Search: “illustrator”

4 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 14 Malware 7 Research 5 AI industry 5 Model release 5 Exploit / PoC 5 Threat actor 4 Phishing & fraud 4 AI research 3 Tools 3 AI tools & infra 3 Policy & legal 3 Vulnerability 1 Data breach 1

SeverityAll critical 4 high 7 medium 20 low 0 info 33

Cisco Secure Email Gateway Vulnerability Exploited in Attacks (CVE-2026-76461)

Cisco Secure Email Gateway flaw CVE-2026-76461 enables root command execution via crafted email SQL injection and is actively exploited, added to CISA KEV.

Cisco disclosed critical vulnerability CVE-2026-76461 in Secure Email Gateway, caused by insufficient validation in email parsing logic, allowing arbitrary SQL statements that lead to root-level command execution. CISA added the flaw to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 17, 2026. The bug affects all SEG deployments regardless of configuration, with fixed releases including 15.5.5-014, 16.0.4-302, and 16.5.0-780. Defenders can check mail_logs for anomalous 'COPY ... TO PROGRAM' SQL statements to detect compromise.

Qualys ThreatPROTECTupdated 13:57 UTC · 9h agofirst Sep 15, 13:37 UTC · 1d agoExploit / PoC in the wild 17 sources CVE-2026-76461

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 15:00 UTC · 8h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540

One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.

Gen Digital researchers found three weaknesses in Sogou Input Method's sgbiz protocol handler that chain into a one-click RCE running with the signed-in user's permissions. UNC3569 used the chain in an active intrusion, leveraging an unsandboxed Chromium 80 embedded browser, the known V8 flaw CVE-2021-38003, and DLL sideloading via 7-Zip to deploy the GRAYRABBIT backdoor. Tencent fixed the issue in version 16.3.0.3498 within 12 days of disclosure; Sogou is used by hundreds of millions of people, mainly in China.

Cyber Security NewsSep 14, 13:01 UTC · 2d agoExploit / PoC in the wild 3 sources CVE-2026-51990 CVE-2021-38003

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 10:14 UTC · 5d agoExploit / PoC in the wild 9 sources CVE-2026-20079 CVE-2026-203165· 2 reads