Tag: exploit
-
Researchers Discover OpenAI API Vulnerability That Leaks Hidden AI Reasoning Traces
Researchers have disclosed a vulnerability in the OpenAI API that reveals hidden reasoning traces by exploiting conversation compaction. This technique, named >>Compaction Smuggling,<< bypassed existing safeguards and could allow for the extraction of valuable training material from advanced models. According to Xint, OpenAI confirmed the issue, implemented an undisclosed fix on October 23, 2026, and…
-
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws…
-
Hackers Use Google Ads to Push Fake Claude Downloads Hosted on Real Claude.ai Domain
Hackers are buying Google Ads to promote fake Claude download pages hosted on Anthropic’s legitimate claude.ai domain, exploiting content-sharing features to distribute malware. The operation does not require compromising Anthropic’s infrastructure. Attackers publish malicious instructions through Shared Chats and public Artifacts, borrowing the platform’s domain and branding while persuading visitors to execute commands themselves. The…
-
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in “extremely sophisticated” targeted attacks on iOS devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/
-
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/
-
9 Managed File Transfer (MFT) Solutions: The 2026 Buyer’s Verdict Guide
MFT buying is posture-first now the category’s mass-exploitation years made exposure architecture and patch velocity selection criteria ahead of any scheduler. Roster honesty first: our sheet’s twelve rows resolve to nine vendors and eleven products Progress owns both MOVEit and WS_FTP, Fortra owns both GoAnywhere and Globalscape EFT, and ExaVault was acquired by Files.com years…
-
Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections
More than 400 incidents in which attackers abused Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware. Researchers identified recurring tenant names, deceptive display names, remote administration tools, and payload infrastructure across incidents. Teams federation, enabled by default, allows communication between organizations when both tenants permit external access. Attackers exploit…
-
Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones
Tags: attack, cyber, cybercrime, exploit, group, hacker, infrastructure, iphone, malicious, spyware, vulnerabilityCybercriminal groups are using malicious Instagram advertisements, abandoned analytics tags, and compromised websites to deliver Coruna and DarkSword exploit kits to vulnerable iPhones. The investigation exposes a scalable spyware distribution model in which attackers exploit advertising infrastructure to reach victims during ordinary browsing. Researchers describe these as “half-click” attacks: users must encounter an infected webpage…
-
71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/27/rapid7-vulnerability-exploitation-trends-q3-2026-report/
-
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Tags: cisa, cve, cvss, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments – CVE-2026-109618 – An out-of-memory First seen on…
-
Experts temper emergency-level alarms over critical Brotli defect
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild. First seen on cyberscoop.com Jump to article: cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/
-
InWild Attack Abuses AI Agents’ Trust in Markdown
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdown
-
Exposed LiteLLM Key Enabled PyPI Supply Chain Attack
Unrevoked Credential Exposed in May Enabled Repository Compromise in October. An attacker exploited an unrevoked LiteLLM master key to steal GitHub credentials, bypass release controls and publish a credential-stealing PyPI package downloaded roughly 50,000 times, exposing developer systems, cloud environments and AI provider secrets. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/exposed-litellm-key-enabled-pypi-supply-chain-attack-a-33211
-
Honeypots Now Recording inWild PHP2Shell Exploits
Exploit for PHP2Shell Shreds ‘Steal My Bitcoin’ Challenge. Never underestimate the power of a cash prize to separate cybersecurity hype from reality, as a researcher has bagged $2,000 in Bitcoin in a capture the flag contest to demonstrate an exploit for PHP2Shell in the wild. The winning CTF move followed reports of honeypots clocking in-the-wild…
-
ClickFix-Kampagnen gegen Krypto-Nutzer – Angreifer verstecken Schadcode in öffentlicher Google-Tabelle
First seen on security-insider.de Jump to article: www.security-insider.de/talos-krypto-skimmer-google-tabelle-fake-captcha-a-a26473b16f0ba28d816741681962fa47/
-
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public
Six Linux flaws were made public, including one with a working root exploit and no merged fix First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes/
-
New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials
A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets. The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. Rather than exploiting an identified vulnerability in these products, the malware…
-
Schadcode-Attacken möglich: Lücke in Brotli-Decoder gefährdet zahllose Anwendungen
Angreifer können aufgrund einer Sicherheitslücke in Brotli potenziell Schadcode über unzählige Apps einschleusen. Entwickler müssen dringend handeln. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-luecke-in-brotli-decoder-gefaehrdet-zahllose-anwendungen-2610-214507.html
-
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/
-
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/php-publishes-mitigation-advice/
-
Wegen Schadcode-Lücke: Forscher legen millionenfach installierten Updater still
Tags: exploitAngreifer hätten Millionen von Geräten über eine Lücke in einem veralteten Popcorn-Time-Fork kapern können. Wie Forscher das verhindert haben. First seen on golem.de Jump to article: www.golem.de/news/wegen-schadcode-luecke-forscher-legen-millionenfach-installierten-updater-still-2610-214498.html
-
Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal. The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev.dll. Rather than exploiting Windows Error Reporting itself, attackers impersonated its components and naming conventions, disguising malicious executables and scheduled…
-
Synthetic identities leave US lenders with $2.4 billion in fraud exposure
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/transunion-synthetic-identity-fraud-risks-report/
-
Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts
Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign. Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22. However, those figures include defensive scanners and do not establish successful server compromises.…
-
Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit
A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against the Steal My Bitcoin challenge. This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server. The researcher, using the GitHub username KillaBoi, published the exploit in…
-
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.”What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application,” a spokesperson for the company told…