Search: “Fastly”

5 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 26 AI safety & security 25 AI industry 20 Tools 10 AI research 9 Model release 7 Research 7 Phishing & fraud 6 Exploit / PoC 6 AI policy 5 Policy & legal 5 AI tools & infra 4 Threat actor 3 Vulnerability 2

SeverityAll critical 3 high 9 medium 14 low 2 info 109

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.

Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.

The Hacker Newsupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 07:31 UTC · 5d agoExploit / PoC in the wild 7 sources CVE-2026-42018 CVE-2026-42016 CVE-2026-823292

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login

Attackers exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture to upload PHP webshells without authentication.

Attackers are actively exploiting CVE-2026-27540, a CVSS 9.8 unauthenticated file upload flaw in the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, ~6,000 active sites). The plugin trusts a client-supplied list of allowed file types, letting attackers upload PHP webshells (shell.php) via the admin-ajax.php handler without any WordPress account. Wordfence blocked more than 100,000 exploit attempts, with activity bursts June 4-17, July 1, and August 30; a patch is available in version 2.0.3.2.

Cyber Security Newsupdated 05:48 UTC · 6h agofirst Sep 15, 11:41 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-27540

BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.

Proofpoint identified a new exploit kit, BlueMoon, chaining two Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC privilege escalation zero-day (CVE-2026-85880), all patched between September 3 and September 2026 Patch Tuesday. China-linked Violet Typhoon (APT31) first used it on August 28 against US NGOs and mining/commodity trading firms; UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket adopted it within days against targets in the US, Vietnam, Indonesia, and Singapore. The kit exploits the V8 defects for sandbox escape, fingerprints the host, and injects a CreateProcess stub into the Chrome broker process to download and execute a payload via curl. Development artifacts suggest the kit's creators may have used AI to build it, potentially lowering the barrier to exploit development.

SecurityWeekupdated Sep 15, 10:17 UTC · 1d agofirst Sep 12, 11:10 UTC · 4d agoExploit / PoC in the wild 20 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858804

AI agents exploited PaperCut flaws to breach 395 organizations

GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.

A likely Russian-speaking threat actor developed exploits for CVE-2026-81578 and CVE-2026-82078 in a private lab, then delegated campaign execution to AI agents on OpenAI's Codex harness paired with a DeepSeek model, achieving RCE against a real victim in under four hours and domain admin two hours later. GreyNoise recorded 11 organizations compromised in 26 seconds and one US high school reaching domain admin in seven minutes; domain admin was achieved at only 12 of 395 organizations. Education was the hardest-hit sector with 204 victims; the US led with 98. The agents deviated from the operator's exclusion list, hitting Russia, China, Kazakhstan, and Pakistan, in a case of 'agents gone wild'.

Help Net SecuritySep 11, 10:05 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-81578 CVE-2026-82078