Tag: exploit
-
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs.Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker…
-
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, rce, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deserialization of untrusted data. The issue First seen…
-
New ChocoPoC malware targets researchers via trojanized PoC exploits
Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/
-
ChocoPoc malware delivered via trojanized exploits on GitHub
Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chocopoc-malware-delivered-via-trojanized-exploits-on-github/
-
Researchers spot exploitation of another critical Oracle defect
The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees. First seen on cyberscoop.com Jump to article: cyberscoop.com/oracle-ebs-critical-vulnerability-exploited/
-
Webinar: Why traditional email security is no longer enough
Modern phishing, business email compromise, and account takeover attacks increasingly exploit trusted identities and legitimate business workflows, making them harder for traditional email defenses to detect. This webinar explores how behavioral AI can help organizations automate detection and response. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/webinar-why-traditional-email-security-is-no-longer-enough/
-
Critical flaw in Oracle E-Business Suite is under immediate threat
Researchers warn that successful exploitation of the vulnerability could allow an attacker to compromise Oracle Payments. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-oracle-e-business-suite-threat/824230/
-
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
A recently disclosed critical security flaw impacting Progress”¯Kemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire’s Threat Response Unit (TRU).The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037 (CVSS score: 9.6), an operating system (OS) command injection flaw that could be exploited to achieve First seen on thehackernews.com Jump…
-
CISA Warns BlueHammer Flaw Is Now Exploited in Ransomware Attacks
CISA confirms BlueHammer (CVE-2026-33825) is now used in ransomware attacks to gain SYSTEM privileges through Microsoft Defender. BlueHammer, tracked as CVE-2026-33825, has moved from proof-of-concept noise to real ransomware attacks in the wild, the US CISA confirms. BlueHammer allows attackers to escalate privileges locally in Microsoft Defender. The vulnerability, along with two other zero-days dubbed…
-
Over 900 Oracle E-Business instances exposed to ongoing attacks
Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/
-
ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts
ToddyCat, an advanced persistent threat group long associated with targeted espionage against corporate environments, has evolved its toolkit to exploit OAuth-based authorization flows and compromise Gmail accounts without directly stealing credentials. Umbrij is deployed on Windows hosts using DLL sideloading: attackers place a malicious DLL alongside legitimately signed executables known to insecurely load libraries (examples…
-
CISA Adds Actively Exploited SimpleHelp Vulnerability to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in SimpleHelp, tracked as CVE-2026-48558, and added it to its Known Exploited Vulnerabilities (KEV) catalog. This indicates that the vulnerability is actively being exploited in the wild, and CISA is urging immediate remediation. The flaw, classified as CWE-347 (Improper Verification of Cryptographic…
-
CISA Adds Actively Exploited SimpleHelp Vulnerability to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in SimpleHelp, tracked as CVE-2026-48558, and added it to its Known Exploited Vulnerabilities (KEV) catalog. This indicates that the vulnerability is actively being exploited in the wild, and CISA is urging immediate remediation. The flaw, classified as CWE-347 (Improper Verification of Cryptographic…
-
Exploitarium: Anonymer Forscher leakt massenweise Zero-Day-Exploits
Ein öffentliches Github-Repository enthält 26 Exploits für Zero-Day-Lücken in mehreren populären Softwaretools. Und es werden immer mehr. First seen on golem.de Jump to article: www.golem.de/news/exploitarium-anonymer-forscher-leakt-massenweise-zero-day-exploits-2607-210388.html
-
RustDuck: The Botnet That’s Still Small but Engineering Like It Plans to Grow
RustDuck is a small, evolving DDoS botnet migrating to Rust. It uses advanced encryption, anti-analysis evasion, and exploits known IoT flaws. Since February 2026, researchers at QiAnXin’s XLab have been tracking a new malware family, called RustDuck, that hijacks routers, cameras, Android set-top boxes, and exposed servers, then uses them to flood targets with junk…
