Sitemap
All pages on Hacker Posts.
Home
Newsroom
- Browsers block 8 compromised eMudhra intermediate CA keys
- PHP ships emergency release for two critical flaws (CVSS 9.2)
- FBI, CISA detail SafePay ransomware: 600+ victims since 2024
- TeamUpdraft breach exposes UpdraftCentral keys to takeover
- Ahold Delhaize takes systems offline after cyberattack
- Citizen Lab confirms Pegasus on Belgrade rector's iPhone
- FortiSIEM CVE-2026-106173: unauth RCE, PoC public, patch now
- Go blocks eight CA keys in emergency 1.27.3/1.26.10 update
- Nikkei breach exposes 1.83M records via a dev system
- OVHcloud CLI releases backdoored on GitHub to steal secrets
- ROMULUS: a ClickFix delivery platform pushing LegionLoader
- Symantec: Swallowtail (APT28) hit NATO naval shipbuilder
- Zeabur shuts down after second breach hits 321,810 accounts
- Fake 'Apex' Web3 accelerator seeds npm malware, hijacks AI agents
- Stolen login exposes California student records at ETS
- PeerStitch implant hid in FortiGate after FortiJump breach
- GhostAction hides a credential stealer in a fake font file
- OpenCode breach may have exposed users' AI provider keys
- Plex2Shell chain exploited within a day of public PoC
- Rank Math PRO 3.0.123 shipped a self-restoring backdoor
- Siemens Software Center flaw abused in ClickFix attacks
- Anne Arundel County confirms breach; Rhysida claims 2.6TB
- Backdoored open-weight model exfiltrates secrets on a trigger
- SiteGuard WAF command injection CVE-2026-106931 exploited for root
- UAT-11985 phishes Taiwan researchers with Google AitM kit
- Burger King Japan breach exposes 11.18M app member records
- Collabora CODE RCE hits Nextcloud: CVE-2026-110447 exploited
- ConnectWise Cloud Backup credential abused in M365 attacks
- Russia reportedly detains DataSuckers extortion suspects
- MALFEX npm campaign resurfaces with imgdecode loader
- Public PoC roots OpenBSD 7.9 via a 37-year-old shmat bug
- Unit 42 details PEERSTITCH, a memory-only FortiGate implant
- Adobe patches CVSS 10 Magento RCE (CVE-2026-103849)
- AOMEI Backupper update servers hijacked to push a backdoor
- BAE security incident halts US bankruptcy court notices
- BeyondTrust patches Remote Support zero-day exploited since August
- Proxyware crew hijacks D-Link, Ubiquiti, SAP via old CVEs
- UK Legal Aid breach wider than first said, records to 1978
- Fake Arch AUR packages impersonate yay and paru, run as root
- Candiru spyware reached Al Jazeera through zero-click ads
- CenterPoint Energy breach hits 1M+ Texans, utility confirms
- Drupal patches critical Field UI RCE reachable via modules
- Langflow MCP stdio RCE exploited in the wild, fix in 1.9.0
- Next.js ships out-of-band fix for two critical RCE flaws
- NGINX fixes five flaws, including a TLS client-cert bypass
- OLVX marketplace admin charged in North Macedonia
- Palo Alto patches exploited PAN-OS RCE CVE-2026-0322
- UAT-6275 weaponizes WinRAR CVE-2025-8088 against CIS governments
- Cisco patches exploited Secure Email Gateway root RCE
- curl patches HTTP/2 use-after-free that a PoC turned into RCE
- DOJ charges 14 over North Korean IT-worker laptop farms
- FTC sues Digital Forensics Corp over $60M sextortion-help fraud
- Ghostscript RCE via crafted PDF patched (CVE-2026-39919)
- Hirudo Android trojan swaps real banking apps for patched copies
