Search: “access control”

5 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 13 Malware 13 AI safety & security 10 Exploit / PoC 10 Industry 9 Threat actor 7 Advisory 7 Phishing & fraud 6 AI industry 5 AI policy 5 Research 4 Data breach 4 Tools 3 Policy & legal 3

SeverityAll critical 1 high 34 medium 23 low 4 info 37

Scans Targeting Hospitality Applications, (Wed, Sep 16th)new

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm Center18:44 UTC · 40m agoExploit / PoC

Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the Wild

Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel and Plesk backup plugins, exploited in targeted attacks.

Acronis released fixes for CVE-2026-87886 (CVSS 7.8, CWE-276), an insecure file permissions flaw in Linux-based backup components for cPanel & WHM and Plesk that enables local privilege escalation. The vendor observed limited, targeted exploitation in the wild before patches shipped. Fixes are available in Backup plugin for cPanel & WHM 1.9.3 HF3 and Backup extension for Plesk 1.8.11. A local attacker with low privileges could gain elevated access to backup data, control panels, and other customer accounts on shared hosting infrastructure.

Cyber Security Newsupdated 11:08 UTC · 8h agofirst 08:01 UTC · 11h agoExploit / PoC in the wild 6 sources CVE-2026-87886

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeekupdated 15:05 UTC · 4h agofirst 08:39 UTC · 10h agoExploit / PoC in the wild 3 sources CVE-2026-54302· 1 read

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security Newsupdated 17:56 UTC · 1h agofirst 09:40 UTC · 9h agoExploit / PoC in the wild 8 sources CVE-2026-58704 CVE-2026-28662

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.

Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.

Infosecurity Magazine15:00 UTC · 4h agoExploit / PoC in the wild 6 sources CVE-2026-27540