Chainalysis Credential Spill Forces Key Rotation
Chainalysis Credential Spill Forces Key Rotation Chainalysis says password hashes and live tokens for all users were exposed during its cyber incident,...
OpenSSH's 257-Byte Key
OpenSSH's 257-Byte Key OpenSSH 10.6p2 fixes a critical authentication bypass on affected Alpine Linux systems where overlong passwords could open key-only...
WordPress Upgrade Window Under Active Attack
WordPress Upgrade Window Under Active Attack CISA says attackers are exploiting WordPress Core CVE-2026-119977 to race the brief full-upgrade window and run...
Open Flow: Node-RED Flaw Under Attack
Open Flow: Node-RED Flaw Under Attack Attackers are exploiting CVE-2026-58115 to abuse exposed Node-RED interfaces on Siemens SIMATIC IoT2050 devices and run...
Cursor Extension Backdoor
Cursor Extension Backdoor Malicious Claude Code-branded extension versions 2.1.312 and 2.1.313 in Cursor’s marketplace attempted SSH persistence and host...
Drupal Checkout Bypass Under Active Exploitation
Drupal Checkout Bypass Under Active Exploitation Drupal says attackers are exploiting CVE-2026-118539, an authorization bypass in Commerce Core that may let...
VPN Knockout: Cisco Patches Exploited Firewall Flaw
VPN Knockout: Cisco Patches Exploited Firewall Flaw Cisco patched actively exploited CVE-2026-76418, which can let unauthenticated requests force exposed ASA...
Oracle EBS Suite Break-In
Oracle EBS Suite Break-In Attackers are probing Oracle E-Business Suite CVE-2026-101767, a critical unauthenticated SQL injection flaw that can lead to...
PHP2Shell Moves to Active Exploitation
PHP2Shell Moves to Active Exploitation CISA says PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 are actively exploited, allowing unauthenticated remote...
PHP2Shell now reaches working shells
PHP2Shell now reaches working shells Researchers observed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) execute shells on honeypots after broad probing....
PHP2Shell Probes Surge as Botnet Operators Test Critical PHP Flaws
PHP2Shell Probes Surge as Botnet Operators Test Critical PHP Flaws Mass probing is targeting PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, with...
GitLab Regex Overflow Opens the Repository Door
GitLab Regex Overflow Opens the Repository Door GitLab patched CVE-2026-110264, a CVSS 10.0 integer overflow in its regex compiler that could let...
PHP2Shell Emergency Fixes Land
PHP2Shell Emergency Fixes Land PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two runtime flaws that can give unauthenticated...
Rank Math PRO backdoor shipped through trusted updates
Rank Math PRO backdoor shipped through trusted updates A subset of Rank Math PRO 3.0.123 packages distributed during an 11-hour window carried persistent...
Broadcom Wi-Fi Forever Day
Broadcom Wi-Fi Forever Day A newly disclosed Broadcom WPS flaw can let nearby attackers run code as root without the Wi-Fi password; no CVE or active...
SneakPeek: Claude Code’s Preview Trap
SneakPeek: Claude Code’s Preview Trap SneakPeek let poisoned HTML in Claude Code Desktop’s preview pane expose local credentials; Anthropic fixed it in...
Defrost Protocol: France’s Cold Chain Goes Hot
Defrost Protocol: France’s Cold Chain Goes Hot Attackers hijacked Internet-exposed refrigeration controllers across French supermarkets, forcing defrost...
Ivanti Ghost Commands Breach the VPN Gate
Ivanti Ghost Commands Breach the VPN Gate Attackers are exploiting Ivanti Connect Secure CVE-2026-104935 to run unauthenticated commands, steal credentials,...
The Wall Called Inside: SonicWall SMA1000 Exploitation
The Wall Called Inside: SonicWall SMA1000 Exploitation Attackers are probing CVE-2026-102255, a CVSS 10 pre-authentication SSRF in SonicWall SMA1000 that can...
Backup Overtime: AhsayCBS Flaws Fuel Cryptominers
Backup Overtime: AhsayCBS Flaws Fuel Cryptominers Attackers are chaining AhsayCBS CVE-2026-105133 and CVE-2026-105134 for unauthenticated code execution,...