- Linux vhost bug CVE-2026-74580 gives local root and a VM escape
- Microsoft, Health-ISAC seize domains behind 1B phishing messages
- Nextcloud Collabora CODE RCE CVE-2026-110447 exploited
- OpenAI engineer arrested over hidden office recording device
- Ahold Delhaize takes systems offline after cyberattack
- Docker Hub CVE-2026-105445 let tokens impersonate repo owners
- GitHub hardens npm trusted publishing after SlugFest flaw
- Ivanti Connect Secure zero-days chained for root on patched VPN
- LG webOS TVs: pre-auth root chain from the local network, no CVE yet
- MarkLogic patches 31 flaws, 5 critical: privileged users can seize admin
- Microsoft's October Patch Tuesday fixes 1,411 flaws, one exploited
- Midnight Mimosa: preinstalled malware on cheap Android phones, 150+ countries
- SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0)
- Norway fines Microsoft's Xandr 92M NOK over Grindr RTB data
- Bricksforge WordPress plugin RCE exploited within days (CVE-2026-85097)
- SOCRadar: 'CyberXero' wired AI agents into a Ukraine access-broker campaign
- Danfoss controllers hijacked in French supermarket fridge attack
- GitLab patches CVSS 10.0 unauthenticated RCE in CI/CD regex compiler (CVE-2026-97229)
- Ledger confirms hardware implant in reseller-sold wallet amid theft reports
- Let's Encrypt moves to 64-day certificates by default in 2027
- Contractor malware exposes 8.7M Daiichi Kosho karaoke records
- iRhythm breach notices put patient data theft at 360,000+
- P7 DarkSword iOS exploit kit adds keychain, crypto-wallet theft
- AhsayCBS unauth RCE (CVE-2026-105134) exploited, no patch yet
- Anthropic cuts internet from internal evals after agent misuse
- AnyDesk Linux pre-auth root RCE gets public exploit, no CVE
- Citrix patches critical NetScaler SAML flaw CVE-2026-107406
- Fake Claude installers ride Google ads through Bing redirects
- Krebs names ShinyHunters arrest as a ransomware negotiator
- GhostAction supply-chain attack returns, hits 340+ repos
- Engineer gets 32 months for locking out his own employer
- SonicWall SMA1000 pre-auth SSRF CVE-2026-102255 scores 10.0
- South Korean banks breached with AI agents, CrowdStrike says
- YMCO leader pleads guilty to running 15,000 money mules
- AhsayCBS zero-days exploited to drop web shells and XMRig
- US seizes Flax Typhoon tools, adds five flaws to CISA KEV
- Germany jails alleged Qilin ransomware core member
- FBI arrests another ShinyHunters suspect over FBIjobs breach
- ASOS app hijacked to push Snowflake extortion message
- Atlassian patches critical file-read flaw CVE-2026-21589
- ClickFix campaign hits 100+ Ukrainian sites with Lunex stealer
- Denmark CPR register breach exposes 8.8 million people
- FBI blames contractor's missed patch for ShinyHunters breach
- LibreOffice RCE via JDBC runs code with no macro warning
- MALFEX npm campaign ran 3 years, hit 40,000 downloads
- Wikimedia reports rogue OpenAI agents editing wikis, probing Etherpad
- Ukraine grocery giant ATB confirms breach; DataSuckers extorts
- Citrix patches exploited NetScaler SAML zero-day (CVE-2026-88779)
- Cling botnet hides C2 in STUN traffic, spreads via Realtek SDK flaw
- Dell System Update CVE-2026-86360: root RCE on PowerEdge
- Denmark CPR register breach exposes 8.8 million people
- Google pauses OSS bug bounty submissions over AI-generated spam
- Exchange flaw CVE-2026-96940 lets users read colleagues' mail
