Tag: attack
-
Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
Citrix has released emergency security updates for NetScaler ADC and NetScaler Gateway after confirming active exploitation of two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772. Both bugs have a CVSS v4.0 score of 9.5 and can enable remote code execution (RCE) against vulnerable customer-managed appliances. The flaws are part of a wider set of eight vulnerabilities…
-
Citrix confirms two NetScaler RCE zero-days exploited in attacks
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
-
Citrix admins warned to shut down NetScalers over 2 exploited zero-days
Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
-
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/
-
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex.The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users.”The attack chain begins with a fake CAPTCHA page and First seen on…
-
ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks
ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor. First seen on hackread.com Jump to article: hackread.com/shinyhunters-bypass-waf-rules-oracle-peoplesoft-attacks/
-
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend after it received threat intelligence about an imminent cyber attack.”Kiteworks received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems,” said Frank Balonis, Chief…
-
Roundcube Webmail Under Attack: 523,000 Instances Exposed Online
Roundcube CVE-2026-48842 is being actively exploited, with more than 523,000 Roundcube instances still exposed on the internet. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-roundcube-cve-2026-48842-active-exploitation/
-
Kiteworks urges 6-hour server shutdown over potential zero-day attacks
Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/kiteworks-urges-6-hour-server-shutdown-over-potential-zero-day-attacks/
-
Army soldier sentenced for spree of attacks on ATT, Snowflake and other major companies
Tags: attackCameron Wagenius was involved in some of the most high-profile attacks of 2024 while on active duty. First seen on cyberscoop.com Jump to article: cyberscoop.com/cameron-wagenius-att-snowflake-attacks-sentenced/
-
Army soldier sentenced for spree of attacks on ATT, Snowflake and other major companies
Tags: attackCameron Wagenius was involved in some of the most high-profile attacks of 2024 while on active duty. First seen on cyberscoop.com Jump to article: cyberscoop.com/cameron-wagenius-att-snowflake-attacks-sentenced/
-
Expecting cyber attack, Kiteworks tells users to turn off servers
An as-yet undisclosed zero-day vulnerability has prompted managed file transfer provider Kiteworks to tell users to preemptively switch off their servers. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651301/Expecting-cyber-attack-Kiteworks-tells-users-to-turn-off-servers
-
WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution
Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do. The post WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-wordpress-cve-2026-87902-active-exploitation/
-
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
Tags: adobe, attack, authentication, cisa, cybersecurity, exploit, flaw, hacker, infrastructure, software, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/
-
Zero-Days, AI Agents, and Identity Attacks Define Cybersecurity Week
Weekly summary of Cybersecurity Insider newsletters First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/weekly-roundup/zero-days-ai-agents-and-identity-attacks-define-cybersecurity-week/
-
Cyber-attack on Dyfed-Powys police ‘may have accessed staff information’
Welsh force says incident disrupted ‘some non-emergency systems’ and public data was not affectedA police force in Wales has said staff information may have been “accessed or compromised” in a cyber-attack.Dyfed-Powys police, which has more than 2,000 officers and civilian staff, said it was hacked on 14 September in an incident that disrupted “some non-emergency…
-
The SOC Doesn’t Need to Start Over with Every Alert
Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry.The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead…
-
Attackers build “silent” cryptominer on victim’s machine and give themselves away
Security researchers at Huntress have uncovered an unusual attack in which a threat actor compiled a cryptocurrency miner directly on a victim’s computer, rather than simply dropping a ready-made one, and in doing so generated so much activity that the intrusion stood out. The incident began in early September 2026 with the exploitation of CVE-2025-4632,…
-
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection
Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form. The attack does not require a Salesforce login or a click from the victim and could leak data via DNS…
-
Russia’s Hybrid Cyber-Physical War in Europe Heats Up
A storm is raging in the form of cyber sabotage, disinformation, and drone attacks on European nations, particularly those that provide material support to Ukraine. First seen on darkreading.com Jump to article: www.darkreading.com/physical-security/russia-hybrid-cyber-physical-war-europe
-
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Tags: adobe, api, attack, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-5430 (CVS score: 9.8) – A path traversal vulnerability in WSO2 API Control Plane, First…
-
Your incident count is missing a few incidents
If you run security for a brand with hundreds or thousands of locations, the tools you’ve bought may have little to do with whether an attack stays at one store. A new … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/25/eu-usa-retail-chain-cyberattacks/
-
Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks
U.S. Sens. Mark Warner (D-VA) and Ted Cruz (R-TX) introduced the Telecommunications Cybersecurity and Resilience Act on Thursday, arguing that the new effort was necessary in light of the Salt Typhoon attacks which saw Chinese hackers breach nearly all of the major telecommunications giants in the U.S. First seen on therecord.media Jump to article: therecord.media/lawmakers-introduce-bill-for-voluntary-telecom-cyber-rules
-
Building AI Systems With ‘Least Capability’ Cuts Agent Risk
Akamai CTO Robert Blumofe on Reliability, Visibility and AI Security. AI systems that perform well in the lab can fail at scale, drive unexpected costs and expose new attack paths in production. Robert Blumofe, executive vice president and CTO at Akamai, says enterprises need stronger visibility, reliability engineering and a least capability model for AI…
-
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before.That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts…
-
AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS
MikroTrick chains two RouterOS flaws to bypass authentication and gain admin access. AI helped researchers uncover the attack chain within days. MikroTik pushed out patches on September 3, 2026 for several RouterOS issues at once, calling it an important security update without saying what it actually fixed. That silence was deliberate, and it didn’t last…
-
3 Cyber Threats That Defined the Summer of 2026
This installment of the Reporters’ Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife’s ransomware attack, and Iranian-linked threat actors compromising a dozen US water systems. It was a busy summer. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/3-cyber-threats-defined-summer-2026
-
Kyiv internet providers report major outages after Russian attacks damage data centers
At least four internet providers serving Kyiv and other parts of Ukraine suffered partial connectivity losses following Wednesday’s drone attack, according to internet monitoring group NetBlocks. First seen on therecord.media Jump to article: therecord.media/kyiv-internet-providers-report-outages-after-russian-strikes
-
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/
-
Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks
Tags: attack, authentication, cve, cvss, cyber, exploit, flaw, hacker, rce, remote-code-execution, update, vpn, vulnerability, zero-dayCheck Point has warned customers about the active exploitation of two critical vulnerabilities in its VPN gateway and Security Management products: CVE-2026-85102 and the newly disclosed CVE-2026-93616. Both vulnerabilities have a CVSS score of 9.8 and allow for pre-authentication attacks, making immediate patching and reducing exposure essential. Check Point Flaws CVE-2026-85102 is an improper certificate-validation…