Collecting Cyber-News from over 60 sources

Tag: exploit

Phishing Campaigns Exploit RCS and iMessage to Evade SMS Security Filters

May 26, 2026 10:00 AM

Tags: credentials, cyber, data, encryption, exploit, malicious, network, phishing, theft, threat

Phishing campaigns are entering a new phase as attackers abandon traditional SMS delivery and static credential theft in favor of encrypted messaging channels and real-time account takeover techniques. Unlike conventional SMS phishing, RCS and iMessage operate over data networks with end-to-end encryption, limiting carriers’ ability to inspect or block malicious content. Threat actors are exploiting…
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

May 26, 2026 9:00 AM

Tags: cve, exploit, flaw, vulnerability, zero-day

A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon.The vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to…
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

May 26, 2026 9:00 AM

Tags: cve, exploit, flaw, vulnerability, zero-day

A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon.The vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to…
Hackers Abuse KnowledgeDeliver LMS Flaw to Install BLUEBEAM Web Shell

May 26, 2026 8:00 AM

Tags: cve, cyber, exploit, flaw, google, hacker, intelligence, mandiant, remote-code-execution, threat, vulnerability

Hackers are actively exploiting a critical vulnerability in the KnowledgeDeliver Learning Management System (LMS) to deploy the BLUEBEAM web shell, according to findings from Mandiant’s Google Threat Intelligence Group. The flaw, tracked as CVE-2026-5426, enables unauthenticated remote code execution through ASP.NET ViewState deserialization and has been observed in real-world attacks. KnowledgeDeliver LMS Flaw The vulnerability…
Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

May 25, 2026 9:00 PM

Tags: attack, cve, exploit, flaw, threat

Attackers are exploiting the patched Ghost CMS flaw CVE-2026-26980, compromising over 700 unpatched sites, including universities. Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and…
Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

May 25, 2026 3:00 PM

Tags: api, attack, cve, data, exploit, flaw, injection, malicious, sql, threat, vulnerability

Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks.According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost’s Content API that could allow an unauthenticated attacker to read arbitrary…
Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

May 25, 2026 3:00 PM

Tags: api, attack, cve, data, exploit, flaw, injection, malicious, sql, threat, vulnerability

Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks.According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost’s Content API that could allow an unauthenticated attacker to read arbitrary…
The AI Era Is Creating a Bug Hunting Arms Race

May 25, 2026 1:02 PM

Tags: ai, exploit, software, vulnerability

As attackers ramp up their AI exploit development, the search for software vulnerabilities is changing rapidly. First seen on wired.com Jump to article: www.wired.com/story/the-ai-era-is-creating-a-bug-hunting-arms-race/
CISA Warns Drupal Core SQL Injection Vulnerability Is Being Exploited in Attacks

May 25, 2026 12:00 PM

Tags: attack, cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, injection, kev, risk, sql, vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical SQL injection vulnerability in Drupal Core, tracked as CVE-2026-9082, which is now being actively exploited in the wild. The flaw has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling a high risk to organizations using affected Drupal deployments.…
Hackers Exploit Azure RBAC to Steal Key Vault Secrets

May 25, 2026 12:00 PM

Tags: access, attack, cloud, cyber, data, exploit, hacker, identity, threat

Hackers are increasingly exploiting cloud identity and access management systems, and a methodical, sophisticated, and multi-layered attack, where a threat actor we track as Storm-2949 launched a relentless campaign with a singular focus: to exfiltrate as much sensitive data from a target organization’s high-value assets as possible. The attack, attributed to a threat actor tracked…
Fake Streams, Counterfeit Merch and Other Scams: How Fraudsters Target F1 Fans

May 25, 2026 12:00 PM

Tags: cybersecurity, exploit, scam, threat

From fake F1 streams to counterfeit merch, fraudsters are exploiting fans online and the Bitdefender Cybersecurity Grand Prix Fan Threat Index details how First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/how-fraudsters-target-f1-fans/
Hackers Exploit Shared CDNs to Evade Domain Reputation Filters

May 25, 2026 11:00 AM

Tags: control, cyber, exploit, flaw, hacker, infrastructure, network, software

Hackers are increasingly abusing shared Content Delivery Network (CDN) infrastructure to bypass domain-reputation-based security controls using a newly identified technique called “Underminr.” Underminr is not a conventional software flaw but an inherent weakness in how modern CDNs handle multi-tenant traffic. CDN providers such as Cloudflare, Akamai, AWS CloudFront, and Fastly route traffic for millions of…
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

May 24, 2026 5:00 PM

Tags: attack, exploit, flaw, injection, malicious, sql, vulnerability

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/
Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited

May 24, 2026 11:00 AM

Tags: exploit, flaw, github, WeeklyReview

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/24/week-in-review-github-breached-via-poisoned-vs-code-extension-critical-nginx-flaw-exploited/
U.S. CISA adds a flaw in Drupal Core to its Known Exploited Vulnerabilities catalog

May 24, 2026 11:00 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Drupal Core to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in Microsoft Exchange Server, tracked as CVE-2026-9082 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. Drupal issued a highly critical security patch on May…
U.S. CISA adds a flaw in Drupal Core to its Known Exploited Vulnerabilities catalog

May 24, 2026 11:00 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Drupal Core to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in Microsoft Exchange Server, tracked as CVE-2026-9082 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. Drupal issued a highly critical security patch on May…
CVE-2026-9082: Drupal’s Highly Critical SQL Injection Flaw Is Already Under Active Attack