- Alleged Ploutus ATM malware developer appears in US court
- Rejetto HFS session-forgery flaw (CVE-2026-61500) under attack
- Booba ransomware hits UIC College of Medicine, 344GB claimed
- DTU breach exposes CPR numbers on up to 200,000 people
- Proofpoint: TA419 phishes US AI policy circles via BitB OneDrive
- Fortra patches critical BoKS flaws: unauth RCE and AD bypass
- MI5 names CGTRI as MSS front, warns 100+ UK academics
- US court dismisses El Faro Pegasus suit against NSO Group
- ShinyHunters member 'Rey' detained in Jordan, aiding FBI
- CloudSyncD: fake Zoom installer backdoors macOS, steals passwords
- Dell CSM: two CVSS 10 auth-bypass flaws, patch to 1.18.0
- FortiMail zero-day CVE-2026-104286 exploited; CISA sets Oct 4
- Frontline Education breach exposes school district employee SSNs
- GitLab patches 9.9 RCE in self-hosted AI Gateway (CVE-2026-90970)
- Alleged Mabna hacker Amir Barati extradited to US from Montenegro
- Microsoft's X account hijacked in $Clippy crypto pump-and-dump
- AI agents fired SQLi probes at US, Canada gov sites: Transluce
- Vicksburg, Mississippi shuts down city systems after ransomware
- Warlock ransomware hits critical infrastructure via SharePoint
- Fakturownia breach exposes data on Polish invoicing platform
- Truffle: 543,699 live credentials sitting in public GitHub repos
- KillSec ransomware leak site seized in Operation KillSwitch
- Kiteworks patches max-severity RCE in Email Protection Gateway
- MetaMask exits Lido validators after staking-infrastructure incident
- OFAC sanctions Ploutus ATM-malware network behind $40M theft
- OpenAI disrupts model-distillation campaign extracting reasoning
- Pentagon DMDC breach exposes data on 3 million people
- WordPress 'SC' malware self-heals via eight footholds, blockchain C2
- Talos: China-nexus UAT-11587 hits Asian governments with Antino
- Zammad zero-days (CVE-2026-102489/102490) chained to root; patch now
- Bitget blames $387M crypto theft on zero-days in security appliances
- Malicious custom GPT 'Plus 5.6' funnels users into ClickFix RAT
- Cisco patches exploited SD-WAN Manager auth bypass (CVE-2026-76504)
- France's DGFiP breach: 350k+ people hit via stolen passwords
- Kiteworks patches critical Advanced Forms flaw in release 9.5.1
- Microsoft Entra ID to enforce CSP, blocking sign-in script injection
- CISA flags pre-auth root RCE in MikroTik RouterOS (CVE-2026-84411)
- OpenSSL patches DTLS heap-disclosure flaw CVE-2026-84782
- Star Blizzard hits 100+ orgs with RedFlick, CosmicPulse backdoor
- TeamViewer patches CVE-2026-92370 access-control bypass (CVSS 8.8)
- WatchGuard patches critical Fireware OS RCE (CVE-2026-86131)
- Apple patches exploited CoreGraphics zero-day (CVE-2026-86950)
- Citrix patches exploited NetScaler zero-days (CVE-2026-88771, CVSS 9.5)
- 101 npm packages abuse Baileys to hijack WhatsApp accounts (PhantomSub)
- Spectre-v2 BTR attack leaks Linux root hash on patched Intel CPUs
- Estée Lauder confirms Oracle EBS zero-day breach in Cl0p campaign
- Arctic Wolf ties CVE-2026-0257 GlobalProtect bypass to Qilin ransomware
- ServiceNow CVE-2026-6875: pre-auth sandbox escape RCE now exploited
- Windows VMSwitch CVE-2026-57092: CVSS 9.9 guest-to-host escape in Hyper-V
- Zimbra 10.1.20 patches critical command injection plus three CVEs
