Tag: exploit
-
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation, Patch Released
Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild.The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard.”Use-after-free in Dawn in Google Chrome prior…
-
Ransomware Groups Exploit Legit IT Tools to Bypass Antivirus
New research from Seqrite explains the ‘dual-use dilemma,’ where ransomware attackers repurpose legitimate IT tools like IOBit Unlocker… First seen on hackread.com Jump to article: hackread.com/ransomware-groups-exploit-it-tools-bypass-antivirus/
-
Google Warns of New Chrome Zero-Day Under Active Exploitation Users Urged to Update Immediately
Google has released an urgent security update for its Chrome desktop browser to address 21 vulnerabilities, including a critical zero-day flaw that is actively being exploited in the wild. Users are strongly urged to update their browsers immediately to version 146.0.7680.177/.178 for Windows and Mac, or 146.0.7680.177 for Linux . Active Zero-Day Threat The most…
-
Gigabyte Control Center: Schadcode-Lücke in verbreitetem Hardware-Steuertool
Viele Nutzer mit Gigabyte-Hardware verwenden das Gigabyte Control Center. Eine Lücke darin lässt Angreifer unter anderem Schadcode einschleusen. First seen on golem.de Jump to article: www.golem.de/news/gigabyte-control-center-schadcode-luecke-in-verbreitetem-hardware-steuertool-2604-207159.html
-
Zero-Day-Schwachstelle in abgehärteten Videokonferenz-Tool Trueconf
Check Point Research (CPR) hat eine bisher unbekannte Zero-Day-Sicherheitslücke in der Videokonferenz-Software <> aufgedeckt. Wie die Sicherheitsforscher von Check Point Software Technologies herausfanden, konnten Angreifer vertrauenswürdige, lokal installierte Software-Updates missbrauchen. Sie verbreiteten so unbemerkt Malware in mehreren südostasiatischen Behörden und Regierungsapparaten. Die Täter mussten also weder auf Phishing, also den Diebstahl von Anmeldedaten, noch auf Exploits…
-
A Taxonomy of Cognitive Security
Last week, I listened to a fascinating talk by K. Melton on cognitive security, cognitive hacking, and reality pentesting. The slides from the talk are here, but”, even better”, Menton has a long essay laying out the basic concepts and ideas. The whole thing is important and well worth reading, and I hesitate to excerpt.…
-
Google Chrome Update Fixes 21 Flaws, Warns of Actively Exploited Vulnerability
Google has released a Stable Channel Update for Chrome, addressing 21 security vulnerabilities, including a high-profile code smuggling vulnerability that is actively being exploited in the wild. The update rolled out on Wednesday night. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/chrome-stable-channel-update-security/
-
Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281)
Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. About CVE-2026-5281 As per usual, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/01/google-chrome-zero-day-cve-2026-5281/
-
Google fixes fourth Chrome zero-day exploited in attacks in 2026
Google has fixed the fourth Chrome vulnerability exploited in zero-day attacks since the start of the year. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-fixes-fourth-chrome-zero-day-exploited-in-attacks-in-2026/
-
Hackers Exploit Hotel Booking Systems to Send Fake Payment Requests to Guests
Hackers are increasingly targeting hotel booking workflows to trick travelers into handing over payment details, using a technique that blends real reservation data with convincing social engineering. The message references real booking details such as the hotel name, stay dates, or payment status making it appear legitimate. Instead of raising suspicion, the message feels like…
-
Vim und Emacs: Claude liefert auf Zuruf gefährliche Schadcode-Exploits
Tags: exploitForscher haben Claude mit Fake-Gerüchten dazu verleitet, Exploit-Code für bisher unbekannte Sicherheitslücken in Vim und Emacs zu generieren. First seen on golem.de Jump to article: www.golem.de/news/vim-und-emacs-claude-liefert-auf-zuruf-gefaehrliche-schadcode-exploits-2604-207151.html
-
PoC Exploit Code Published for nginx-ui Backup Restore Security Flaw
A critical security flaw in the nginx-ui backup restore mechanism, tracked as CVE-2026-33026, allows attackers to manipulate encrypted backups and execute arbitrary commands. Proof-of-Concept (PoC) exploit code has been publicly released, prompting an urgent need for administrators to update to version 2.3.4. Backup Integrity Bypass Flaw The vulnerability stems from a circular trust model where…
-
Schadcode per Klick: Attackierte Chrome-Lücke gefährdet Millionen von Nutzern
In Google Chrome klafft eine Sicherheitslücke, mit der sich per Webseitenaufruf Schadcode einschleusen lässt. Angreifer nutzen das bereits aus. First seen on golem.de Jump to article: www.golem.de/news/schadcode-per-klick-attackierte-chrome-luecke-gefaehrdet-millionen-von-nutzern-2604-207143.html
-
Darksword: Apple bringt Exploit-Patch für weitere iPhones
Wer nicht auf iOS 26 aktualisieren will und weiter iOS 18 verwendet, ist bisher vor dem Darksword-Exploit ungeschützt gewesen. First seen on golem.de Jump to article: www.golem.de/news/darksword-apple-bringt-exploit-patch-fuer-weitere-iphones-2604-207142.html
-
TrueConf Vulnerability Under Active Exploitation in Southeast Asia Government Attacks
