Abandoned Popcorn Time updater could hijack PCs via CVE-2026-30612
Eye Security seized update domains, pushed a disabling fix with over two million downloads, then gave 15 domains to Shadowserver.
71
Organization
Shadowserver Foundation
- Mentions · 7d2
- Mentions · 30d2
- All mentions22
- First seenAug 25, 2026
- Last mentioned4d ago
Timeline
22 articles · newest firstEye Security pushed 2 million updates to disable Popcorn Time updater
CVE-2026-30612, scored 9.8, let anyone owning abandoned updater domains push code as SYSTEM or root.
72
Attackers have been exploiting critical Zimbra flaw to steal emails
Attackers are exploiting critical Zimbra flaw CVE-2026-73570 to steal organizational email and credentials.
85
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.
75
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Attackers exploit unauthenticated SQL injection CVE-2026-48842 in Roundcube webmail's virtuser_query plugin; Canadian Cyber Centre confirms in-the-wild exploitation, 500,000+ servers exposed.
75
F5 fixes actively exploited zero-day flaw in BIG-IP APM
F5 patched actively exploited BIG-IP APM zero-day CVE-2026-94127, a 9.8 CVSS heap overflow RCE added to CISA's KEV catalog.
90
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
78
MikroTik patches flaws currently being exploited to take over routers
MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.
82
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
78
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
76
MikroTik Patches Critical Flaws Chained to Hack Routers
MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.
84
Florida water agency latest to confirm cyber incident as feds warn of nation
A ransomware gang hit Florida's St. Johns River Water Management District as CISA warned of IRGC-linked CyberAv3ngers attacks on exposed Unitronics water-sector PLCs.
72
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.
82
Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast
Help Net Security week-in-review roundup: Claude infostealer lockouts, record Patch Tuesday, McKesson breach, SonicWall zero-days, PaperCut attacks.
28
Sality, one of the longest
US and European authorities, with CrowdStrike and Shadowserver, disrupted the 20-year-old Sality peer-to-peer botnet, severing 15,000+ infected machines from operators.
52
Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.
72
Global sinkhole operation ends Sality botnet’s 23-year run
Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.
65
Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
Law enforcement and CrowdStrike disrupted the 23-year-old Sality P2P botnet, isolating 15,000+ infected machines and seizing linked domains.
72
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
25
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
75
Unpatched Zimbra servers are falling to CVE-2026-73570 attacks
Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.
78
Related CVEs
by mentions- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- CVE-2026-860606%9.2Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
- CVE-2026-672769%9.2SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2025-4911399%8.8Authenticated PHP Object Deserialization RCE in Roundcube Webmail
- CVE-2026-672772%8.8Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
- CVE-2025-6846127%6.1Cross-Site Scripting via SVG animate Tag in Roundcube Webmail
- CVE-2026-30612<1%9.8Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android)
- CVE-2026-488422%8.1Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
Appears with
- CISAorganization · 8
- Shadowserver Foundationvendor · 5
- FBIorganization · 4
- Microsoftorganization · 3
- CrowdStrikeorganization · 3
- Salitymalware · 3
- CERT Polskaorganization · 3
- RouterOSproduct · 3
- Zimbravendor · 3
- ESETvendor · 3
- MikroTikvendor · 3
- CrowdStrikevendor · 3
- EggJaggermalware · 3
- Microsoftvendor · 3
- Synacorvendor · 2
- Time4Popcornproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.