Tag: exploit
-
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
Tags: cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, microsoft, office, rce, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities in question are as follows – CVE-2026-65660 (CVSS score: 8.8) – A code injection vulnerability in Microsoft Office SharePoint First seen on…
-
U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPressflaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-87902 allows an unauthenticated attacker to make the get_page_template() function include a readable local…
-
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Tags: access, cve, cyber, data-breach, exploit, flaw, Internet, linux, remote-code-execution, threat, vulnerabilityA threat actor tracked as Red Heron has exploited the critical Gitea remote code execution vulnerability CVE-2026-60004 to steal source-code repositories, establish persistent access, and deploy a covert Linux toolset consisting of the JITTERLY implant and SIXZUT LD_PRELOAD rootkit. Acronis reported that the actor rapidly weaponized the flaw against internet-exposed Gitea environments, turning initial access…
-
Roundcube Webmail Under Attack: 523,000 Instances Exposed Online
Roundcube CVE-2026-48842 is being actively exploited, with more than 523,000 Roundcube instances still exposed on the internet. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-roundcube-cve-2026-48842-active-exploitation/
-
InfraTrust Report Flags Exploited Network Management Flaws
Eclypsium’s InfraTrust report highlights exploited flaws in network management consoles and explains what security teams should patch, monitor, and investigate. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-infratrust-network-management-flaws/
-
U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, microsoft, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft SharePoint and Mikrotik RouterOS flaws flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-65660 is a code-injection vulnerability in Microsoft SharePoint Server that allows an authenticated, low-privileged attacker to execute arbitrary…
-
Stop Waiting for Someone Else to Make AI Safe
Forget AI Doomsday. Defend Against the Agent Already Jimmying the Locks AI labs warn their creations could someday threaten humanity while governments race to keep their nations competitive. Security teams have a less cinematic problem: Autonomous agents can already probe defenses, exploit weaknesses and wield credentials. Time for Cybersecurity 101. First seen on govinfosecurity.com Jump…
-
Stop Waiting for Someone Else to Make AI Safe
Forget AI Doomsday. Defend Against the Agent Already Jimmying the Locks AI labs warn their creations could someday threaten humanity while governments race to keep their nations competitive. Security teams have a less cinematic problem: Autonomous agents can already probe defenses, exploit weaknesses and wield credentials. Time for Cybersecurity 101. First seen on govinfosecurity.com Jump…
-
Attackers Target Unpatched Roundcube Servers With CVE-2026-48842
Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update. The post Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/attackers-target-unpatched-roundcube-servers-with-cve-2026-48842/
-
Attackers Target Unpatched Roundcube Servers With CVE-2026-48842
Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update. The post Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/attackers-target-unpatched-roundcube-servers-with-cve-2026-48842/
-
WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution
Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do. The post WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-wordpress-cve-2026-87902-active-exploitation/
-
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
Tags: adobe, attack, authentication, cisa, cybersecurity, exploit, flaw, hacker, infrastructure, software, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/
-
Only 26% of Detected CISA Known Exploited Vulnerabilities Were Fully Remediated
A recent Verizon study found that vulnerability exploitation became the most common initial access vector, appearing in 31%… First seen on hackread.com Jump to article: hackread.com/26-detected-cisa-known-exploited-vulnerabilities-remediated/
-
14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape
A vulnerability in the Linux kernel’s AF_ALG cryptographic interface, which has existed for 14 years, can let an unprivileged local attacker gain root access and escape a Docker container by exploiting a race condition in concurrent socket writes. This flaw, tracked as CVE-2025-39964, was discovered in 2025 by STAR Labs researcher Muhammad Alifa Ramdhan, with…
-
14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape
A vulnerability in the Linux kernel’s AF_ALG cryptographic interface, which has existed for 14 years, can let an unprivileged local attacker gain root access and escape a Docker container by exploiting a race condition in concurrent socket writes. This flaw, tracked as CVE-2025-39964, was discovered in 2025 by STAR Labs researcher Muhammad Alifa Ramdhan, with…
-
14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape
A vulnerability in the Linux kernel’s AF_ALG cryptographic interface, which has existed for 14 years, can let an unprivileged local attacker gain root access and escape a Docker container by exploiting a race condition in concurrent socket writes. This flaw, tracked as CVE-2025-39964, was discovered in 2025 by STAR Labs researcher Muhammad Alifa Ramdhan, with…
-
Attackers build “silent” cryptominer on victim’s machine and give themselves away
Security researchers at Huntress have uncovered an unusual attack in which a threat actor compiled a cryptocurrency miner directly on a victim’s computer, rather than simply dropping a ready-made one, and in doing so generated so much activity that the intrusion stood out. The incident began in early September 2026 with the exploitation of CVE-2025-4632,…
-
AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution. CARBONATO is a Docker-based botnet that has been active since at least October 2024. ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet. The registry contained the attackers’ entire toolchain…
-
CISA Flags WSO2 Security Flaw Under Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting WSO2, tracked as CVE-2026-5430, to its Known Exploited Vulnerabilities (KEV) catalog. CISA made this decision after evidence showed threat actors are actively exploiting the flaw. CISA added the vulnerability on September 24, 2026, and set a remediation deadline for affected federal…
-
CISA Adds Multiple Check Point Product Flaws to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting multiple Check Point products to its Known Exploited Vulnerabilities (KEV) catalog. CISA warns that these flaws are being actively exploited in the wild. Federal civilian agencies must address these vulnerabilities by September 25, 2026, under Binding Operational Directive (BOD) 26-04. The…
-
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.The issue stems from a preg_replace() backslash First…
-
Schadcode-Attacken möglich: Angreifer können Gitlab-Instanzen kapern
Mehrere Sicherheitslücken lassen Angreifer Schadcode auf Gitlab-Server sowie in die Webbrowser anderer Nutzer einschleusen. Admins sollten zügig handeln. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-angreifer-koennen-gitlab-instanzen-kapern-2609-213435.html
-
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
Tags: adobe, authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products…
-
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
Tags: adobe, authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products…
-
Attackers Drain Payy Network After Exploiting Ethereum Bridge Contract
Payy Network has confirmed that an attacker exploited its Ethereum bridge contract and drained its entire balance. As a result, the network and wallet services were immediately suspended. This incident affected users’ non-custodial deposits held within the Payy Network and Payy Wallet bridge infrastructure. The exploit occurred around 04:21 UTC on September 24, 2026. Payy…
-
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Tags: adobe, api, attack, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-5430 (CVS score: 9.8) – A path traversal vulnerability in WSO2 API Control Plane, First…
-
‘Salesbleed’ Exploits Salesforce Agents to Enable Slack Phishing
Agentic AI can smuggle arbitrary instructions from the Web, across multiple apps, into trusted internal communications channels. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/salesbleed-exploits-salesforce-agents-slack-phishing
-
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before.That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…
-
ISMG Security Report: AI Doesn’t Wait for Patch Tuesday
AI Bug Discovery Forces Security Teams to Rethink Vulnerability Management. AI is getting scary good at finding software vulnerabilities. Anthropic says Claude Mythos previews uncovered more than 10,000 flaws in key software products. That’s great news, but somebody still has to triage them, figure out which ones attackers can actually exploit and, eventually, patch them.…