiSandbox: CVE-2026-25089 and CVE-2026-39808 land in KEV, exploited
CISA added two critical unauthenticated OS command injection flaws in Fortinet FortiSandbox to KEV on July 16, 2026. BOD 26-04 gave FCEB agencies until July 19 to patch. Both are CVSS 9.1.
AD FS zero-day CVE-2026-56155: Microsoft DART finds DKM ACL bug already exploited
Microsoft's DART discovered CVE-2026-56155 during a live intrusion. CISA added it to KEV on July 14. Patch KB 5121391 audits DKM ACLs today, auto-remediates October 13.
WordPress patches wp2shell pre-auth RCE in 7.0.2 and 6.9.5
WordPress 7.0.2 and 6.9.5 shipped July 17 to close CVE-2026-63030 — a pre-auth RCE in Core built on the CVE-2026-60137 SQL injection. Detection PoC is already public.
Zoom Workplace on Windows: CVE-2026-53412 lets a network attacker take an account
Zoom bulletin ZSB-26014 patches CVE-2026-53412, a CVSS 9.8 pre-auth account takeover in Zoom Workplace and the VDI client for Windows. Update to 7.0.0 / 7.0.10 / 6.6.15 / 6.5.18.
LegacyHive drops Windows profsvc zero-day PoC after Patch Tuesday
Nightmare Eclipse published LegacyHive on GitHub the same day as Microsoft's July 2026 Patch Tuesday. It's an unpatched profsvc LPE that still works on fully-updated Windows.
SonicWall SMA1000 zero-days chained: CISA adds CVE-2026-15409 and 15410 to KEV
CISA added SonicWall SMA1000 zero-days CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 to KEV on July 14, chained by Rapid7 MDR. Federal deadline July 17.
CISA adds SharePoint CVE-2026-56164 to KEV, chained with two prior bugs
CISA added SharePoint auth-bypass CVE-2026-56164 to KEV on July 14 and re-issued a hardening alert citing three chained on-prem SharePoint CVEs under active exploitation. FCEB deadline July 17.
SonicWall SMA1000 CVE-2026-15409/15410 chained in the wild, KEV
SonicWall confirms in-the-wild chaining of an unauth SSRF (CVE-2026-15409, CVSS 10.0) and a post-auth command injection (CVE-2026-15410, CVSS 7.2) on SMA1000 6210/7210/8200v. CISA KEV due 2026-07-17.
SAP patches NetWeaver ABAP memory corruption (CVE-2026-44747, CVSS 9.9)
SAP's July 14 Patch Day ships 16 notes: a NetWeaver ABAP memory-corruption bug at CVSS 9.9, an Approuter request-smuggling flaw and Commerce Cloud default credentials both at 9.1.
EU + UK ship first joint cyber sanctions on Russia — FSB Centre 16 and Turla named
EU lists 9 individuals + 4 entities under the cyber regime; UK adds 24 more. FSB Centre 16 designated for the Poland grid attempt; ANSSI ties Turla to FSB unit 61240.
Zimbra 10.1.19 patches Classic Web Client stored XSS, TAG-reported
Zimbra shipped Daffodil 10.1.19 on July 7 to fix a stored XSS in the Classic Web Client where a crafted email runs JavaScript in the recipient's mailbox session. Reporter: Google TAG. No CVE assigned.
Two more Joomla extensions hit CISA KEV: iCagenda and Balbooa Forms
CISA added CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) to KEV on July 10. Both unauth file-upload to RCE. Patches: iCagenda 4.0.8/3.9.15, Balbooa Forms 2.4.1.
GhostLock (CVE-2026-43499): 15-year rtmutex UAF gives root on every Linux distro
A use-after-free in the Linux kernel's futex priority-inheritance path, present since May 2011, hands root to any local user. Fixed in mainline commit 3bfdc63936dd; distros started shipping July 9.
Tenda routers ship a hidden backdoor password — CVE-2026-11405 unpatched
CERT/CC disclosed CVE-2026-11405 on July 6: five Tenda firmware images ship a plaintext strcmp() backdoor in /bin/httpd. Tenda didn't respond and no patch is available.
Ubiquiti UniFi Connect CVE-2026-50746 (10.0): SAB-066 lands 25 flaws
Ubiquiti's SAB-066 patches 25 UniFi flaws led by CVE-2026-50746 — an unauthenticated command injection in Connect ≤3.4.16 (CVSS 10.0). Fix ships in Connect 3.4.20.