- FortiSandbox: CVE-2026-25089 and CVE-2026-39808 land in KEV, exploited
- AD FS zero-day CVE-2026-56155: Microsoft DART finds DKM ACL bug already exploited
- WordPress patches wp2shell pre-auth RCE in 7.0.2 and 6.9.5
- Zoom Workplace on Windows: CVE-2026-53412 lets a network attacker take an account
- LegacyHive drops Windows profsvc zero-day PoC after Patch Tuesday
- SonicWall SMA1000 zero-days chained: CISA adds CVE-2026-15409 and 15410 to KEV
- CISA adds SharePoint CVE-2026-56164 to KEV, chained with two prior bugs
- SonicWall SMA1000 CVE-2026-15409/15410 chained in the wild, KEV
- SAP patches NetWeaver ABAP memory corruption (CVE-2026-44747, CVSS 9.9)
- EU + UK ship first joint cyber sanctions on Russia — FSB Centre 16 and Turla named
- Zimbra 10.1.19 patches Classic Web Client stored XSS, TAG-reported
- Two more Joomla extensions hit CISA KEV: iCagenda and Balbooa Forms
- GhostLock (CVE-2026-43499): 15-year rtmutex UAF gives root on every Linux distro
- Tenda routers ship a hidden backdoor password — CVE-2026-11405 unpatched
- Ubiquiti UniFi Connect CVE-2026-50746 (10.0): SAB-066 lands 25 flaws
- Two Joomla page-builder RCEs hit CISA KEV, remediation due today
- Gitea CVE-2026-20896: Docker image trusts X-WEBAUTH-USER from anywhere
- Microsoft patches Defender RoguePlanet LPE CVE-2026-50656
- Januscape (CVE-2026-53359): 16-year-old KVM UAF escapes VMs on Intel and AMD
- Langflow CVE-2026-55255 IDOR added to CISA KEV, patch to 1.9.2
- Adobe ColdFusion CVE-2026-48282 hits honeypots within hours of writeup
- Cisco Catalyst Center CVE-2026-20191: unauth arbitrary file read
- Cursor DuneSlide: two critical sandbox escapes in the AI IDE (CVE-2026-50548 / -50549)
- JetBrains Hub ships 2026.1.13757 patching two critical auth-bypass CVEs
- Bad Epoll CVE-2026-46242: Linux epoll race lifts any user to root
- runZero drops seven FatFs CVEs; only CVE-2026-6684 fixed in R0.16
- Oracle EBS Payments CVE-2026-46817 exploited before any public PoC existed
- Citrix CTX696604: six NetScaler CVEs, CVE-2026-8451 leaks memory
- CISA adds SharePoint CVE-2026-45659 to KEV, FCEB deadline July 4
- Adobe ships APSB26-68 out of band: 11 ColdFusion CVEs, six at CVSS 10
- Progress LoadMaster CVE-2026-8037: pre-auth root RCE, PoC-ready diff
- OpenAM 16.1.1 patches 10+ CVEs as wodzen coordinated disclosure rolls out
- CISA adds SimpleHelp CVE-2026-48558 to KEV after OIDC bypass exploited
- FBI: Russian intel now phishes Signal Backup Recovery Keys
- Linux pedit COW CVE-2026-46331: page-cache LPE PoC drops in 24h
- macOS.Gaslight: DPRK Rust implant attacks LLM-based malware triage
- Ubiquiti UniFi OS: three chained CVSS 10.0 flaws hit CISA KEV (CVE-2026-34908/34909/34910)
- Linux DirtyClone CVE-2026-43503: working LPE PoC from JFrog
- Lantronix EDS5000 CVE-2025-67038 in CISA KEV — patch deadline is today
- PTC Windchill CVE-2026-12569 in CISA KEV — federal patch deadline June 28
- Cisco Unified CM CVE-2026-20230 now drops webshells via Tor
- Symantec ties new Mistic backdoor to ransomware broker KongTuke
- DifyTap: four cross-tenant flaws hit Dify, one still unpatched
- Squidbleed: 29-year-old Squid FTP gateway leaks heap memory (CVE-2026-47729)
- Splunk Enterprise CVE-2026-20253: KEV-listed unauthenticated RCE via PostgreSQL sidecar
- Texas Parks & Wildlife vendor breach hits 3M license holders
- Node.js ships June 18 security release — 12 CVEs across v22, v24, v26
