ZyXEL GS1900 (Product): news timeline & CVEs

Related CVEsby mentions

CVE-2026-630309.810%

WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE

published Jul 17, 2026· WordPress Core KEV PoC ×3

CVE-2026-601375.96%

WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)

published Jul 17, 2026· WordPress Core KEV

CVE-2026-3491010.046%

Unauthenticated Command Injection in Ubiquiti UniFi OS Devices

published May 22, 2026· Ubiquiti (ui) UniFi OS KEV PoC

CVE-2026-3490810.015%

Improper Access Control in Ubiquiti UniFi OS Devices (CVE-2026-34908)

published May 22, 2026· Ubiquiti UniFi OS Server KEV PoC

CVE-2026-3490910.02%

Unauthenticated Path Traversal in Ubiquiti UniFi OS Devices

published May 22, 2026· Ubiquiti UniFi OS Server KEV PoC

CVE-2026-600049.824%

Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection

published Aug 26, 2026· Gitea KEV PoC ×4

CVE-2026-72738.83%

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

published Jun 16, 2026· Zyxel GS1900 Series Switches KEV PoC

CVE-2022-08477.893%

Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel

published Mar 10, 2022· Linux Kernel KEV PoC ×4

CVE-2026-545699.8<1%

SENAITE.CORE: The SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing…

published Aug 26, 2026

CVE-2026-797568.75%

Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform)

published 24d ago· Nuclio (open-source project) Nuclio Dashboard (local/Docker platform)

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.

GreyNoise says a Chinese-speaking actor linked to Red Heron exploited WordPress core wp2shell flaws CVE-2026-63030 and CVE-2026-60137, breaching at least 49 organizations in 29 countries. One Western government intrusion produced at least 18,566 SQL records with accounts, plaintext passwords, and law-enforcement PII after AMSI bypass, token theft, local-admin creation, and password spraying. On August 17 the actor used CVE-2026-7273 to compromise 996 Zyxel GS1900 switches in 48 countries and also targeted UniFi OS, PAN-OS GlobalProtect, FlowiseAI, Gitea, Nuclio, Proxmox VE, SENAITE LIMS, and Dirty Pipe. CISA has the three UniFi bugs on the KEV list; GreyNoise published backdoor and C2 indicators.

BleepingComputerSep 22, 20:35 UTC · 4d agoThreat actor in the wildCVE-2026-63030 CVE-2026-60137 CVE-2026-7273+9 CVEs1

Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords

Chinese-speaking actor exploited WordPress flaws affecting 49 orgs, stealing 18,566 government records including plaintext passwords.

A suspected Chinese-speaking threat actor has exploited WordPress vulnerabilities to compromise at least 49 organizations across 29 countries, stealing 18,566 records from a western government including accounts, plaintext passwords, and personally identifiable information. The attackers used the wp2shell exploit chain (CVE-2026-63030 and CVE-2026-60137) to deploy webshells, create hidden admin accounts, and move laterally to internal systems. The campaign also targeted ZyXEL GS1900 switches, with 996 devices compromised or having sensitive information exfiltrated across 48 countries.

Cyber Security NewsSep 22, 09:51 UTC · 5d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-60137

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.

GreyNoise identified a suspected Chinese-speaking threat actor ('Red Heron') conducting widespread exploitation across multiple technologies since June 2026. The actor exploited Ubiquiti, WordPress, ZyXEL, Gitea, and other products, stealing over 18,000 sensitive records from a western government. A novel zero-day exploitation of CVE-2026-7273 in ZyXEL GS1900 switches affected 996 devices globally. GreyNoise observed patterns suggesting the actor used LLMs to generate custom attack tools.

GreyNoiseSep 21, 00:00 UTC · 6d agoThreat actor in the wildCVE-2026-7273 CVE-2026-34908 CVE-2026-34909+9 CVEs

ZyXEL GS1900

Timeline3 articles

Related CVEsby mentions

Appears with

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation