Search: “decryption”

228 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 1480 Malware 1255 Vulnerability 555 Threat actor 239 Exploit / PoC 228 Data breach 223 Industry 163 Policy & legal 118 Phishing & fraud 75 Research 73 AI tools & infra 24 Advisory 21 AI safety & security 18 Tools 10

SeverityAll critical 1198 high 2033 medium 864 low 328 info 72

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 7d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

Attack on French Diplomat Linked to Operation Lotus Blossom

Palo Alto Unit 42Nov 1, 09:57 UTC · Nov 1, 2018Exploit / PoC CVE-2014-6332

FinSpy: unseen findings

Kaspersky SecurelistSep 28, 14:45 UTC · Sep 28, 2021Exploit / PoC

New Attacks Linked to C0d0so0 Group

Palo Alto Unit 42Nov 1, 10:03 UTC · Nov 1, 2018Exploit / PoC

DirtyDecrypt: PoC Released for yet another Linux flaw

Security AffairsMay 20, 07:36 UTC · May 20, 2026Exploit / PoC in the wildCVE-2026-31635 CVE-2026-31431 CVE-2026-43284+4 CVEs

Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue

Palo Alto Unit 42Nov 1, 10:41 UTC · Nov 1, 2018Exploit / PoC in the wildCVE-2016-7855 CVE-2016-7255 CVE-2015-76451

The big questions from FTI's report on the Jeff Bezos hack

CyberScoopJan 24, 16:37 UTC · Jan 24, 2020Exploit / PoC in the wild

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security NewsSep 8, 16:50 UTC · 7d agoExploit / PoC in the wildCVE-2025-252491

Coruna framework: an exploit kit and ties to Operation Triangulation

Kaspersky SecurelistMar 26, 08:00 UTC · Mar 26, 2026Exploit / PoC CVE-2023-32434 CVE-2023-38606

Critical Nginx UI flaw CVE-2026

Security AffairsMar 8, 19:10 UTC · Mar 8, 2026Exploit / PoC CVE-2026-27944

If you don’t control your keys, you don’t control your data

CyberScoopJan 28, 14:46 UTC · Jan 28, 2026Exploit / PoC in the wild

Wifi networks are vulnerable to hacking WPA KRACK attack

Security AffairsOct 29, 18:16 UTC · Oct 29, 2017Exploit / PoC CVE-2017-13077 CVE-2017-13078 CVE-2017-13079+7 CVEs

Password manager OneLogin hacked, attackers could 'decrypt encrypted data'

CyberScoopJun 1, 16:50 UTC · Jun 1, 2017Exploit / PoC in the wild

CVE-2015

Kaspersky SecurelistMay 25, 10:56 UTC · May 25, 2016Exploit / PoC CVE-2015-2545 CVE-2015-1701

DeadBolt is hitting QNAP NAS devices via zero-day bug, what to do?

Help Net SecuritySep 12, 09:31 UTC · Sep 12, 2022Exploit / PoC

Bitter APT adds Bangladesh to their targets

Cisco TalosMay 11, 12:00 UTC · May 11, 2022Exploit / PoC CVE-2017-11882 CVE-2018-0798 CVE-2018-0802+1 CVEs

Chrome 0-day exploit CVE-2019

Kaspersky SecurelistNov 1, 16:00 UTC · Nov 1, 2019Exploit / PoC CVE-2019-13720

Second flaw found in Swiss election system could change 'valid votes into nonsense,' researchers say

CyberScoopMar 25, 13:51 UTC · Mar 25, 2019Exploit / PoC in the wild

Here's How eFail Attack Works Against PGP and S/MIME Encrypted Emails

The Hacker NewsMay 15, 00:00 UTC · May 15, 2018Exploit / PoC

Apple rolls out quantum

CyberScoopFeb 21, 14:43 UTC · Feb 21, 2024Exploit / PoC in the wild

IT threat evolution Q1 2019

Kaspersky SecurelistMay 23, 10:00 UTC · May 23, 2019Exploit / PoC CVE-2019-0797 CVE-2018-8589

Cryptographic breakthrough allows using handshake-style encryption for time-delayed communications

Help Net SecurityMay 7, 00:00 UTC · May 7, 2019Exploit / PoC

ROBOT Attack: RSA TLS crypto attack worked against Facebook, PayPal, and tens of 100 top domains

Security AffairsDec 13, 16:19 UTC · Dec 13, 2017Exploit / PoC CVE-2017-6168 CVE-2017-17382 CVE-2017-17427+6 CVEs

IARPA director: New homomorphic crypto is 'math magic'

CyberScoopMar 31, 01:30 UTC · Mar 31, 2017Exploit / PoC in the wild

Researchers discovered severe flaws in the Confide app which is also used by White House staffers

Security AffairsMar 9, 15:12 UTC · Mar 9, 2017Exploit / PoC

IT threat evolution Q3 2014

Kaspersky SecurelistNov 18, 10:10 UTC · Nov 18, 2014Exploit / PoC CVE-2011-0611 CVE-2013-2465 CVE-2013-1347+3 CVEs

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.

Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.

Security AffairsSep 11, 07:11 UTC · 5d agoExploit / PoC in the wildCVE-2026-154091

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

HuntressSep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1