Tag: exploit
-
Hackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy Meterpreter
Threat actors are actively exploiting two critical vulnerabilities in PaperCut NG/MF, identified as CVE-2026-81578 and CVE-2026-82078. These exploits allow attackers to take control of print management servers, steal credentials, and deploy Meterpreter payloads within enterprise networks. Analysts Jens Pose and Ross Phillips from Arctic Wolf reported that these intrusions progressed from remote command execution to…
-
Liquid Network Hackers Demand Bug Fix Before Returning $320M BTC
The Liquid Network security incident has taken an unusual turn after the unidentified actors behind the theft of nearly 4,000 BTC offered to return “most” of the funds, but only after the vulnerability that enabled the exploit is fixed across the network. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/liquid-network-security-incident/
-
Critical N-able N-central Flaw Enables Pre-Auth Remote Code Execution
N-able has released a security update to address CVE-2026-86218, a critical-severity vulnerability in its N-central remote monitoring and management platform. This vulnerability could enable pre-authenticated remote code execution on an affected server. The issue is fixed in N-central version 2026.3 Hotfix 4, build 2026.3.1.14. Because an attacker may exploit this vulnerability before logging in, it…
-
DPRK-Linked Hackers Backdoor HAProxy Servers to Spy on South Korean Organizations
A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors. The campaign is notable because it does not exploit a flaw in HAProxy itself. Instead, the operators appear to have obtained code execution on targeted edge servers…
-
Magento and Adobe Commerce StyleSmuggler 0-Day RCE Actively Exploited in Attacks
Tags: adobe, attack, cyber, exploit, Internet, open-source, rce, remote-code-execution, vulnerability, zero-daySecurity researchers have discovered an actively exploited, unauthenticated remote code execution vulnerability affecting installations of Magento Open Source and Adobe Commerce. This vulnerability, known as StyleSmuggler, allows attackers to inject PHP payloads into Magento’s template system and execute them via standard application workflows. Sansec’s Forensics Team reported that attacks began on September 4, targeting internet-facing…
-
Weekly Cybersecurity Newsletter Top 50 Biggest Cybersecurity Stories of the Week
Welcome to this week’s edition of the GBHackers cybersecurity newsletter, your weekly cybersecurity bulletin covering the 50 most important stories from August 31 September 5, 2026. AI ran through the whole week: OpenAI’s GPT-6 Astra built working exploits, Anthropic shipped Claude Fable 5.1 and Mythos 5.1, Claude gained the ability to control computers, […] The…
-
Hackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell Commands
A newly identified Chromium-based post-exploitation toolkit named PEEP can turn Google Chrome and Microsoft Edge into persistent remote-access platforms, enabling attackers to steal browser data, hijack sessions, manage files and execute shell commands on compromised endpoints. Unlike a conventional initial-access malware strain, PEEP requires attackers to already possess administrative privileges or code-execution access on a…
-
Hackers Actively Exploiting MikroTik RouterOS MikroTrick Flaws to Take Full Control of Routers
Threat actors are actively exploiting critical vulnerabilities in MikroTik RouterOS, collectively known as MikroTrick, to compromise internet-exposed routers and gain complete administrative control. The attacks primarily target devices with SSH management access that are exposed to public networks, prompting urgent patching recommendations from MikroTik, CERT Polska, and Latvia’s national CERT.LV. On September 3, MikroTik issued…
-
ISMG Editors: Cybersecurity’s Paper Problem Isn’t Dead
Also: AI Attacks Exploit Security Debt, Iran Targets US Critical Infrastructure. In this week’s panel, ISMG editors discussed sensitive mental health records left to rot in abandoned buildings, how mounting security debt could leave firms exposed to AI-powered attacks and how the escalating U.S.-Iran conflict is raising new concerns about attacks on critical infrastructure. First…
-
Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
MikroTik RouterOS SSH zero-day (MikroTrick chain) under active exploitation since Sept 2. Patch to 7.24.2, 7.23.5, or 6.49.21 immediately and check logs. Anyone running a MikroTik router with SSH exposed to the internet should treat it as compromised until proven otherwise. The popular cybersecurity expert Costin Raiu published a detailed technical breakdown of the active…
-
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
Tags: access, attack, authentication, control, data-breach, exploit, hacker, Internet, router, serviceAttackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska’s attack warning, published on September 5.Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count…
-
Security Affairs newsletter Round 593 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. PaperCut Flaws Exploited in Attacks on U.S. and European Schools Broadcom Patches Critical VMware Workstation and Fusion…
-
