Search: “Google Drive”

2 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 20 Industry 15 AI safety & security 15 Threat actor 9 Phishing & fraud 8 Malware 7 AI research 6 Policy & legal 6 Research 4 Tools 4 Vulnerability 2 Data breach 2 Exploit / PoC 2 AI tools & infra 1

SeverityAll critical 2 high 15 medium 31 low 2 info 54

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner

CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.

CVE-2026-60004 is a critical remote code execution flaw affecting Gitea versions 1.17 through 1.27.0, abused via the diffpatch endpoint to install a Git hook and execute shell commands as the Gitea OS user. Default open registration lets unauthenticated attackers obtain the required repository write access. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 28, 2026 to patch; version 1.27.1 fixes it. A developer reported their HOSTKEY-hosted VPS was exploited to run a miner-like dropper, driving CPU usage above 70% and killing competing processes.

The Hacker NewsAug 26, 07:34 UTC · 21d agoExploit / PoC in the wildCVE-2026-60004

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.

Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.

The Hacker NewsSep 5, 20:14 UTC · 10d agoExploit / PoC in the wild