Two Joomla page-builder RCEs hit CISA KEV, remediation due today
CISA added CVE-2026-48908 (JoomShaper SP Page Builder) and CVE-2026-56290 (Page Builder CK) to KEV on July 7. Both CVSS 10.0, unauth file-upload to RCE. FCEB deadline: July 10.
Gitea CVE-2026-20896: Docker image trusts X-WEBAUTH-USER from anywhere
Gitea's Docker template shipped REVERSE_PROXY_TRUSTED_PROXIES=* — any client can send X-WEBAUTH-USER: admin and impersonate any account. CVSS 9.8. Patched in 1.26.3, skip to 1.26.4.
Microsoft patches Defender RoguePlanet LPE CVE-2026-50656
Microsoft shipped Malware Protection Engine 1.1.26060.3008 on July 9 to close a race condition in mpengine.dll that hands SYSTEM to any local user. Public PoC has been circulating for a month.
Januscape (CVE-2026-53359): 16-year-old KVM UAF escapes VMs on Intel and AMD
A shadow-MMU use-after-free in KVM/x86 lets a root guest reach into the host on Intel VMX and AMD SVM. Stable kernels shipped the fix on July 4; embargo lifted July 6 with a public PoC.
Langflow CVE-2026-55255 IDOR added to CISA KEV, patch to 1.9.2
CISA added the Langflow /api/v1/responses IDOR (CVE-2026-55255, CVSS 9.9) to KEV on July 7. Sysdig first observed exploitation on June 25. Third Langflow flaw to hit KEV in seven months.
Adobe ColdFusion CVE-2026-48282 hits honeypots within hours of writeup
KEVIntel logged in-the-wild exploitation of Adobe ColdFusion CVE-2026-48282 within two hours of watchTowr's July 2 technical writeup. Path traversal → RCE, pre-auth, CVSS 10.
Cisco Catalyst Center CVE-2026-20191: unauth arbitrary file read
Cisco advisory cisco-sa-catc-file-read-wLH2vf8X patches CVE-2026-20191, a CVSS 7.5 pre-auth path traversal in Catalyst Center. Fixed in 3.1.6 GSMU200 and 2.3.7.11-VA GSMU100. No workaround.
Cursor DuneSlide: two critical sandbox escapes in the AI IDE (CVE-2026-50548 / -50549)
Two CVSS 9.3 flaws let a prompt-injected agent write outside Cursor's workspace and reach OS-level RCE. Patched in Cursor 3.0. Credit: Cato AI Labs.
JetBrains Hub ships 2026.1.13757 patching two critical auth-bypass CVEs
JetBrains Hub 2026.1.13757 fixes CVE-2026-50242 (CVSS 10.0 auth bypass) and CVE-2026-56141 (CVSS 9.8 account takeover via predictable restore codes). LTS backports available.
Bad Epoll CVE-2026-46242: Linux epoll race lifts any user to root
A race-condition use-after-free in the Linux kernel epoll subsystem lets an unprivileged process reach root on desktops, servers, and Android. Reported to Google kernelCTF by Jaeyoung Chung.
runZero drops seven FatFs CVEs; only CVE-2026-6684 fixed in R0.16
Seven FatFs bugs disclosed July 1 by runZero — FAT32, exFAT and long-filename paths across ESP-IDF, STM32Cube, Zephyr, MicroPython. Only CVE-2026-6684 has an upstream fix.
Oracle EBS Payments CVE-2026-46817 exploited before any public PoC existed
Defused honeypots caught in-the-wild exploitation of CVE-2026-46817 (CVSS 9.8) on June 27, six weeks after Oracle's May patch. ~950 EBS instances are internet-exposed.
Citrix CTX696604: six NetScaler CVEs, CVE-2026-8451 leaks memory
Citrix's CTX696604 fixes six NetScaler ADC/Gateway CVEs on June 30. CVE-2026-8451, a pre-auth memory overread on the SAML IdP path, echoes CitrixBleed 2. Patch 14.1-72.61 or 13.1-63.18.
CISA adds SharePoint CVE-2026-45659 to KEV, FCEB deadline July 4
CISA added SharePoint RCE CVE-2026-45659 to the KEV catalog on July 1 after confirmed exploitation. Deserialization bug patched OOB May 21; FCEB agencies have three days.
