Tag: exploit
-
AI Could Shrink the Supply of Exploits Governments Rely On
AI could accelerate vulnerability discovery, shrinking the pool of exploits governments rely on while speeding up the race between attackers and defenders. The post AI Could Shrink the Supply of Exploits Governments Rely On appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-ai-government-hackers-vulnerability-discovery/
-
Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/
-
Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs
A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The campaign does not exploit a Microsoft Teams vulnerability. Instead, it weaponizes trust in familiar support workflows, combining Teams chats…
-
Using AI, Calif Creates Demo WeChat Exploit that Spreads Through Phone Calls
Researchers with Calif used AI to detect a security flaw in the WeChat app and then create a demo worm exploit that can be spread quickly through mobile phones. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/using-ai-calif-creates-demo-wechat-exploit-that-spreads-through-phone-calls/
-
Claude Mythos Executes EndEnd Intrusion From Initial Access to Full Domain Compromise
Anthropic’s Claude Mythos Preview has demonstrated the ability to complete an end-to-end enterprise intrusion simulation, progressing from initial access through chained exploitation and network traversal to the defined compromise objective. The result marks a material shift in frontier-model cyber capability: the model did not merely solve isolated CTF-style tasks, but autonomously connected weaknesses commonly found…
-
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe”¯Commerce and”¯Magento Open Source that has come under active exploitation in the wild.The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.”This update resolves a critical First seen on thehackernews.com…
-
Mathspace Data Breach Exposes Personal Data of Over 1 Million Students, Parents and Staff
Mathspace, an online mathematics learning platform used by schools in Australia and New Zealand, has reported a data breach affecting 1,079,819 students, parents or guardians, teachers, and staff members. The company stated that attackers exploited a critical vulnerability in its self-hosted Metabase reporting environment, allowing them to gain administrator-level access without legitimate credentials. Mathspace Data…
-
Mathspace Breach Exposes Data of 1.08 Million in Australia, New Zealand
Mathspace says a breach exposed data tied to nearly 1.08 million people in Australia and New Zealand after attackers exploited a self-hosted Metabase flaw. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/news-mathspace-data-breach-australia-new-zealand-apac/
-
MikroTik RouterOS Vulnerabilities Actively Exploited via SSH
Attackers are actively exploiting MikroTik RouterOS flaws for unauthenticated router takeover. Here are the fixes, indicators of compromise, and post-patch checks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-mikrotik-routeros-mikrotrick-ssh-exploit/
-
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser.”Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences First seen on thehackernews.com…
-
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
A zero-day vulnerability dubbed “StyleSmuggler” affecting all versions of Magento and Adobe Commerce is being exploited in attacks to deploy a backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/magento-stylesmuggler-zero-day-exploited-to-deploy-linux-backdoor/
-
Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day
Chaotic Eclipse released GreenSection, a PoC exploit for an Nvidia GreenSection Memory Corruption Zero-Day Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Nvidia. The researcher named the exploit GreenSection, it triggers a Memory Corruption flaw. The researcher disclosed a potential security vulnerability in NVIDIA’s Windows user-mode…
-
Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day
Chaotic Eclipse released GreenSection, a PoC exploit for an Nvidia GreenSection Memory Corruption Zero-Day Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Nvidia. The researcher named the exploit GreenSection, it triggers a Memory Corruption flaw. The researcher disclosed a potential security vulnerability in NVIDIA’s Windows user-mode…
-
Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day
Chaotic Eclipse released GreenSection, a PoC exploit for an Nvidia GreenSection Memory Corruption Zero-Day Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Nvidia. The researcher named the exploit GreenSection, it triggers a Memory Corruption flaw. The researcher disclosed a potential security vulnerability in NVIDIA’s Windows user-mode…
-
Daily OT Security News: September 07, 2026
Today’s selection covers IoT, OT, ICS and cyber-physical-system security developments that may affect edge networking, management platforms, industrial assets and healthcare devices. Hackers exploit new MikroTik RouterOS flaws to hijack routers Attackers are actively exploiting a chain of two MikroTik… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/daily-ot-security-news-september-07-2026/
-
MikroTik Issues Patches for Routers Amid Zero-Day Attacks
Chaining Two Flaws Leads to Full Compromise, Warn Polish Incident Responders. Latvian router-maker MikroTik has issued emergency patches in the face of in-the-wild MikroTrick attacks that chain together exploits for two zero-day vulnerabilities in the RouterOS operating system that runs MikroTik devices to obtain full, remote control of any device with SSH access enabled. First…
-
Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication
Attackers are exploiting a chain of RouterOS vulnerabilities to hijack MikroTik devices with SSH open to the internet, CERT Polska found. CERT Polska, Poland’s national … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/07/mikrotik-routeros-ssh-vulnerabilities-exploited/
-
PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells
Tags: access, backdoor, cve, cyber, exploit, flaw, linux, malware, remote-code-execution, vulnerabilityA sophisticated Linux implant linked to compromised F5 BIG-IP Access Policy Management (APM) environments. The activity has been associated with exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw affecting BIG-IP APM when an access policy is configured on a virtual server. F5 has confirmed exploitation of the vulnerability and links the related compromise activity…
-
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE, Public Exploit Released
A TantoSec proof-of-concept turns an AES-CBC “padding oracle” in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild.Security firm TantoSec has published a working exploit chain targeting vulnerabilities…
-
N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)
N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central, its remote monitoring and management (RMM) solution popular … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/07/n-able-n-central-hotfix-cve-2026-86218/
-
N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)
N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central, its remote monitoring and management (RMM) solution popular … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/07/n-able-n-central-hotfix-cve-2026-86218/
-
Über Zero-Day-Lücke: Angreifer schleusen Backdoor in Onlineshops ein
Hacker kompromittieren Onlineshops auf Basis von Magento über eine Sicherheitslücke. Sie schleusen Schadcode ein und platzieren eine Backdoor. First seen on golem.de Jump to article: www.golem.de/news/ueber-zero-day-luecke-angreifer-schleusen-backdoor-in-onlineshops-ein-2609-212724.html
-
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
-
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
-
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
-
BYOTC Attack Abuses Trusted Windows Clients to Access Privileged Kernel Driver Operations
A newly documented Windows attack pattern, dubbed Bring Your Own Trusted Caller (BYOTC), shows how attackers can bypass driver-level authorization controls without exploiting a traditional memory-corruption flaw. Instead of attacking a privileged kernel driver directly, an adversary compromises or abuses the legitimate user-mode application that the driver already trusts. The technique expands on the well-known…
-
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Every on-premises N-central build below 2026.3.1.14, including servers updated to Hotfix 3 a day earlier, needs Hotfix 4. N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this…
-
Researcher Publishes CrowdStrike Privilege Escalation Zero Day
A security researcher has posted a zero-day exploit in CrowdStrike which could allow hackers to escalate privileges First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/crowdstrike-privilege-escalation/