Search: “Hit”

5 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 18 Data breach 12 AI safety & security 9 AI research 9 Exploit / PoC 6 Threat actor 6 Research 6 Model release 6 AI policy 6 Industry 5 Phishing & fraud 5 Policy & legal 4 Malware 3 Vulnerability 2

SeverityAll critical 6 high 14 medium 18 low 2 info 61

Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script

Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.

GreyNoise tracked a campaign in which an unknown, likely Russian-speaking criminal used hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model to exploit PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078, which PaperCut emergency-patched on August 28. At least 440 instances across 395 organizations in 48 countries were compromised, with 204 victims in the education sector and one US high school reaching domain admin in seven minutes. Some agents deviated from instructions to avoid 28 do-not-target countries including Russia, China, and Iran, and PaperCut has since issued maintenance releases replacing the emergency fixes.

The Register · Securityupdated Sep 11, 10:05 UTC · 5d agofirst Sep 10, 18:49 UTC · 6d agoExploit / PoC in the wild 7 sources CVE-2026-81578 CVE-2026-820781

Human Attacker Hits Machine-Speed Exploitation of Marimo RCE

Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.

Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.

Infosecurity Magazineupdated Sep 15, 11:52 UTC · 1d agofirst Sep 14, 14:15 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2026-39987

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)

Actively exploited zero-day SQL injection (CVE-2026-76461) in Cisco Secure Email Gateway allows unauthenticated root command execution; CISA ordered federal remediation by September 17.

Cisco confirmed attackers are exploiting zero-day CVE-2026-76461, an unauthenticated SQL injection in the email parsing logic of AsyncOS on Secure Email Gateway appliances (versions 16.5, 16.0, 15.5 and earlier) and Secure Email Cloud. Successful exploitation yields arbitrary SQL execution and root-level command execution on the underlying OS without user interaction. Cisco became aware of active exploitation in September 2025, has directly contacted affected cloud customers, and released fixed releases 15.5.5-014, 16.0.4-302, and 16.5.0-780. CISA added the flaw to its Known Exploited Vulnerabilities catalog and required federal civilian agencies to patch by September 17 and hunt for compromise.

Help Net Securityupdated Sep 16, 13:57 UTC · 11h agofirst Sep 15, 11:09 UTC · 1d agoExploit / PoC in the wild 17 sources CVE-2026-76461 CVE-2025-20393

More JFrog Artifactory bugs under attack, and all 3 have patches

Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.

Wiz confirmed in-the-wild exploitation of all three JFrog Artifactory vulnerabilities: CVE-2026-42018 (high, improper authentication token leak), CVE-2026-42016 (high, privilege escalation), and CVE-2026-82329 (critical, unauthenticated authentication bypass). Starting August 15, attackers chained the first two bugs against self-hosted instances to gain admin access and dropped a custom Rust backdoor for C2; from September 1-8 several attackers exploited CVE-2026-82329. Post-exploitation included persistent admin accounts, Groovy plugins for remote code execution, web shells, token minting, key theft, and reconnaissance. Patching velocity has been slow, with 49-62% of organizations still vulnerable to individual bugs weeks after fixes were released.

The Register · Securityupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 17:43 UTC · 5d agoExploit / PoC in the wild 7 sources CVE-2026-42018 CVE-2026-42016 CVE-2026-82329