- Gravity SMTP CVE-2026-4020: API keys leaked, 17M exploit attempts
- JetBrains pulls 15 plugins exfiltrating AI API keys, 70K installs
- SurrealDB 3.1.5 patches five flaws; lead is a HIGH file read
- FortiBleed dumps 73,932 Fortinet firewall creds; CISA orders resets
- NGINX 1.31.2 / 1.30.3 patches HTTP/3 UAF (CVE-2026-42530) and two more
- Mastra npm scope hijacked: 142 packages backdoored via easy-day-js
- Cisco SD-WAN Manager CVE-2026-20262 exploited, KEV-added
- CISA adds JCE Joomla CVE-2026-48907 to KEV — pre-auth RCE, CVSS 10
- LiteSpeed cPanel CVE-2026-54420 in KEV: symlink path to root, second LiteSpeed cPanel KEV in 3 weeks
- Chrome ships fix for V8 zero-day CVE-2026-11645, CISA adds to KEV
- CISA gives feds 3 days to patch Ivanti Sentry CVE-2026-10520
- Fortinet patches unauth command injection in FortiSandbox (CVE-2026-25089)
- Langflow CVE-2026-5027 exploited; fix shipped but unlabelled
- Everest Forms Pro CVE-2026-3300 exploited since April 13 to plant rogue admins
- Oracle PeopleSoft zero-day CVE-2026-35273 hits 100+ orgs
- Arista EOS CVE-2026-7473 added to CISA KEV — vendor says no patch coming
- Microsoft June 2026 Patch Tuesday: 3 publicly disclosed zero-days
- Veeam patches critical RCE in Backup & Replication (CVE-2026-44963)
- Check Point patches IKEv1 VPN bypass CVE-2026-50751, exploited since May
- Linux nf_tables CVE-2026-23111: full LPE chain now public via Exodus
- CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV, DoS in the wild
- Anthropic patches Claude Code GitHub Action repo-takeover chain
- Cisco SD-WAN Manager CVE-2026-20245 exploited, no patch yet
- VS Code github.dev zero-day exposed full GitHub OAuth tokens in one click
- CISA adds Oracle WebLogic CVE-2024-21182 to KEV catalog
- Android Framework zero-day CVE-2025-48595 added to CISA KEV
- HTTP/2 Bomb (CVE-2026-49975) drops nginx, Apache, IIS, Envoy
- Red Hat npm packages backdoored: Miasma worm hits @redhat-cloud-services
- Windows Netlogon RCE CVE-2026-41089 now exploited in the wild
- CIFSwitch: 19-year-old Linux CIFS bug gives any local user root
- Marimo CVE-2026-39987 RCE chains into LLM-driven post-exploit
- npm supply-chain campaign: 14 typosquats target AWS, Vault, npm tokens
- Palo Alto GlobalProtect auth bypass (CVE-2026-0257) added to CISA KEV after weeks of exploitation
- FortiClient EMS bug CVE-2026-35616 now drops EKZ stealer as fake patch
- CISA links GitHub repo exfiltration to malicious Nx Console 18.95.0
- Gitea CVE-2026-27771: anyone could pull your private container images, no login
- Starlette BadHost (CVE-2026-48710): one Host header bypasses auth in FastAPI, vLLM, MCP
- KnowledgeDeliver CVE-2026-5426: Mandiant traces RCE to shared ASP.NET keys
- CISA flags Langflow CVE-2025-34291: CORS chain yields RCE
- Ghost CMS SQLi (CVE-2026-26980) hijacks 700+ sites — Harvard, Oxford, DuckDuckGo serve ClickFix
- Trend Micro Apex One CVE-2026-34926 exploited; CISA deadline June 4
- Canvas LMS breach: ShinyHunters claims 275M records; Instructure says it paid for deletion
- Drupal patches highly critical SQL injection (CVE-2026-9082) — exploited in the wild within 48h
- Laravel-Lang Composer packages hijacked — 700+ versions ship a credential stealer
- LiteSpeed cPanel plugin RCE (CVE-2026-48172, CVSS 10.0) actively exploited — any cPanel user can run code as root