Search: “publishing”

8 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 9 Exploit / PoC 9 Industry 9 Research 7 AI safety & security 6 Advisory 5 Threat actor 5 Malware 5 Policy & legal 3 Tools 3 AI industry 2 Phishing & fraud 2 Data breach 2 Model release 1

SeverityAll critical 4 high 26 medium 10 low 2 info 28

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security News15:31 UTC · 1h agoExploit / PoC in the wild 5 sources CVE-2026-84869

CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability

N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw (CWE-96 static code injection) in N-able N-central servers, scored 10.0 CVSS 4.0 by N-able and 9.8 CVSS 3.1 by NIST. N-able fixed it in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, and has already patched hosted NCOD environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026, citing evidence of active exploitation, though researchers have not attributed every reported N-central compromise to this flaw. Horizon3 released a NodeZero Rapid Response test to validate exposure and recommends log review for prior compromise.

Horizon3.ai16:06 UTC · 1h agoExploit / PoC in the wild 18 sources CVE-2026-862181

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.

Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.

Infosecurity Magazine15:00 UTC · 2h agoExploit / PoC in the wild 6 sources CVE-2026-27540

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security Newsupdated 14:47 UTC · 2h agofirst 09:40 UTC · 7h agoExploit / PoC in the wild 7 sources CVE-2026-58704 CVE-2026-28662

Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)

Acronis warns CVE-2026-87886, an authenticated Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugins, is under limited targeted exploitation; patches released.

Acronis disclosed CVE-2026-87886, a privilege escalation vulnerability caused by insecure file permissions in its backup plugins for cPanel, WHM, and Plesk, platforms popular among hosting providers and MSPs. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments, with no exploitation observed on Plesk so far, and the low-complexity attack requires no user interaction. Fixes shipped last week: backup plugin version 1.9.3 HF3 for cPanel & WHM and extension version 1.8.11 for Plesk.

Help Net Securityupdated 11:08 UTC · 6h agofirst 09:33 UTC · 7h agoExploit / PoC in the wild 6 sources CVE-2026-87886

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeekupdated 15:05 UTC · 2h agofirst 08:39 UTC · 8h agoExploit / PoC in the wild 3 sources CVE-2026-54302· 1 read

Public PoC Released for Apache Superset SQL Injection Vulnerability

A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.

CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.

Cyber Security Newsupdated 09:23 UTC · 7h agofirst 08:04 UTC · 9h agoExploit / PoC 2 sources CVE-2026-23980

U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) to KEV; federal agencies must patch by September 17, 2026.

CISA added CVE-2026-76461 (CVSS 9.8), a critical zero-day in Cisco AsyncOS for Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities catalog. The flaw stems from insufficient validation in email parsing, letting an unauthenticated remote attacker send a crafted email with malicious SQL statements to achieve arbitrary command execution with root privileges. Cisco confirmed active exploitation in the wild, notes no workarounds exist, and recommends checking mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM' on every cluster device. Under BOD 22-01, FCEB agencies must remediate by September 17, 2026.

Security Affairsupdated 13:57 UTC · 3h agofirst Sep 15, 20:46 UTC · 20h agoExploit / PoC in the wild 17 sources CVE-2026-76461