May 23, 2026 8:00 PM

Tags: attack, cve, exploit, flaw, injection, sql, update, vulnerability

Attackers began exploiting Drupal SQL injection flaw CVE-2026-9082 within 48 hours of patch release. Drupal issued a highly critical security patch on May 20 for CVE-2026-9082, a SQL injection vulnerability that allows unauthenticated attackers to compromise sites running PostgreSQL databases. The project maintainers warned ahead of the release that exploits could surface within hours or…
RondoDox Botnet Exploits Critical 2018 Vulnerability to Hijack ASUS Routers

May 23, 2026 2:00 PM

Tags: authentication, botnet, cybersecurity, exploit, hacker, router, vulnerability

Cybersecurity firm VulnCheck reveals hackers are using a critical 2018 vulnerability to bypass authentication and hack over a million ASUS routers. First seen on hackread.com Jump to article: hackread.com/rondodox-botnet-2018-vulnerability-hijack-asus-routers/
RondoDox Botnet Exploits Critical 2018 Vulnerability to Hijack ASUS Routers

May 23, 2026 2:00 PM

Tags: authentication, botnet, cybersecurity, exploit, hacker, router, vulnerability

Cybersecurity firm VulnCheck reveals hackers are using a critical 2018 vulnerability to bypass authentication and hack over a million ASUS routers. First seen on hackread.com Jump to article: hackread.com/rondodox-botnet-2018-vulnerability-hijack-asus-routers/
The FBI Wants ‘Near Real-Time’ Access to US License Plate Readers

May 23, 2026 1:00 PM

Tags: access, deep-fake, exploit, flaw, google

Plus: Google publishes a live exploit for an unpatched flaw, the feds arrest two men accused of creating thousands of nonconsensual deepfake nudes, and more. First seen on wired.com Jump to article: www.wired.com/story/security-news-this-week-fbi-license-plate-reader-real-time-access/
Hackers Exploit F5 BIG-IP to Gain SSH Access and Pivot Into Linux Networks

May 23, 2026 1:00 PM

Tags: access, attack, cyber, exploit, hacker, intelligence, linux, microsoft, network, threat, unauthorized

Threat actors are actively exploiting end-of-life F5 BIG-IP appliances to gain unauthorized SSH access into enterprise networks, using the compromised devices as launchpads for sophisticated multi-stage intrusion campaigns that ultimately target Active Directory infrastructure. Microsoft Threat Intelligence disclosed the full attack chain on May 22, 2026, documenting how a single compromised edge appliance cascaded into…
Hackers Exploit F5 BIG-IP to Gain SSH Access and Pivot Into Linux Networks

May 23, 2026 1:00 PM

Tags: access, attack, cyber, exploit, hacker, intelligence, linux, microsoft, network, threat, unauthorized

Threat actors are actively exploiting end-of-life F5 BIG-IP appliances to gain unauthorized SSH access into enterprise networks, using the compromised devices as launchpads for sophisticated multi-stage intrusion campaigns that ultimately target Active Directory infrastructure. Microsoft Threat Intelligence disclosed the full attack chain on May 22, 2026, documenting how a single compromised edge appliance cascaded into…
LiteSpeed cPanel Plugin 0-Day Exploited for Server Root Access

May 23, 2026 12:00 PM

Tags: access, cvss, cyber, exploit, flaw, vulnerability, zero-day

A critical zero-day privilege escalation vulnerability in the LiteSpeed User-End cPanel plugin is being actively exploited in the wild, enabling any authenticated cPanel user to execute arbitrary scripts as root and gain full server control. Tracked as CVE-2026-48172 with a maximum CVSS score of 10.0, the flaw has been patched as of May 21, 2026. The root cause is a logic…
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

May 23, 2026 11:00 AM

Tags: cve, exploit, flaw, vulnerability

A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild.The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to run arbitrary scripts with elevated permissions.”Any cPanel user (including an attacker or a compromised account) may First…
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

May 23, 2026 11:00 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, sql, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core.”Drupal Core First seen on…
Organizations knowingly ship vulnerable code amid shrinking exploit windows

May 23, 2026 6:00 AM

Tags: exploit, vulnerability, windows

First seen on scworld.com Jump to article: www.scworld.com/brief/organizations-knowingly-ship-vulnerable-code-amid-shrinking-exploit-windows
CISA adds Trend Micro Apex One and Langflow flaws to exploited vulnerabilities catalog

May 23, 2026 6:00 AM

Tags: cisa, exploit, flaw, vulnerability

First seen on scworld.com Jump to article: www.scworld.com/brief/cisa-adds-trend-micro-apex-one-and-langflow-flaws-to-exploited-vulnerabilities-catalog
‘Underminr’ exploitation poses similar risks to domain fronting, researchers say

May 23, 2026 6:00 AM

Tags: exploit, risk

First seen on scworld.com Jump to article: www.scworld.com/news/underminr-exploitation-poses-similar-risks-to-domain-fronting-researchers-say
‘Underminr’ exploitation poses similar risks to domain fronting, researchers say

May 23, 2026 6:00 AM

Tags: exploit, risk

First seen on scworld.com Jump to article: www.scworld.com/news/underminr-exploitation-poses-similar-risks-to-domain-fronting-researchers-say
Attackers exploit SonicWall VPN vulnerability to bypass MFA

May 23, 2026 6:00 AM

Tags: exploit, mfa, vpn, vulnerability

First seen on scworld.com Jump to article: www.scworld.com/brief/attackers-exploit-sonicwall-vpn-vulnerability-to-bypass-mfa