Adobe ships APSB26-68 out of band: 11 ColdFusion CVEs, six at CVSS 10
APSB26-68 fixes 11 ColdFusion CVEs on June 30 — six at CVSS 10, all pre-auth RCE. Priority 1. Patch to 2025.10 or 2023.21 today.
Progress LoadMaster CVE-2026-8037: pre-auth root RCE, PoC-ready diff
Progress patches an unauth pre-auth command-injection RCE in Kemp LoadMaster. CVSS 9.8. GA 7.2.63.2 and LTSF 7.2.54.18 ship the fix; watchTowr posted the full chain on June 29.
OpenAM 16.1.1 patches 10+ CVEs as wodzen coordinated disclosure rolls out
OpenAM 16.1.1 shipped June 17 with fixes for 17 CVEs. Public advisories began June 22 and continued through June 29: pre-auth RADIUS spoof, MSISDN LDAP injection, OAuth2 takeover, Groovy sandbox RCE.
CISA adds SimpleHelp CVE-2026-48558 to KEV after OIDC bypass exploited
CISA added the SimpleHelp OIDC auth bypass (CVSS 10) to KEV on June 29. ~14,000 servers are internet-exposed; 5.5.16 and 6.0 RC2 shipped the fix on June 9.
FBI: Russian intel now phishes Signal Backup Recovery Keys
FBI PSA I-062626-PSA names UNC5792 and UNC4221, attributes the activity to Russian Intelligence Services, and adds a new Signal Backup Recovery Key phishing tactic to the March warning.
Linux pedit COW CVE-2026-46331: page-cache LPE PoC drops in 24h
Researcher Massimiliano Oldani published a working root exploit (packet_edit_meme) for CVE-2026-46331 one day after the kernel.org CVE landed. Ubuntu 18.04–26.04 vulnerable.
macOS.Gaslight: DPRK Rust implant attacks LLM-based malware triage
SentinelLABS named macOS.Gaslight on June 23 — a Rust backdoor whose 3.5 KB prompt-injection payload is built to make an AI triage agent abort the analysis.
Ubiquiti UniFi OS: three chained CVSS 10.0 flaws hit CISA KEV (CVE-2026-34908/34909/34910)
CISA gave federal agencies three days to patch the Bulletin 064 UniFi OS triple — access control bypass, path traversal, command injection — all CVSS 10.0, all exploited.
Linux DirtyClone CVE-2026-43503: working LPE PoC from JFrog
JFrog published a full local-root exploit for the DirtyFrag-family kernel flaw CVE-2026-43503 on June 25. Patched in v7.1-rc5. Container hosts are the priority.
Lantronix EDS5000 CVE-2025-67038 in CISA KEV — patch deadline is today
CISA added the CVSS 9.8 command-injection bug — plus three perfect-10 UniFi OS flaws — to KEV on June 23. BOD 26-04 forces federal patching by June 26.
PTC Windchill CVE-2026-12569 in CISA KEV — federal patch deadline June 28
CISA added the CVSS 10 deserialization RCE in Windchill PDMLink and FlexPLM to KEV on June 25. PTC ships patches, BSI repeats the alarm. Three days to act.
Cisco Unified CM CVE-2026-20230 now drops webshells via Tor
Three weeks after the June 3 patch, Defused honeypots see automated Tor-routed sweeps deploying multi-stage JSP shells via the WebDialer SSRF. Patch alone won't evict them.
Symantec ties new Mistic backdoor to ransomware broker KongTuke
Symantec links a stealth in-memory backdoor used since April 2026 to KongTuke (Woodgnat), the initial-access broker that has fed Interlock, Rhysida, Akira, 8Base and Black Basta.
DifyTap: four cross-tenant flaws hit Dify, one still unpatched
Zafran Security discloses four Dify CVEs (41947–41950). Three patched in 1.14.2; the CVSS-9.4 Plugin Daemon path traversal CVE-2026-41948 remains unfixed at release time.
Squidbleed: 29-year-old Squid FTP gateway leaks heap memory (CVE-2026-47729)
Squid project published SQUID-2026:4 on June 23 — a heap over-read in the FTP gateway that leaks raw memory to a malicious FTP server. Fix in Squid 7.6.
