Tag: exploit
-
PHP warns it plans to release 2 emergency patches imminently
Tags: exploitUnconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
-
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks. First seen on therecord.media Jump to article: therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims
-
Ransomware groups expand targeting of Palo Alto Networks vulnerability
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/
-
Pegasus Spyware Infection Confirmed on Serbian University Rector’s iPhone Days Before Election
The iPhone of Vladan Äokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, the Citizen Lab said on October 19.The finding came six days before Serbia’s October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Äokić…
-
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/
-
Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47…
-
Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an…
-
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw
Siemens identified the activity to be from the Romulus multi-platform ClickFix campaign, with Siemens Software Center users urged to apply an update First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/
-
Hackers Exploit Zimbra Zero-Click Flaw to Take Control of Email Servers
Tags: authentication, control, cyber, data, email, exploit, flaw, hacker, injection, intelligence, Internet, microsoft, threat, vulnerabilityHackers are exploiting a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite. This vulnerability allows attackers to compromise internet-facing email servers without any user interaction. Microsoft Threat Intelligence has observed attackers deploying webshells, escalating privileges, collecting authentication secrets, and staging mailbox data across organizations in various regions and industries. Zimbra Zero-Click Flaw The >>zero-click<<…
-
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks.The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as…
-
Schadcode-Attacken möglich: Kritische Nginx-Lücken gefährden Webserver
Tags: exploitDrei Sicherheitslücken in Nginx lassen Angreifer zahlreiche Webserver lahmlegen oder Schadcode einschleusen. Admins sollten zügig patchen. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-kritische-nginx-luecken-gefaehrden-webserver-2610-214277.html
-
New RedAgents AI Platform Deploys Multiple Hacking Agents to Find and Exploit Vulnerabilities
RedAgents, a cloud platform that deploys multiple AI penetration testing agents against authorized targets to discover vulnerabilities and test attack paths. Announced on October 16, 2026, the service brings Artex Pro, Cyber(YanJi), Yanxun, and CyberStrikeAI Enterprise Edition into a single environment for security operations teams. The platform addresses a limitation of automated security assessments: different…
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
‘AdFection’ Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest. First seen on darkreading.com Jump to article: www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery
-
Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server. Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who…
-
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.The vulnerabilities First seen on…
-
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.The vulnerabilities First seen on…
-
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard’s Greg Pollock explains what universities, government websites, and security teams need to think about next. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/onlyfans-copyright-takedowns-expose-compromised-websites
-
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/exploited-vulnerabilities-three/
-
SiteGuard Warns Patching Actively Exploited Security Flaw Could Erase Evidence of Attacks
EG Secure Solutions has warned that a flaw in SiteGuard Server Edition is being exploited and that applying a fix could remove signs of an earlier attack. The issue, CVE-2026-106931, affects the product’s statistics feature, which is enabled by default. Before updating, administrators should save diagnostic information so they can check whether the server was…
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud