Tag: exploit
-
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next.With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point…
-
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next.With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point…
-
(g+) Windows-Kernel: Ein falsches Jobangebot hebelt den Windows-Schutz aus
Mit gefälschten Jobangeboten schleusten nordkoreanische Hacker Schadcode ein und schalteten über eine Windows-Lücke Sicherheitssoftware aus. Wie Admins solche Angriffe erkennen können. First seen on golem.de Jump to article: www.golem.de/news/windows-kernel-ein-falsches-jobangebot-hebelt-den-windows-schutz-aus-2610-214044.html
-
Legacy refrigeration controllers exploited in OT attack on hundreds of French supermarkets
A coordinated attack on the operational technology (OT) behind supermarket refrigeration has hit hundreds of stores across France, in what security experts are calling one of the clearest examples yet of cyber sabotage with physical consequences. Retailers confirmed the attack on Monday 12 October, with disruption reportedly beginning on Sunday night. Intermarché and its Netto…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Amazon Fire TV Cube Security Flaws Allow Bootloader Unlocking and Permanent Root Access
A recently released exploit package lets the third-generation Amazon Fire TV Cube gain an unlocked bootloader and persistent root access on firmware version PS7717 or earlier. Developed by XDA developer Pro-me3us, the project targets devices codenamed “gazelle”. It combines temporary privilege escalation with a separate bootloader vulnerability to enable lasting system modifications. This release includes…
-
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure. Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked asCVE-2026-102255(CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login.…
-
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Security researchers have revealed a critical vulnerability in Discourse, tracked as CVE-2026-55420. This flaw could let a low-privileged user read and write files on the underlying server by exploiting the platform’s ImageMagick-based upload pipeline. The issue was fixed for hosted customers in June 2026 and was publicly disclosed on June 30, 2026. The vulnerability affects…
-
CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog
Tags: apache, cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, injection, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2016-3081, a critical command injection vulnerability in Apache Struts, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This vulnerability affects Apache Struts deployments where Dynamic Method Invocation (DMI) is enabled. Tracked as CWE-77, this flaw allows a remote attacker to…
-
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker “to direct the appliance to issue requests on…
-
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The First seen on…
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
-
AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn. This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk…
-
AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn. This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk…
-
AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn. This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk…
-
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The five vulnerabilities have been added to a broader list of flaws linked to cyber…
-
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic on Friday said it’s cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites.The AI company said it identified four broad categories of unintended model actions during evaluations and internal use of Claude –…
-
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
-
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.”Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker’s infrastructure,” iVerify said in a new report published Thursday.The name…
-
Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning
Anthropic launches free OSS Scanner, using AI to find open-source vulnerabilities and help maintainers fix bugs before attackers exploit them. Anthropic is launching OSS Scanner, a vulnerability scanner for open-source code that costs nothing for projects to join. It grew directly out of lessons learned running Claude against real-world targets during Project Glasswing. The backdrop…
-
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection.AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as “fixed a bug that could lead to a crash,” with no…
-
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners.Details of the flaws are below – CVE-2026-105133 (CVSS v4 score: 5.5) – An improper authentication vulnerability in the checkSysPwd() function in the “com/ahsay/obs/api/ApiStructsAction.java” First seen on…
-
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
-
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
Tags: access, china, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, threat, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.The vulnerabilities in question are listed below – CVE-2015-3306 (CVSS score: 10.0) – An improper access control vulnerability in ProFTPD that could allow…
-
React Server Components Vulnerability Lets Attackers Freeze Next.js Servers With a Single Request
A security vulnerability has been identified in React Server Components deployments using specific vulnerable releases of React 19. An attacker can exploit this flaw to create a denial-of-service condition through specially crafted HTTP POST requests, as detailed in CVE-2026-23870. React Server Components Vulnerability Tracked as CVE-2026-23870 and GHSA-rv78-f8rc-xrxh, this high-severity vulnerability affects React Server Components…
-
Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners
Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress. AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their…