Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
- Mentions · 7d5
- Mentions · 30d14
- All mentions20
- First seenAug 28, 2026
- Last mentioned19h ago
Timeline
20 articles · newest firstExploitation attempts hit patched Oracle EBS flaw CVE-2026-101767
Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.
74
PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
30
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
86
CISA confirms active exploitation of two PHP2Shell RCE flaws
Both flaws score CVSS 9.2; fixes shipped October 21, and US agencies must patch by October 29.
90
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
74
PHP2Shell exploitation began days before the patches
Amazon says probing started October 17; CISA urges PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
92
France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack
French internet-exposed Danfoss StoreView controllers fell 71 percent within three days after a supermarket cyber-attack.
74
Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.
84
The internet’s attack surface moves at very different speeds
Censys says publicly exposed AI software grew 63% in nine months, led by vulnerable n8n hosts.
66
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
iVerify details P7 DarkSword, an iOS exploit kit that steals keychains and crypto wallets and accepts remote commands.
77
DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
DarkSword's Coruna malware uses iOS browser exploits to steal cryptocurrency wallet recovery phrases from iPhones.
72
Exposed DarkSword iOS Servers Reveal Crypto Wallet Theft From Compromised iPhones
Censys-exposed DarkSword/Coruna servers reveal an iOS exploitation-as-a-service platform stealing crypto wallet secrets, including 11 victim recovery phrases.
65
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
93
Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers
Attackers exploited critical cPanel CVE-2026-41940 on hosting servers, deploying Mirai variants and ransomware.
85
Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication root RCE in Security Management and Log Servers; no exploitation observed.
65
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication stack overflow letting unauthenticated attackers run code as root on Security Management and Log Servers.
66
The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet
Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.
45
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
65
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-91843<1%9.8Unauthenticated stack overflow gives root RCE in Check Point login process
- CVE-2025-242014%10.0WebKit Out-of-Bounds Write Sandbox Escape in Apple iOS, Safari, and macOS
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-162324%9.3Authentication Bypass in Check Point SmartConsole Grants Full Admin Access
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2025-41451<1%8.7Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version…
- CVE-2025-41450<1%8.2Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
Appears with
- CISAorganization · 6
- DarkSwordmalware · 3
- Miraimalware · 3
- Cloudflareorganization · 3
- VulnCheckorganization · 3
- Sophosorganization · 3
- Corunamalware · 3
- Applevendor · 3
- PHPproduct · 3
- watchTowrorganization · 3
- Censysvendor · 3
- Amazonorganization · 3
- PHPvendor · 3
- iOSproduct · 3
- Check Pointorganization · 2
- Cl0pthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.