Search: “Conditional Access”

8 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 28 Exploit / PoC 15 Advisory 12 AI safety & security 12 Research 7 Industry 6 Data breach 4 Model release 4 Malware 4 AI industry 4 Phishing & fraud 4 Threat actor 4 AI research 3 Policy & legal 3

SeverityAll critical 9 high 47 medium 19 low 0 info 41

New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.

The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.

SecurityWeekupdated Sep 10, 12:18 UTC · 6d agofirst Sep 10, 07:09 UTC · 6d agoExploit / PoC 3 sources CVE-2026-50656 CVE-2026-694141

ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

ConnectWise patched critical ScreenConnect flaw CVE-2026-84869 (CVSS 9.9) exploited since August 20 in worm-like attacks; CISA added it to KEV.

ConnectWise released urgent patches for CVE-2026-84869 (CVSS 9.9), a missing authorization and improper privilege management flaw in ScreenConnect allowing file transfer and execution through active remote sessions without host confirmation. Huntress reported in-the-wild exploitation since August 20, with attackers using rogue ScreenConnect clients to push four VBScript files for persistence and worm-like propagation to other ScreenConnect clients. The flaw is fixed in ScreenConnect 26.6.5, with disabling the TransferFiles permission as a temporary mitigation. CISA added the CVE to its KEV catalog, requiring federal agencies to patch within three days under BOD 26-04.

SecurityWeekupdated 15:31 UTC · 1h agofirst Sep 14, 08:25 UTC · 2d agoExploit / PoC in the wild 5 sources CVE-2026-848691

Google Pixel owners urged to patch actively exploited modem flaw

Google's September 2026 Pixel bulletin fixes 110 vulnerabilities, including CVE-2026-58704, a modem permission bypass under limited targeted exploitation enabling remote privilege escalation.

Google released the September 2026 Pixel Update Bulletin addressing 110 vulnerabilities, including CVE-2026-58704, a high-severity logic error in the cellular modem that allows remote escalation of privilege with no additional execution privileges or user interaction required. Google says there are indications the flaw may be under limited, targeted exploitation; attackers need adjacent network access and some existing foothold on the device, which the bulletin does not explain how to obtain. The fix ships at the 2026-09-05 patch level and appears only in the Pixel-specific bulletin, so other Android vendors do not receive this specific fix.

Malwarebytes Labsupdated 14:47 UTC · 2h agofirst 10:39 UTC · 6h agoExploit / PoC in the wild 7 sources CVE-2026-58704

CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks

CISA adds exploited Citrix NetScaler authentication bypass CVE-2026-19490 to the KEV catalog; federal agencies must patch by September 12.

CISA added CVE-2026-19490, a CWE-288 authentication bypass affecting NetScaler ADC and Gateway deployments configured as AAA virtual servers or Gateway services (including SSL VPN, ICA Proxy, and RDP Proxy), to the Known Exploited Vulnerabilities catalog. Citrix released fixes on August 19, 2026; honeypots recorded 56 attack attempts between September 3 and 8 after a public PoC, though no confirmed production compromises have been reported. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21; newer installations require SAML IdP configuration to be exposed.

Cyber Security Newsupdated Sep 10, 18:57 UTC · 5d agofirst Sep 10, 13:23 UTC · 6d agoExploit / PoC in the wild 5 sources CVE-2026-19490

U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.

CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.

Security AffairsSep 14, 14:08 UTC · 2d agoExploit / PoC in the wild 2 sources CVE-2026-42016 CVE-2026-42018 CVE-2026-84869+3 CVEs6

Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

Mass-scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS/Azure credentials, .env files, and Terraform state.

F5 Labs documented an August 2026 credential-harvesting campaign exploiting CVE-2026-39364 (CVSS 8.2), a Vite flaw allowing unauthenticated attackers to bypass server.fs.deny via query parameters like ?raw and ?import&raw. Attackers issue GET requests to /@fs/ endpoints to retrieve .env files, AWS and Azure credentials, terraform.tfstate, serverless.yml, and /proc data from dev servers exposed via --host or misconfigured Docker port mappings. Requests impersonate crawlers like Googlebot, ClaudeBot, and GPTBot, forge X-Forwarded-For headers, and largely originate from GCP ranges in the US, Belgium, Netherlands, Singapore, and Taiwan.

The Hacker NewsSep 15, 11:12 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-393641

CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert

CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.

CISA added CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS to the Known Exploited Vulnerabilities catalog on September 10, giving federal agencies until September 13 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; CVE-2026-86060 (CWE-88) lets attackers manipulate the trusted RouterOS policy mask for privilege escalation. CISA designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. Compromised routers could have altered routing rules, persistence, traffic interception, or use as pivots into internal networks.

GBHackersSep 11, 11:57 UTC · 5d agoExploit / PoC in the wild 3 sources CVE-2026-67277 CVE-2026-860601

Perfect-10 GitLab bug under attack days after patch lands

CISA confirms active exploitation of CVSS 10.0 GitLab path traversal flaw CVE-2026-85706 days after patches shipped, enabling unauthenticated arbitrary file reads.

CISA added CVE-2026-85706, a maximum-severity 10.0 CVSS path traversal flaw in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog and confirmed active exploitation. The bug allows unauthenticated attackers to read arbitrary files, including configuration data and credentials, from self-managed GitLab CE/EE servers via a single HTTP POST request. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6, and 19.1.8, covering versions 18.7 through 19.3. watchTowr is observing probes against internet-facing instances and warns widespread exploitation is likely to follow quickly.

The Register · Securityupdated Sep 15, 00:52 UTC · 1d agofirst Sep 14, 14:30 UTC · 2d agoExploit / PoC in the wild 18 sources CVE-2026-85706