SimpleHelp

Search everything

Mentions · 7d0
Mentions · 30d2
All mentions5
First seenSep 1, 2026
Last mentioned7d ago

Timeline

5 articles · newest first

INC and Gentlemen affiliates used AI agents in ransomware intrusions

Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.

The Hacker NewsOct 23, 17:50 UTC · 7d agoRansomwareExploitedCVE-2024-57727 CVE-2026-35616 CVE-2026-41940+47 · 2 reads

Ransomware affiliates using Claude left chats and tools exposed

SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.

Cyber Security NewsOct 21, 11:49 UTC · 9d agoRansomwareCVE-2026-35616 CVE-2024-57727 CVE-2026-419408 · 4 reads

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

The Hacker NewsSep 2, 10:21 UTC · Sep 2, 2026Exploit / PoCExploitedCVE-2026-82078 CVE-2026-815783 · 1 read

Attackers plant remote access tools on compromised PaperCut servers

Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.

Help Net SecuritySep 2, 08:12 UTC · Sep 2, 2026Exploit / PoCExploitedCVE-2026-81578 CVE-2026-820783

SimpleHelp OpenID Connect Auth Bypass to RCE [CVE-2026-48558]

Metasploit adds a module chaining SimpleHelp OpenID Connect authentication bypass to remote code execution, tracked as CVE-2026-48558.

Metasploit Framework commitsSep 1, 20:43 UTC · Sep 1, 2026Exploit / PoCCVE-2026-485582

Related CVEs

by mentions

CVE-2026-3561694%9.8
Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
published Apr 4, 2026Fortinet FortiClient EMSKEVPoC
CVE-2026-8207861%9.4
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
published Aug 28, 2026PaperCut NGKEV
CVE-2026-4194099%9.3
Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
published Apr 29, 2026WebPros cPanelKEVRansomwarePoC ×9
CVE-2026-8157884%8.8
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
published Aug 28, 2026PaperCut MFKEV
CVE-2024-5772797%7.5
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/remote access software)KEVRansomware
CVE-2026-154097%10.0
Unauthenticated SSRF in SonicWall SMA1000 Appliances
published Jul 14, 2026SonicWall SMA1000 Appliances (SMA 6210 firmware)KEVRansomwarePoC
CVE-2026-908289%9.8
Actively Exploited SQL Injection in Drupal Core
published May 20, 2026Drupal CoreKEV
CVE-2026-6303011%9.8
WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
published Jul 17, 2026WordPress CoreKEVPoC ×7
CVE-2026-4855878%9.5
Authentication Bypass via Forged OIDC Tokens in SimpleHelp
published Jun 12, 2026SimpleHelpKEV
CVE-2026-4220889%9.3
SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild
published May 8, 2026BerriAI LiteLLM (proxy server / AI gateway)KEVPoC

Appears with

Rapid7vendor · 2
Fortinetvendor · 2
cPanelvendor · 2
PaperCut NGproduct · 2
watchTowrvendor · 2
FortiClient EMSproduct · 2
PaperCut MFproduct · 2
AnyDeskvendor · 2
RevSocksmalware · 2
PaperCutvendor · 2
Huntressvendor · 2
SimpleHelpproduct · 2
Phantommalware · 2
OpenCodeproduct · 2
SOCRadarorganization · 2
The Gentlementhreat actor · 2

Entities are extracted by the model from each article. First seen Sep 1, 2026, last mentioned 7d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.