Search: “Insight”

10 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 28 AI industry 26 AI research 23 Tools 18 Research 18 Threat actor 17 AI safety & security 15 Exploit / PoC 13 Phishing & fraud 7 AI tools & infra 6 Malware 5 Vulnerability 4 Model release 4 Policy & legal 4

SeverityAll critical 7 high 19 medium 24 low 5 info 139

Acronis Patches Exploited Vulnerability in cPanel Backup Plugin

Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.

Acronis released urgent patches for CVE-2026-87886 (CVSS 7.8), insecure file permissions in the Backup plugin for cPanel & WHM and the Backup extension for Plesk that allow attackers to gain elevated privileges. Exploitation has been detected in the wild in limited, targeted attacks against the cPanel & WHM plugin, but not against the Plesk extension. All Linux versions of the plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected; Acronis urges immediate updates and has not shared technical details.

SecurityWeekupdated 11:08 UTC · 48m agofirst 09:52 UTC · 2h agoExploit / PoC in the wild 6 sources CVE-2026-87886

ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

ConnectWise patched critical ScreenConnect flaw CVE-2026-84869 (CVSS 9.9) exploited since August 20 in worm-like attacks; CISA added it to KEV.

ConnectWise released urgent patches for CVE-2026-84869 (CVSS 9.9), a missing authorization and improper privilege management flaw in ScreenConnect allowing file transfer and execution through active remote sessions without host confirmation. Huntress reported in-the-wild exploitation since August 20, with attackers using rogue ScreenConnect clients to push four VBScript files for persistence and worm-like propagation to other ScreenConnect clients. The flaw is fixed in ScreenConnect 26.6.5, with disabling the TransferFiles permission as a temporary mitigation. CISA added the CVE to its KEV catalog, requiring federal agencies to patch within three days under BOD 26-04.

SecurityWeekupdated 11:14 UTC · 43m agofirst Sep 14, 08:25 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2026-848691

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.

Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.

The Hacker Newsupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 07:31 UTC · 5d agoExploit / PoC in the wild 7 sources CVE-2026-42018 CVE-2026-42016 CVE-2026-823292

CVE-2019-1068: A remote code execution vulnerability exists in ...

CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.

CVE-2019-1068 (CVSS 8.8, CWE-20) is an improper input validation flaw allowing unauthenticated RCE in Microsoft SQL Server 2014 SP2/SP3, 2016, and 2017 on 32-bit and x64 builds. Exploitation requires low complexity and low privileges with no user interaction, and CISA formally added it to the KEV catalog on August 26, 2026. The CVE was originally published on July 15, 2019 and carries an EPSS score of 52.8%. Administrators must inventory affected SQL Server assets and apply vendor patches on an accelerated timeline.

Web discovery (articles for new exploits & KEV entries)Sep 9, 06:32 UTC · 7d agoExploit / PoC in the wildCVE-2019-10681

Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch

PaperCut pre-auth RCE CVE-2026-81578 actively exploited; 47% of tracked installs unpatched and exposed to remote code execution.

Huntress confirmed active exploitation of a pre-authentication RCE flaw in PaperCut (CVE-2026-81578), chainable with CVE-2026-82078 to achieve SYSTEM-level code execution via PaperCut's Application Server. Observed attacks focused on short reconnaissance (whoami, ver, tasklist) with no persistence, but a malicious Java class dropping into the installation directory leaves the jdbc:derby:memory:pwn breadcrumb. Roughly 47% of ~2,500 tracked installations run version 23 or earlier with no patch yet available.

Security AffairsSep 6, 08:17 UTC · 10d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker NewsSep 2, 10:21 UTC · 14d agoExploit / PoC in the wildCVE-2026-82078 CVE-2026-815781

Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)

Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.

CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3, lets crafted HTTP POST requests execute arbitrary SQL against the backend PostgreSQL database. Horizon3 honeypots first saw exploitation on August 30, 2026 from IP 176.65.148.184, and dozens of additional source IPs have since joined with scanning payloads and second-stage malware that appears to be a cryptominer. The flaw was patched in Switchvox 8.4.0.2 on July 14, 2026; roughly 4,000 exposed instances exist, mostly in the United States, and exploitation is likely against most of them.

Help Net SecuritySep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-9586

Apple macOS Screen Sharing Flaw Exploited on Internet

Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.

NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.

The Hacker NewsAug 19, 05:22 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400 CVE-2026-43779 CVE-2026-43777+1 CVEs

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.

Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.

The Hacker NewsAug 17, 17:57 UTC · 29d agoExploit / PoC CVE-2026-50656 CVE-2026-62832 CVE-2026-68820+2 CVEs

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42Aug 17, 13:03 UTC · 29d agoExploit / PoC in the wildCVE-2025-32433