Tag: exploit
-
CISA warns of hackers exploiting critical MLflow vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/
-
ICS Operators Warned of AI-Driven Attacks on Siemens PLCs
A US government advisory warned that attackers are deploying AI-generated exploitation scripts against exposed Siemens S7 Series PLCs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ics-ai-attacks-siemens/
-
U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an MLflow vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2026-64849 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-64849 is a critical server-side request forgery (SSRF) vulnerability in MLflow, a…
-
Critical Zimbra RCE flaw now actively exploited in attacks
CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/
-
US agencies warn of AI-powered attacks on Siemens industrial controllers
Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/20/usa-ai-attacks-siemens-s7-plcs-critical-infrastructure/
-
Hackers Trick AI Agents Into Telling Users to Install the Malware Themselves
A supply-chain campaign targeting OpenClaw has shown how threat actors can turn autonomous AI agents into persuasive malware-delivery intermediaries. Rather than relying only on exploit code, attackers poisoned the ClawHub skill registry with seemingly legitimate extensions whose instructions prompted users to install fake prerequisite tools or paste obfuscated commands into a terminal. The campaign, tracked…
-
AI-Driven Vulnerability Exploitation Is Now Fast and Cheap
AI is making vulnerability exploitation faster and cheaper, forcing defenders to rethink vulnerability management, continuous exposure detection and agentic cyber defense. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/ai-driven-vulnerability-exploitation-is-now-fast-and-cheap/
-
Zimbra RCE Vulnerability Lets Remote Attackers Execute System Commands
An urgent alert regarding an actively exploited remote code execution vulnerability affecting the Zimbra Collaboration Suite, a widely used enterprise email and collaboration platform. This vulnerability, tracked as CVE-2026-73570, is an unauthenticated OS command injection issue that allows attackers to execute arbitrary shell commands as the zimbra user. Zimbra RCE Vulnerability The flaw affects Zimbra…
-
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type.”The…
-
8,539 reasons to rethink how vulnerabilities get patched
The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/20/rapid7-vulnerability-patch-cycles-report/
-
GitLab Code Injection Flaw Exploited in the Wild
CVE-2026-19478 Can Alter or Delete Public Projects Without Authentication. Researchers detected active exploitation of CVE-2026-19478, a critical GitLab code injection flaw that lets unauthenticated attackers alter public projects, forge merge records or delete repositories, creating a potential path to software supply-chain compromise. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/gitlab-code-injection-flaw-exploited-in-wild-a-32606
-
NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology
The National Security Agency (NSA), FBI and other federal agencies said the campaign is targeting Siemens S7 Series PLCs and was being fueled by “AI-assisted development” alongside exploitation of known vulnerabilities. First seen on therecord.media Jump to article: therecord.media/nsa-fbi-warns-of-hackers-using-ai-generated-tools-critical-infrastructure
-
US warns of AI-powered attacks on Siemens PLCs in critical infrastructure
U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/
-
GitLab Patches Critical CVE-2026-19478 GraphQL Vulnerability
GitLab patched a critical GraphQL flaw as researchers observed exploitation attempts. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/gitlab-patches-critical-cve-2026-19478-graphql-vulnerability/
-
Quantum-Safe Isn’t Cyber-Safe
Tags: access, ai, api, breach, communications, compliance, computer, computing, credentials, cryptography, cyber, data, defense, encryption, exploit, flaw, google, group, ml, openai, password, radius, risk, threat, update<div cla In the same week federal agencies began scoping migrations under the White House’s new Post-Quantum Cryptography Executive Order, a group of academic researchers published a paper that, on its face, had nothing to do with quantum computing at all. It described a flaw in how three of the most security-conscious engineering organizations on…
-
Password spraying attacks surge 155x as hackers exploit MFA gaps
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps/
-
Password spraying attacks surge 155x as hackers exploit MFA gaps
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps/
-
CISA Warns Microsoft Internet Key Exchange RCE Flaw Is Actively Exploited
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, Internet, kev, microsoft, rce, remote-code-execution, service, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability, tracked as CVE-2026-33824, is currently being actively exploited. The issue is classified as a double-free vulnerability, which means it affects the memory management of Microsoft…
-
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Tags: apple, authentication, cve, cybersecurity, exploit, flaw, infrastructure, kev, macOS, microsoft, vcenter, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, stating they are being exploited in the wild.The shortcomings added to the KEV catalog are listed below – CVE-2026-65400 (CVSS score: 9.8) – An improper authentication vulnerability impacting Apple macOS that could allow an…