Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
- Mentions · 7d0
- Mentions · 30d0
- All mentions14
- First seenAug 17, 2026
- Last mentionedSep 27, 2026
Timeline
14 articles · newest firstChinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
82
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
82
Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords
Chinese-speaking actor exploited WordPress flaws affecting 49 orgs, stealing 18,566 government records including plaintext passwords.
80
U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog
CISA added exploited Zyxel GS1900 switch flaw CVE-2026-7273 to the KEV catalog, with a September 24 fix deadline.
74
CISA Warns of Zyxel GS1900 Switches Flaw Actively Exploited in Attacks
CISA added exploited Zyxel GS1900 buffer overflow CVE-2026-7273 to KEV, warning of unauthenticated command execution.
80
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.
90
Zyxel security advisory (AV26-603) – Update 1
Canada's Cyber Centre says Zyxel GS1900 buffer overflow CVE-2026-7273 is now in CISA's KEV catalog.
71
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added actively exploited Zyxel GS1900 stack buffer overflow CVE-2026-7273 to the Known Exploited Vulnerabilities catalog.
76
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
80
Home & Small Office Wireless Routers Exploited to Attack Gaming Servers
Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.
38
Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
40
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
42
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
Related CVEs
by mentions- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2026-3490968%10.0Unauthenticated Path Traversal in Ubiquiti UniFi OS Devices
- CVE-2026-3491090%10.0Unauthenticated Command Injection in Ubiquiti UniFi OS Devices
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2021-4642294%9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication
- CVE-2026-54569<1%9.8SENAITE.CORE: The SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing…
- CVE-2026-56271<1%9.3Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and…
- CVE-2026-797565%8.7Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform)
Appears with
- CISAorganization · 7
- GreyNoiseorganization · 5
- WordPressproduct · 4
- GS1900product · 4
- Ubiquitivendor · 3
- Giteaproduct · 3
- Palo Alto Networksvendor · 3
- Tendavendor · 3
- Miraimalware · 3
- Zyxel GS1900product · 3
- Unit 42organization · 3
- Red Heronthreat actor · 3
- TP-Linkvendor · 2
- D-Linkvendor · 2
- ISCASorganization · 2
- Proxmox VEproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.