-
New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits
A sophisticated new botnet family dubbed RustDuck emerged in early 2026, leveraging a two-stage Loader and Core architecture to compromise IoT devices, routers, and enterprise servers through brute-force credential attacks and remote code execution vulnerabilities. RustDuck employs a multi-pronged infection strategy combining weak password attacks against Telnet and SSH services with exploitation of known RCE…
-
23 Exploits in ‘bikini/exploitarium”-Repository – Wenn der Exploit vor dem Advisory kommt
First seen on security-insider.de Jump to article: www.security-insider.de/ki-exploits-bikini-exploitarium-repository-a-11b55c25940d6393026954a7dfa78fe2/
-
Citrix Patches Six NetScaler Flaws Allowing File Read and DenialService
Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition.The vulnerabilities are listed below – CVE-2026-8451 (CVSS score: 8.8) – An insufficient input validation First…
-
Critical Oracle E-Business Suite bug actively exploited
First seen on scworld.com Jump to article: www.scworld.com/news/critical-oracle-e-business-suite-bug-actively-exploited
-
Anonymous researcher dumps zero-day exploits for multiple software products
First seen on scworld.com Jump to article: www.scworld.com/brief/anonymous-researcher-dumps-zero-day-exploits-for-multiple-software-products
-
Attack exploiting SimpleHelp vulnerability deploys novel loader, infostealer
First seen on scworld.com Jump to article: www.scworld.com/news/attack-exploiting-simplehelp-vulnerability-deploys-novel-loader-infostealer
-
Fake Bug Report Hijacks AI Coding Agents at Scale
Agentjacking is the latest demonstration of how easily attackers can exploit an AI agent’s inability to differentiate between content and instructions. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/fake-bug-report-hijacks-ai-coding-agents
-
Citrix patches a new NetScaler flaw with echoes of CitrixBleed
The bulletin includes six NetScaler issues, but attention is centered on a high-severity flaw with similarities to earlier actively exploited bugs. First seen on cyberscoop.com Jump to article: cyberscoop.com/citrix-netscaler-flaw-cve-2026-8451-citrixbleed/
-
Scammers race to cash in on Venezuelan earthquake disaster
Scammers wasted no time exploiting Venezuela’s devastating earthquake, with researchers uncovering 212 newly-registered relief-themed domains in just five days. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/scammers-cash-in-venezuela-earthquake
-
DICOM Toolkit Bugs Raise Medical Imaging Security Risks
Common AI Tools Helped Researcher Discover Hidden Flaws. Several newly identified vulnerabilities in a DICOM toolkit used in medical-imaging software could expose patient information, crash imaging services offline and pose other serious problems if exploited, said the researcher who discovered the flaws using commonly used artificial intelligence tools. First seen on govinfosecurity.com Jump to article:…
-
Nissan Traces Data Breach to PeopleSoft Zero-Day Exploit
Extortionists Add National Association of Insurance Commissioners to Breach List. Japanese automotive giant Nissan and the U.S. National Association of Insurance Commissioners are the latest organizations to confirm they fell victim to cyber extortionists who recently wielded a zero-day exploit against Oracle PeopleSoft, leading to the theft of data. First seen on govinfosecurity.com Jump to…
-
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Tags: ai, attack, crypto, cve, data-breach, endpoint, exploit, intelligence, rce, remote-code-execution, threat, vulnerabilityThreat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner.The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI) First seen on…
-
Critical flaw in SimpleHelp exploited in attacks targeting sensitive credentials
Researchers found two previously undisclosed malware samples used to steal AI assistant tokens and other valuable secrets. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-simplehelp-exploited-attacks-credentials/824105/
-
Critical SimpleHelp Vulnerability Exploited For Malware Delivery
Attackers exploited a critical SimpleHelp RMM bug to deploy TaskWeaver and Djinn Stealer malware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/simplehelp-rmm-vulnerability/
-
npm-Lieferkettenangriff auf KI-Framework Mastra – Gekapertes npm-Konto schleust Schadcode in 140 Mastra-Pakete
First seen on security-insider.de Jump to article: www.security-insider.de/mastra-npm-lieferkettenangriff-a-082843107ef0d041bb0263bbc1329843/