Tag: attack
-
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization’s SD-WAN network.The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical…
-
CISA Warns of Active Attacks Exploiting Critical Node2Shell RCE Vulnerability in Node.js
CISA has added CVE-2026-111497, a critical vulnerability in Google Brotli that affects Node.js, to its Known Exploited Vulnerabilities catalog following confirmed evidence of exploitation. Added on October 27, 2026, this flaw allows unauthenticated attackers to corrupt memory, disrupt services, disclose sensitive information, or potentially execute arbitrary code through maliciously crafted compressed streams. Federal agencies have…
-
Cloudflare Image Transformation Flaw Allows Hackers to Bypass CSP and Execute Malicious JavaScript
Security researchers have demonstrated an attack chain against Cloudflare’s Image Transformations service that bypasses SVG sanitization and Content Security Policy (CSP), enabling malicious JavaScript execution on a targeted website’s origin. Published on October 28, 2026, the research combines an XML serialization flaw, Chromium cache behavior, and redirects that circumvent image source restrictions. Exploitation depends on…
-
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
Tags: attack, china, crowdstrike, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, threat, vmware, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.The vulnerability in question is CVE-2026-41709 (CVSS…
-
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
Tags: attack, china, crowdstrike, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, threat, vmware, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.The vulnerability in question is CVE-2026-41709 (CVSS…
-
Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail
Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for…
-
Stolen staff logins are spreading attacks between K-12 school districts
Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/cis-k-12-cybersecurity/
-
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 2728. The published agenda also covered hypervisor exploitation, Windows privilege escalation, Linux kernel techniques, and AI-assisted security research. However, session titles alone do not indicate…
-
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
The supply chain attack campaign’s shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github
-
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/
-
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Tags: ai, attack, breach, china, cybersecurity, data-breach, exploit, government, intelligence, network, threat, vulnerabilityCybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root First seen…
-
Japan’s GMO Internet Urges Customers to Disconnect PCs
GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/japan-gmo-internet-disconnect/
-
Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems
A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/hive-ransomware-jailed-fbi-infiltrated
-
Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator
A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/doj-ukrainian-ransomware-hacker-sentenced/
-
Fake AI Attacks Target US Firms as Researchers Warn of Corporate Credential Theft
ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data. First seen on hackread.com Jump to article: hackread.com/fake-ai-attacks-target-us-firms-credential-theft/
-
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Tags: access, attack, authentication, business, cloud, corporate, credentials, data-breach, phishing, serviceModern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.ANY.RUN’s analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations First seen on thehackernews.com Jump to…
-
Nefilim and Hive ransomware affiliate gets 70 months in prison
A Ukrainian national was sentenced to 70 months in prison for his role in ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nefilim-and-hive-ransomware-affiliate-gets-70-months-in-prison/
-
AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft
Tags: ai, attack, credentials, cyber, cybersecurity, data-breach, hacker, intelligence, theft, threat, toolThreat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures. The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts. The research follows Japan’s National Cybersecurity…
-
AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft
Tags: ai, attack, credentials, cyber, cybersecurity, data-breach, hacker, intelligence, theft, threat, toolThreat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures. The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts. The research follows Japan’s National Cybersecurity…
-
Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first,…
-
Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first,…
-
Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first,…
-
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
Tags: adobe, attack, breach, cve, cybersecurity, exploit, google, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google’s Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in First seen on thehackernews.com…
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
Japan’s GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
-
SBOMs Alone Can’t Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/sboms-alone-scope-supply-chain-attack
-
UNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/
-
Italy ‘s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters
Italy ‘s Parliament cyberattack highlights hybrid warfare risks and the need for transparency, stronger defenses and accountability. The cyberattack targeting email accounts at Italy’s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face…