Tag: exploit
-
VMware vCenter RCE Gives Attackers a Path From One Appliance to Entire Virtual Infrastructure
Tags: cve, cyber, data-breach, exploit, infrastructure, rce, remote-code-execution, vcenter, vmware, vulnerabilityA critical VMware vCenter vulnerability is being actively exploited in a fast-moving campaign that turns a single exposed management appliance into a launch point for broad virtual-infrastructure compromise. Incident responders at QUIRSO linked the activity to exploitation of CVE-2026-59310, while identifying a separate, possibly unrelated track involving CVE-2026-59309. CVE-2026-59310 is a directory-traversal vulnerability in the…
-
PoC Exploit Released for Microsoft SCCM Vulnerability Enabling SYSTEM-Level Code Execution
A recently disclosed proof-of-concept (PoC) exploit for Microsoft Configuration Manager, previously known as System Center Configuration Manager (SCCM), demonstrates how an authenticated domain user could potentially escalate privileges to SYSTEM on a vulnerable Primary Site Server. This issue, tracked as CVE-2026-47301, was reported by security researcher Omri Baso and is characterized as an exploit chain…
-
Clop Claims Data Theft From More Than 40 Companies
Victims Are Assessing Claims of Stolen Databases, CAD Files and Backups. Russia-linked Clop claims it stole databases, engineering files, backups and other sensitive corporate data from more than 40 organizations in a breach wave tied to exploitation of a critical remote code execution flaw in PTC Windchill and FlexPLM. First seen on govinfosecurity.com Jump to…
-
Video Call Exploit Chains Two Flaws in Unisoc Modems
Researchers found that by combining two vulnerabilities, they could take over an Android device by delivering a payload and getting the victim to answer their phone. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/video-call-exploit-chains-two-flaws-unisoc-modems
-
China-Nexus Threat Actor Targeting Critical VMware Flaw
A China-nexus bad actor is likely behind the rapid exploitation of a critical flaw in VMware’s vCenter management software that has spread across 361 victim IP addresses in almost four dozen countries. Exploitation of the vulnerability tracked as CVE-2026-59310 started five days after VMware owner Broadcom first disclosed the security flaw July 29,.. First seen…
-
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher…
-
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher…
-
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher…
-
SafePal Says 39,798 Customers Hit by Data Breach
SafePal says a breach exposed personal data of 39,798 customers, but not wallet credentials, private keys, seed phrases, or payment information. SafePal disclosed a data breach affecting about 39,798 customers after hackers exploited a vulnerability in its order-tracking plugin. The flaw exposed information linked to orders placed between March 2, 2025, and April 11, 2026,…
-
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials.The issue was present in .github/workflows/jira_issue.yml, which ran when a First seen on thehackernews.com Jump to article:…
-
Critical flaw in SAP Commerce Cloud faces initial exploitation attempts
The vulnerability has a maximum severity score of 10, indicating serious potential impact and relative ease to exploit by an attacker. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-sap-commerce-cloud-initial-exploitation/828023/
-
Critical flaw in SAP Commerce Cloud faces initial exploitation attempts
The vulnerability has a maximum severity score of 10, indicating serious potential impact and relative ease to exploit by an attacker. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-sap-commerce-cloud-initial-exploitation/828023/
-
Critical flaw in SAP Commerce Cloud faces initial exploitation attempts
The vulnerability has a maximum severity score of 10, indicating serious potential impact and relative ease to exploit by an attacker. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-sap-commerce-cloud-initial-exploitation/828023/
-
Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS
The botnet adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into persistent attacker infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/linux-botnet-evooo1bot-mirai-capabilities-beyond-ddos
-
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
Today is Microsoft’s August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/
-
ExfilSquad Targets New Victims, Shares Data via Torrents
ExfilSquad targets 13 organizations, exploiting cloud portals for data theft and using torrents to spread stolen information and amplify damage. Resecurity is tracking the activity of ExfilSquad the group announced new victims this week. ExfilSquad is a new cybercrime group that emerged in mid-2026. Instead of using ransomware, it steals data and threatens to […]…
-
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent.The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft’s First…
-
AI Helps Researchers Uncover Zoom Zero-Click RCE in Less Than a Day
Researchers used public AI models to uncover ZOOMSDAY, a critical Zoom zero-click RCE exploit chain, in less than 24 hours. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/ai-helps-researchers-uncover-zoom-zero-click-rce-in-less-than-a-day/
-
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development
OpenAI on Monday unveiled a new cybersecurity-focused model called GPT”‘5.6″‘Cyber that it said is focused on vulnerability research, penetration testing, and incident response.”Built on GPT”‘5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk First seen on…
-
Plug Pwn Attack Exploits Windows PnP to Gain SYSTEM Access With Zero Clicks
Security researchers Alejandro Hernando, also known as 0xedh, and Borja MartÃnez have unveiled a research project titled >>Plug & Pwn.<< This project demonstrates how the Windows Plug and Play (PnP) driver installation workflows can be exploited to execute vendor-supplied code with NT AUTHORITY\SYSTEM privileges. Presented at DEF CON 34, the research explores the risky intersection…
-
Microsoft SharePoint flaw now exploited in ransomware attacks
CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
-
Cisco warns of high-severity ClamAV flaws with public exploits
Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/
-
Copeland XWEB Pro Vulnerabilities Let Attackers Gain Root Access and Manipulate Refrigeration Systems
Security researchers have discovered 23 vulnerabilities in Copeland’s XWEB Pro commercial refrigeration controllers, with 21 rated as high severity. These vulnerabilities could allow unauthenticated attackers to gain root-level remote code execution and control connected cooling equipment. Claroty’s Team82 found that an attacker could exploit a combination of authentication flaws, predictable administrator credentials, and command-injection vulnerabilities…
-
China-Linked Hackers Use N-able Flaw in Ransomware Attacks
Microsoft Says Storm-1175 Exploited CVE-2026-18577 After Its Disclosure. Microsoft says China-linked Storm-1175 is exploiting N-able N-central authentication bypass CVE-2026-18577 to gain administrative RMM access, pivot into managed endpoints and rapidly deploy its new StormEncryptor ransomware. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-use-n-able-flaw-in-ransomware-attacks-a-32506