Tag: attack
-
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Tags: attack, cve, cvss, exploit, flaw, rce, remote-code-execution, threat, vulnerability, wordpressThreat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system.…
-
Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell
The AI-enabled campaign hit two dozen targets, including sites linked to the U.S. government. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/palo-alto-networks-firewalls-compromised-chained-attacks-php2shell/873323/
-
New Framework Puts Ransomware Resilience for AI Systems in Focus
RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/framework-ransomware-resilience-ai/
-
Syrian Electronic Army hacker gets prison time for attacks on Western targets
Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad’s closest advisers. First seen on therecord.media Jump to article: therecord.media/syrian-electronic-army-hacker-sentenced-three-years
-
Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files
Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. NetamLoader malware Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load…
-
Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations
Tags: access, ai, attack, credentials, cyber, cybercrime, exploit, group, hacker, ransomware, sophos, threatThe GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Sophos researchers say the agents moved from credential access to domain administrator with little human involvement. Aur0ra ransomware AI attacks In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation…
-
Syrian Electronic Army hacker gets prison time for attacks on Western targets
Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad’s closest advisers. First seen on therecord.media Jump to article: therecord.media/syrian-electronic-army-hacker-sentenced-three-years
-
SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone
Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone/
-
Cloudflare DDoS Report Shows 18.2 Million Network Attacks in Q3 2026
The Cloudflare DDoS report Q3 2026 reveals 18.2M network attacks, a 208% surge in short-burst floods, and a major shift toward DNS and UDP attacks. First seen on securityonline.info Jump to article: securityonline.info/cloudflare-ddos-report-q3-2026/
-
Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History
Leading cryptocurrency analysts have attributed the cyber-attack to a North Korean elite hacking unit First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/binance-record-hack-crypto-heist/
-
Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/
-
Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/
-
New Kairos DDoS Botnet Hijacks Linux Devices to Overwhelm Servers With Thousands of TCP Connections
Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot for Linux. It turns compromised Linux devices into attack nodes that exhaust a victim’s connection capacity with thousands of idle TCP sessions. Kairos DDoS botnet Honeypot telemetry captured three Kairos builds. They differ only in the hard-coded C2 address and the Go compiler…
-
WordPress 7.1.4 Fixes 22 Security Vulnerabilities, Including RCE Flaw Under Active Attack
WordPress released version 7.1.4 on October 28, 2026, which addresses 22 security vulnerabilities. Among them is an unauthenticated remote code execution flaw that attackers are actively exploiting. Administrators should ensure the update is installed, rather than assuming automatic background updates have completed. The official release documentation details fixes spanning stored cross-site scripting, information disclosure, authorization…
-
WordPress 7.1.4 Fixes 22 Security Vulnerabilities, Including RCE Flaw Under Active Attack
WordPress released version 7.1.4 on October 28, 2026, which addresses 22 security vulnerabilities. Among them is an unauthenticated remote code execution flaw that attackers are actively exploiting. Administrators should ensure the update is installed, rather than assuming automatic background updates have completed. The official release documentation details fixes spanning stored cross-site scripting, information disclosure, authorization…
-
As Russia’s Cyberwar Evolves, Belarus Steps Forward
The FrostyNeighbor advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives. First seen on darkreading.com Jump to article: www.darkreading.com/physical-security/russia-cyber-war-belarus-steps-forward
-
Hackers Launch Over 18 Million DDoS Attacks in Three Months, Cloudflare Reports
In the third quarter of 2026, Cloudflare successfully mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks. This increase indicates a trend among attackers who now favor short, frequent disruptions over large traffic floods. Compared to the same quarter in 2025, this represents a significant 208% rise in the frequency of attacks across Cloudflare’s network. Published…
-
Critical UEFI Flaw Exposes Systems to Pre-Boot Attacks
Attackers Can Exploit ICMP Error Handling Before Operating System Protections Load. A critical buffer overflow in TianoCore’s EDK II UEFI firmware, tracked as CVE-2026-97631, could let unauthenticated attackers execute code during PXE network boot before OS security checks begin, exposing systems to pre-boot compromise despite an upstream source fix. First seen on govinfosecurity.com Jump to…
-
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn’t.There’s a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using…
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ir-trends-q3-2026/
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ir-trends-q3-2026/
-
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/
-
Cyberattack disrupts Belgian tax services before filing deadline
The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin, the country’s main online platform for managing tax and financial affairs. First seen on therecord.media Jump to article: therecord.media/cyberattack-disrupts-belgian-tax-services-before-deadline
-
Closing the loop: Why an effective SOC focuses on remediation, not just containment
By Oliver Spence, CEO, CybaVerse According to a recent report from insurance firm Hiscox, 38 percent of UK organisations have a suffered cyber attack in the last year. The figure is not hugely surprising. Cyber crime is widely recognised as the number one threat to business today. However, what is concerning is that the rate…
-
Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into…
-
NIST Releases New Guidelines to Protect Encryption Against Future Quantum Computer Attacks
Tags: attack, computer, computing, cryptography, cyber, encryption, framework, nist, technology, threat, vulnerabilityThe National Institute of Standards and Technology (NIST) has released finalized guidance to assist organizations in replacing cryptography that is vulnerable to quantum computing before future quantum computers pose a threat to sensitive information. Published on October 27, 2026, the report establishes a framework for migration that includes cryptographic standards, federal deadlines, and implementation priorities.…
-
Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months
Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas. First seen on hackread.com Jump to article: hackread.com/ukrainian-nefilim-hive-affiliate-artem-stryzhak-jailed/
-
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid…
-
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project’s own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October.The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine…
-
11 User Entity Behavior Analytics (UEBA) Tools: The 2026 Buyer’s Verdict Guide
UEBA earns its keep on attacks that look like logins stolen credentials used plausibly, insiders drifting toward exits and fails on unexplainable scores nobody acts on. Roster honesty first: our sheet listed Exabeam and LogRhythm separately, but their merger makes them one company, so this is an eleven-vendor verdict guide spanning SIEM-embedded analytics, standalone timelines,…