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Tags: adobe, advisory, attack, backdoor, exploit, flaw, malicious, open-source, vulnerability, zero-dayAttackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store’s server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5.Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4.…
-
PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education organizations in the U.S. and Europe, as reported by TheHackerNews. Arctic Wolf researchers observed threat…
-
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment.”Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions,”…
-
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions.The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code.”A First seen on…
-
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions.The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code.”A First seen on…
-
CISA Flags Old ownCloud Flaw After Reported Philippine Nuclear Data Theft
CISA added CVE-2023-49105 to its exploited-flaws catalog after researchers tied the old ownCloud bug to reported Philippine nuclear data theft. The post CISA Flags Old ownCloud Flaw After Reported Philippine Nuclear Data Theft appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-owncloud-nuclear-data-breach-apac-philippines/
-
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 an authentication bypass and remote code execution chain to conduct command execution and reconnaissance, as well as First…
-
Google’s Chrome Update Patches Sixth Zero-Day Exploited in 2026
Google patched CVE-2026-85046, the sixth Chrome zero-day exploited in the wild in 2026. Here’s how to update your browser and stay protected. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-google-chrome-cve-2026-85046-zero-day/
-
CISA Adds 7 Exploited Flaws as Attackers Target AI Infrastructure
CISA added seven exploited flaws to its KEV catalog, including LiteLLM, Kestra, Starlette, and SonicWall vulnerabilities under active attack. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/news-cisa-exploited-ai-flaws/
-
PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7.2). Present in releases dating back to 2014, the flaw can be exploited by attackers with low-level replication access to execute code,…
-
Researcher Releases Exploit of Claimed CrowdStrike Falcon Zero-Day
The security researcher who for much of the year has haunted Microsoft by publishing zero-day vulnerabilities without disclosing them to the IT giant first this week dropped another exploit, this time one that targets CrowdStrike’s Falcon endpoint security platform. The researcher who goes by a number of names, including Nightmare-Eclipse, Chaotic Eclipse, MSNightmare, and.. First…
-
New CrowdStrike ‘FalconFlank’ zero-day grants SYSTEM privileges
An anonymous security researcher who uses the “Nightmare Eclipse” handle released a CrowdStrike Falcon zero-day exploit named “FalconFlank” that lets attackers escalate privileges on up-to-date Windows systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/
-
Protecting Against Zero-Click Attacks
By Aimee Steele, threat intelligence analyst at Talion Cyber Security Last month, the UK’s National Cyber Security Centre (NCSC) issued an advisory around a new phishing campaign targeting organisations in the West that was being carried out by the Russian state-sponsored threat actor known as Laundry Bear. The campaign, saw the threat actors exploiting a…
-
The Cyber Express Weekly Roundup: Claude Session Hijacking, PaperCut Exploits, and Enterprise Cyberattacks
This weekly roundup highlights a range of cybersecurity developments affecting artificial intelligence platforms, enterprise software, healthcare organizations, social media accounts, and internet-facing infrastructure. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/weekly-roundup-claude-papercut-citrix/
-
Google patches actively exploited Chrome zero-day (CVE-2026-85046)
Google has patched 12 vulnerabilities affecting its popular Chrome browser, among them CVE-2026-85046, which has been exploited in the wild. >>Google is aware that an … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/04/google-chrome-zero-day-cve-2026-85046/
-
Google warns of new Chrome zero-day flaw exploited in attacks
Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/
-
Critical Super Forms WordPress Flaw Actively Exploited to Achieve Remote Code Execution
Threat actors are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, allowing them to upload PHP backdoors and gain remote code execution. This flaw, tracked as CVE-2026-14894, affects Super Forms versions 6.3.313 and earlier. Administrators are urged to upgrade to version 6.3.314 immediately. Super Forms WordPress Flaw Wordfence disclosed this unauthenticated arbitrary…
-
Google fixes the sixth actively exploited Chrome zero-day of 2026
Tags: browser, chrome, cve, exploit, flaw, google, remote-code-execution, update, vulnerability, zero-dayGoogle patched 12 Chrome flaws, including an actively exploited V8 zero-day that could enable remote code execution through a crafted webpage. Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046 (CVSS score of 8.8), an actively exploited V8 type confusion flaw. The bug affects Chrome’s JavaScript and WebAssembly engine and could let a…