Splunk Enterprise CVE-2026-20253: KEV-listed unauthenticated RCE via PostgreSQL sidecar
CVE-2026-20253 is a CVSS 9.8 missing-authentication flaw in Splunk Enterprise 10. CISA added it to KEV on June 18 with a three-day patch deadline. WatchTowr published a working RCE exploit.
Texas Parks & Wildlife vendor breach hits 3M license holders
TPWD says a third-party license vendor was breached, exposing driver's licenses, passport numbers, emails, phones and addresses for 3M+ hunting and fishing customers. SSNs and financials not affected.
Node.js ships June 18 security release — 12 CVEs across v22, v24, v26
Node.js v22.23.0, v24.17.0 and v26.3.1 fix 12 CVEs including a TLS wildcard hostname bypass (CVE-2026-48618) and a WebCrypto integer overflow DoS (CVE-2026-48933).
Gravity SMTP CVE-2026-4020: API keys leaked, 17M exploit attempts
Wordfence blocked 17M attempts at the unauth REST endpoint that dumps Gravity SMTP's full System Report — live API keys and OAuth tokens included. Patch is 2.1.5.
JetBrains pulls 15 plugins exfiltrating AI API keys, 70K installs
Aikido Security found 15 JetBrains Marketplace plugins under 7 vendor accounts that exfiltrated OpenAI, DeepSeek, and SiliconFlow keys over plaintext HTTP. JetBrains pulled them on June 16, 2026.
SurrealDB 3.1.5 patches five flaws; lead is a HIGH file read
SurrealDB shipped 3.1.5 on June 19, closing five same-day GitHub advisories — including arbitrary file read via DEFINE ANALYZER mapper at CVSS 7.7. No CVE IDs assigned yet.
FortiBleed dumps 73,932 Fortinet firewall creds; CISA orders resets
Researcher Bob Diachenko found an open attacker server holding plaintext admin and SSL VPN credentials for 73,932 FortiGate appliances across 194 countries. CISA issued reset guidance June 18.
NGINX 1.31.2 / 1.30.3 patches HTTP/3 UAF (CVE-2026-42530) and two more
F5 shipped NGINX 1.31.2 and 1.30.3 on June 17 fixing a use-after-free in the HTTP/3 module, a heap overflow in proxy_v2/grpc, and a buffer overread in charset.
Mastra npm scope hijacked: 142 packages backdoored via easy-day-js
Microsoft documents the @mastra npm takeover: 142 packages republished in 88 minutes on June 17 with the easy-day-js typosquat, dropping a cross-platform Node.js infostealer.
Cisco SD-WAN Manager CVE-2026-20262 exploited, KEV-added
Second Cisco Catalyst SD-WAN Manager zero-day in two weeks. CVE-2026-20262 is an arbitrary file write under exploitation; CISA gave agencies until June 29 to patch.
CISA adds JCE Joomla CVE-2026-48907 to KEV — pre-auth RCE, CVSS 10
CISA added CVE-2026-48907 to KEV on June 16 — an unauth profile-import chain in the JCE Joomla extension that lets attackers upload and execute PHP. Patch in JCE 2.9.99.5.
LiteSpeed cPanel CVE-2026-54420 in KEV: symlink path to root, second LiteSpeed cPanel KEV in 3 weeks
CISA added CVE-2026-54420 — a CVSS 8.5 symlink-following bug in the LiteSpeed cPanel plugin — to KEV on June 15. Federal patch deadline: June 18.
Chrome ships fix for V8 zero-day CVE-2026-11645, CISA adds to KEV
Google's June 8 Stable Channel pushes 149.0.7827.102/.103 for an actively exploited V8 out-of-bounds read/write. CISA added the CVE to KEV the next day.
CISA gives feds 3 days to patch Ivanti Sentry CVE-2026-10520
Unauthenticated root RCE in Ivanti Sentry. CVSS 10.0. Shadowserver sees exploitation a day after the patch. CISA KEV deadline is June 14.
Fortinet patches unauth command injection in FortiSandbox (CVE-2026-25089)
Crafted HTTP requests against the FortiSandbox web UI yield OS command execution. CVSS 9.1. No active exploitation reported. Fixed in 5.0.6 and 4.4.9.
Langflow CVE-2026-5027 exploited; fix shipped but unlabelled
VulnCheck added CVE-2026-5027 to its KEV on June 8 after detecting in-the-wild exploitation. Path traversal in /api/v2/files yields unauth RCE; ~7,000 instances are publicly exposed.
