Tag: flaw
-
Researchers Use AI to Discover Critical Linux Kernel Flaw That Enables Virtual Machine Escape
Researchers at pwn.ai used an AI-assisted research harness to find a critical Linux kernel networking flaw, tracked as CVE-2026-99999 and nicknamed >>PwnEscape<<. It lets an untrusted guest virtual machine leak host kernel memory and, in lab conditions, escape to the host. The bug is in the Linux networking stack, not in KVM or any hypervisor.…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
-
New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting vulnerabilities in network appliances and enterprise software to monetize victims’ internet connections. GreyNoise identified an attacker installing Pawns.app, a legitimate bandwidth-sharing application, without device owners’ consent, turning compromised systems into commercial residential proxy nodes. Unlike conventional VPN or hosting infrastructure,…
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a First…
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
-
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel’s live cloud sandboxes, and Vercel confirmed it.The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel’s networking code, not…
-
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cisco, cybersecurity, email, exploit, flaw, infrastructure, kev, network, threat, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Cisco confirmed this week that threat actors are exploiting a critical vulnerability…
-
Cryptohack Roundup: Ledger Halts Sales Amid $86M Theft Probe
Also: UK Sanctions Crypto Exchanges Over Russian Sanctions Evasion. This week, Ledger halted wallet sales across Asia, the United Kingdom sanctioned a crypto exchange for evading sanctions on Russia, hackers deployed cryptocurrency miners through AhsayCBS flaws, a British court ruled on a $5 billion bitcoin ownership dispute and XRP Ledger fixed a token-creation bug. First…
-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives First seen…
-
Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in…
-
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. PAN-OS zero-day vulnerability The flaw is a code injection weakness (CWE-94, CAPEC-242) in the…
-
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.A fourth…
-
Next.js Ships OutBand Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.The fixes are in First seen…
-
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site’s server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist…
-
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site’s server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist…
-
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted/
-
Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution
Vercel has released an out-of-band security update for Next.js that fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) bug. One of the critical flaws, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), sits in the Image Optimization API and is triggered through SVG processing. Next.js SVG vulnerability According to security disclosures published by Vercel, the update…
-
Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise
Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw…
-
PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
A public proof-of-concept (PoC) exploit is now available for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient Endpoint Management Server (EMS). The flaw has been exploited in the wild since spring 2026. FortiClient EMS authentication bypass According to details published by GitHub user Alaatk, a repository titled >>CVE-2026-35616 FortiClient EMS Pre-Auth Bypass<< contains a Python…
-
Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Tags: ai, cve, exploit, flaw, intelligence, open-source, rce, remote-code-execution, threat, vulnerabilityThreat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case…
-
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.In a report published earlier First…
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.”A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables…
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.”A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables…
-
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a…
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a…
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a…
-
Anthropic ‘SneakPeek’ Flaw Is a Silent Zero-Click Threat
A bug in Claude Code Desktop’s preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat