Tag: exploit
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud
-
Hackers steal customer data from major Russian hosting provider FirstVDS
Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-firstvds-cloud
-
Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw
OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from…
-
Exploit-Code geleakt: Plex-Server werden attackiert
Wer einen Plex-Media-Server betreibt, sollte diesen dringend auf die neueste Version updaten. Angreifer schleusen mittels Plex2Shell-Angriff Malware ein. First seen on golem.de Jump to article: www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-auf-plex-server-2610-214242.html
-
Exploit-Code geleakt: Angreifer schleusen Malware auf Plex-Server
Wer einen Plex-Media-Server betreibt, sollte diesen dringend auf die neueste Version updaten. Angreifer schleusen mittels Plex2Shell-Angriff Malware ein. First seen on golem.de Jump to article: www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-auf-plex-server-2610-214242.html
-
Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM…
-
U.S. Agencies Warn AI Agents Could Exploit Security Flaws and Establish Hidden Backdoors
U.S. agencies have warned that advanced AI agents could exploit security flaws, break out of their assigned limits, and leave hidden backdoors behind. New guidance from NIST, the National Security Agency, and CISA urges AI developers to prepare for incidents in which agents take harmful actions without being told to do so. Released on October…
-
Hackers exploit SiteGuard WAF flaw to run commands as admins
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/
-
Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/
-
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
-
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cybersecurity, exploit, firewall, flaw, fortinet, infrastructure, kev, malware, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls,…
-
Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to analysis by Seqrite researcher Amruta Wagh. Dubbed WP2Shell, the exploit chain reportedly emerged in July 2026 and combines REST API route confusion with SQL injection, allowing attackers to progress from public endpoints to server compromise without possessing valid WordPress credentials.…
-
OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a separate out-of-bounds write to obtain root privileges. Calif researcher Andrew Griffiths published the “Big Fish” research on October 16, 2026, alongside public proof-of-concept code demonstrating exploitation with multiple kernel security protections enabled. The oldest vulnerability traces to a shared memory…
-
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
-
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
-
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD’s KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD…
-
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
-
Zero-Day in BeyondTrust Remote Support Appliances Exploited
‘Patch ASAP’ Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns. All self-hosted BeyondTrust Remote Support appliance users are being urged to immediately patch a bug that an advanced persistent threat group tied to China, which specializes in hacking edge devices. Its been exploiting since late August as a zero-day vulnerability to steal credentials and…
-
F5 addressed critical RCE flaws in NGINX
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests. Under certain conditions beyond their control, an…
-
Researchers Demonstrate iOS 27.0.1 Untethered Jailbreak on iPhone 18 Pro
Security researchers from Calif (Calif.io) demonstrated a working untethered jailbreak on iOS 27.0.1 running on an iPhone 18 Pro. They showed it live at the Hexacon 2026 offensive security conference in Paris on October 16, 2026. Heise reports it is the first reboot-proof jailbreak since iOS 9, and that AI helped find the exploit chain.…
-
U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw…
-
Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/16/arch-linux-aur-malware-yay-paru/
-
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and…
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and…
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and…
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A likely Russian-speaking threat actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and establish reusable access to internal networks. GreyNoise identified at least 440 compromised instances belonging to 395 organizations across 48 countries, demonstrating how agent-assisted workflows can accelerate exploitation of enterprise infrastructure. The operator combined OpenAI’s Codex harness…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/