Everest Forms Pro CVE-2026-3300 exploited since April 13 to plant rogue admins
Wordfence's firewall blocked 29,300+ exploit attempts against a CVSS 9.8 PHP-eval RCE in Everest Forms Pro. Sites pre-1.9.13 should hunt for the rogue admin diksimarina.
Oracle PeopleSoft zero-day CVE-2026-35273 hits 100+ orgs
Oracle ships an out-of-band Security Alert for an unauthenticated RCE in PeopleTools 8.61/8.62. Mandiant ties exploitation since May 27 to ShinyHunters (UNC6240).
Arista EOS CVE-2026-7473 added to CISA KEV — vendor says no patch coming
Tunnel-decap logic flaw in Arista EOS lets crafted VXLAN/GRE/decap-group packets reach configured decap IPs. Exploited in the wild. Arista will not patch — mitigate with ACLs.
Microsoft June 2026 Patch Tuesday: 3 publicly disclosed zero-days
Microsoft's June 9 Patch Tuesday fixes around 200 CVEs and 33 Critical flaws, including publicly disclosed zero-days in BitLocker, HTTP.sys (HTTP/2 Bomb) and CTFMON.
Veeam patches critical RCE in Backup & Replication (CVE-2026-44963)
An authenticated domain user can run code on a domain-joined VBR backup server. CVSS 9.4. Fixed in 12.3.2.4854; v13 is not affected.
Check Point patches IKEv1 VPN bypass CVE-2026-50751, exploited since May
Check Point hotfixes a CVSS 9.3 cert-validation bypass on Remote Access and Mobile Access VPN. Exploitation since May 7, 2026 — one case linked to a Qilin affiliate.
Linux nf_tables CVE-2026-23111: full LPE chain now public via Exodus
Exodus Intelligence published a complete local root exploit for CVE-2026-23111 — a one-character nf_tables UAF patched upstream Feb 5. Container escape on default distros.
CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV, DoS in the wild
CISA added CVE-2026-28318 — an unauthenticated DoS in SolarWinds Serv-U — to KEV on June 5. CVSS 7.5. Fix is 15.5.4 Hotfix 1. FCEB deadline June 19.
Anthropic patches Claude Code GitHub Action repo-takeover chain
GMO Flatt Security's RyotaK chained a checkWritePermissions bot bypass with prompt injection to hijack any public repo running claude-code-action. Fix shipped in v1.0.94.
Cisco SD-WAN Manager CVE-2026-20245 exploited, no patch yet
Cisco disclosed a command-injection zero-day in Catalyst SD-WAN Manager on June 5. Mandiant credited as reporter. CVSS 7.8, exploitation observed, no fix available.
VS Code github.dev zero-day exposed full GitHub OAuth tokens in one click
Researcher Ammar Askar dropped a webview-postMessage exploit on June 2 that steals github.dev OAuth tokens via a single click. Microsoft shipped a stopgap fix the next day.
CISA adds Oracle WebLogic CVE-2024-21182 to KEV catalog
CISA added the two-year-old Oracle WebLogic auth-bypass CVE-2024-21182 to KEV on June 1, citing active exploitation. Federal agencies have until June 4 to patch.
Android Framework zero-day CVE-2025-48595 added to CISA KEV
Google's June 2026 Android Security Bulletin fixes 124 flaws, including a Framework integer overflow under limited, targeted exploitation. CISA wants federal agencies patched by 5 June.
HTTP/2 Bomb (CVE-2026-49975) drops nginx, Apache, IIS, Envoy
Calif researchers crash 32 GB of Envoy memory in seconds with one connection. nginx 1.29.8 and Apache mod_http2 2.0.41 are patched; IIS, Envoy and Cloudflare Pingora are not.
Red Hat npm packages backdoored: Miasma worm hits @redhat-cloud-services
Red Hat security bulletin RHSB-2026-006 confirms 32 @redhat-cloud-services npm packages were trojaned on June 1, 2026 with a self-spreading credential-stealing worm derived from Shai-Hulud.
Windows Netlogon RCE CVE-2026-41089 now exploited in the wild
Belgium's CCB confirms active exploitation of the CVSS 9.8 Netlogon stack-overflow patched by Microsoft in May. Unauthenticated, no user interaction, domain controller takeover.