Check Point Research has discovered a critical zero-day vulnerability in the TrueConf video conferencing client. Tracked as CVE-2026-3502 with a CVSS score of 7.8, this flaw is currently being exploited in targeted attacks against government entities in Southeast Asia. Dubbed >>Operation TrueChaos,<< the campaign uses the application's trusted update system to deliver the Havoc post-exploitation…
-
LeakNet Changes Tactics, But Consistency Gives Defenders an Advantage
LeakNet may be expanding its reach and scaling up, changing techniques and running campaigns directly, but the ransomware operator’s use of a repeatable post-exploitation sequence gives defenders a leg up. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/leaknet-changes-tactics-but-consistency-gives-defenders-an-advantage/
-
Google Cloud’s Vertex AI Hit by Vulnerability Enabling Sensitive Data Access
Artificial intelligence agents are transforming enterprise workflows, but they also introduce dangerous new attack vectors. Security researchers from Palo Alto Networks’ Unit 42 recently uncovered a significant vulnerability in Google Cloud Platform’s (GCP) Vertex AI Agent Engine. By exploiting overly broad default permissions, attackers can deploy a malicious >>double agent<< to secretly exfiltrate sensitive data…
-
Hackers Actively Exploit Critical WebLogic RCE Vulnerabilities in Ongoing Attacks
A maximum-severity vulnerability in Oracle WebLogic Server is facing rapid exploitation in the wild. Tracked as CVE-2026-21962, this unauthenticated Remote Code Execution (RCE) flaw carries a maximum CVSS score of 10.0. According to a recent honeypot study, attackers began weaponizing the flaw on January 22, 2026, the exact day public exploit code was released on…
-
Maryland Man Charged Over $53m Uranium Finance Crypto Hack
Maryland man accused of $53m Uranium Finance hack, exploited smart contract flaws, laundered funds First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/man-charged-uranium-crypto-hack/
-
Google’s Vertex AI Has an Over-Privileged Problem
Palo Alto researchers show how attackers could exploit AI agents on Google’s Vertex AI to steal data and break into restricted cloud infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/googles-vertex-ai-over-privilege-problem
-
Supply chain attack on Axios npm package: Scope, impact, and remediations
Tags: access, api, attack, breach, cloud, control, credentials, crypto, data, data-breach, defense, exploit, incident response, macOS, malicious, malware, open-source, rat, risk, security-incident, software, supply-chain, theft, threat, vulnerability, windowsThe Axios npm package has been compromised in a supply chain attack that uploaded new versions of the package containing malicious code. Any environment that downloaded these compromised Axios versions is at risk of severe data theft, including the loss of credentials and API keys. Scan your environment now. Key takeaways This incident is a…
-
5-month-old F5 BIG-IP DoS bug becomes critical RCE exploited in the wild
/run/bigtlog.pipe and /run/bigstart.ltm and makes changes to system binaries, including /usr/bin/umount and /usr/sbin/httpd. Attackers have also been observed modifying the sys-eicheck utility, which relies on RPM integrity checks to verify on-disk executables.Log analysis can reveal patterns related to the attack. The user “f5hubblelcdadmin” accessing the iControl REST API from localhost, SELinux disable commands in auditd…
-
TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks
A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos.The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to…
-
46 Vulnerability Statistics 2026: Key Trends in Discovery, Exploitation, and Risk
Vulnerability attacks rose 56% in 2025. Explore 46 statistics on CVE disclosure, exploitation patterns, and industry impact to guide your 2026 security strategy. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/46-vulnerability-statistics-2026-key-trends-in-discovery-exploitation-and-risk/
-
Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets
ey Points Introduction At the beginning of 2026, Check Point Research observed a series of targeted attacks against government entities in Southeast Asia carried out via a legitimate TrueConf software installed in the targets’ environment. The investigation led to the discovery of a zero-day vulnerability in the TrueConf client, tracked asCVE-2026-3502with aCVSS score of 7.8.…
-
OpenAI patches twin leaks as Codex slips and ChatGPT spills
ChatGPT’s hidden outbound channel leaks user data: OpenAI has reportedly fixed a parallel bug in ChatGPT that goes beyond credential theft. Check Point researchers uncovered a hidden outbound communication path in ChatGPT’s code execution runtime that could be triggered with a single malicious prompt.This channel successfully bypassed the platform’s expected safeguards around external data sharing.…
-
The AI Arms Race Why Unified Exposure Management Is Becoming a Boardroom Priority
The cybersecurity landscape is accelerating at an unprecedented rate. What is emerging is not simply a rise in the number of vulnerabilities or tools, but a dramatic increase in speed. Speed of attack, speed of exploitation, and speed of change across modern environments.This is the defining challenge of the new era of digital warfare: the…
-
TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets
TeamPCP is exploring ways to monetize the secrets harvested during supply chain attacks, with identified ties to the Lapsus$ and Vect ransomware gangs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/teampcp-exploit-stolen-supply/