CIFSwitch: 19-year-old Linux CIFS bug gives any local user root
Researcher Asim Manizada disclosed CIFSwitch on May 28 — a cifs.spnego upcall flaw that grants root on default Mint, Rocky, AlmaLinux, Kali, and SUSE 15 SP7.
Marimo CVE-2026-39987 RCE chains into LLM-driven post-exploit
Sysdig documents an LLM agent driving post-exploitation after a CVE-2026-39987 Marimo notebook compromise: cloud creds and SSH key pulled in under three minutes.
npm supply-chain campaign: 14 typosquats target AWS, Vault, npm tokens
Microsoft says a single maintainer 'vpmdhaj' pushed 14 typosquatted npm packages on May 28 that exfiltrate AWS, ECS, HashiCorp Vault and npm tokens via a Bun-runtime payload.
Palo Alto GlobalProtect auth bypass (CVE-2026-0257) added to CISA KEV after weeks of exploitation
PAN-OS portals with authentication-override cookies on a shared certificate let attackers forge a valid session. Rapid7 observed exploitation since May 17. Federal patch deadline June 19.
FortiClient EMS bug CVE-2026-35616 now drops EKZ stealer as fake patch
Arctic Wolf says attackers are using the pre-auth FortiClient EMS flaw to push a previously undocumented infostealer disguised as a Fortinet endpoint update.
CISA links GitHub repo exfiltration to malicious Nx Console 18.95.0
CISA's May 28 alert ties the 3,800-repo GitHub breach to a poisoned Nx Console VS Code extension. CVE-2026-48027 is in KEV. Federal deadline June 10.
Gitea CVE-2026-27771: anyone could pull your private container images, no login
An access-control flaw in Gitea's container registry let anonymous clients pull images marked private. Patched in 1.26.2. Forgejo affected too.
Starlette BadHost (CVE-2026-48710): one Host header bypasses auth in FastAPI, vLLM, MCP
X41 D-Sec discloses CVE-2026-48710 in Starlette <1.0.1: a Host-header re-parse desync that lets attackers forge request.url.path. Upgrade to 1.0.1.
KnowledgeDeliver CVE-2026-5426: Mandiant traces RCE to shared ASP.NET keys
Mandiant traces a zero-day in Japan's KnowledgeDeliver LMS to ASP.NET machineKey values reused across customers — enabling unauthenticated ViewState RCE and BLUEBEAM web-shell drops.
CISA flags Langflow CVE-2025-34291: CORS chain yields RCE
CISA added CVE-2025-34291 to the KEV catalog on May 21. An overly permissive CORS plus a misconfigured refresh-token cookie chain to account takeover and code execution in Langflow ≤ 1.6.9.
Ghost CMS SQLi (CVE-2026-26980) hijacks 700+ sites — Harvard, Oxford, DuckDuckGo serve ClickFix
An unauthenticated SQL injection in Ghost's Content API leaks admin API keys. Attackers chain it into stored XSS and a fake Cloudflare ClickFix lure. Upgrade to 6.19.1.
Trend Micro Apex One CVE-2026-34926 exploited; CISA deadline June 4
Trend Micro patches a directory-traversal flaw in the Apex One server after observing in-the-wild exploitation. CISA orders federal agencies to remediate by June 4.
Canvas LMS breach: ShinyHunters claims 275M records; Instructure says it paid for deletion
ShinyHunters exfiltrated 3.65 TB from Instructure's Canvas LMS, defaced login pages at 330 schools, then accepted a payment in exchange for 'returning' the data. The data is still out there.
Drupal patches highly critical SQL injection (CVE-2026-9082) — exploited in the wild within 48h
An unauthenticated SQL injection in Drupal core's database abstraction API affects every PostgreSQL-backed site. Drupal scored it 23/25. Attacks started two days after the patch dropped.
Laravel-Lang Composer packages hijacked — 700+ versions ship a credential stealer
Attackers rewrote Git tags across four Laravel-Lang repos to point at a malicious fork, planting a Composer-autoloaded stealer that runs on every request. Packagist has unlisted the packages.
LiteSpeed cPanel plugin RCE (CVE-2026-48172, CVSS 10.0) actively exploited — any cPanel user can run code as root
A privilege-escalation flaw in the LiteSpeed User-End cPanel plugin lets any cPanel account execute arbitrary scripts as root. Mass scanning began within 72 hours of disclosure.