Search: “documentation”

29 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 102 Threat actor 87 Malware 71 Industry 58 Data breach 47 Phishing & fraud 44 Vulnerability 43 Policy & legal 41 AI industry 37 Exploit / PoC 36 Research 33 Tools 28 AI research 24 AI tools & infra 18

SeverityAll critical 31 high 164 medium 202 low 12 info 306

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security NewsSep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2025-25249+3 CVEs3

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker NewsAug 17, 17:57 UTC · 29d agoExploit / PoC in the wildCVE-2026-59310 CVE-2026-65400 CVE-2026-688201

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.

Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.

The Hacker NewsSep 15, 11:52 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-39987 CVE-2021-33044 CVE-2021-33045

14th September – Threat Intelligence Report

Check Point weekly digest: Microsoft's record 974-vuln Patch Tuesday ships two actively exploited Windows zero-days; IDScan.net, Mathspace, Revolut suffer breaches.

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited privilege-escalation zero-days, CVE-2026-85880 and CVE-2026-81963, plus 20 flaws allowing unauthenticated remote code execution. Disclosed breaches include IDScan.net (identity documents), Mathspace (over 1 million people via Metabase CVE-2026-72898), Revolut, and Florida DMV (ShinyHunters). GitLab fixed critical CVSS 10.0 path traversal CVE-2026-85706, and MikroTik fixed chainable RouterOS flaws CVE-2026-67276 and CVE-2026-86060. The report also covers the PuzzleMask LLM jailbreak technique, GoldFactory's Gigabud Android fraud, and the BlueMoon Chromium exploit chain (CVE-2026-85046).

Check Point ResearchSep 14, 12:22 UTC · 1d agoExploit / PoC in the wildCVE-2026-72898 CVE-2026-85880 CVE-2026-81963+4 CVEs2· 1 read

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blogupdated Sep 10, 12:56 UTC · 5d agofirst Sep 9, 16:06 UTC · 6d agoExploit / PoC in the wild 4 sources CVE-2026-59822 CVE-2026-598211

Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

Researcher Nightmare Eclipse released a PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon's Office macro remediation feature.

Researcher Nightmare Eclipse published a zero-day PoC dubbed FalconFlank targeting CrowdStrike Falcon's Microsoft Office malicious macro removal feature, achieving privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 with Optimal Protection and macro removal enabled. Kevin Beaumont independently confirmed the exploit works. The same researcher also released HardBreacher, an elevation-of-privilege bug in Kaspersky Endpoint (since fixed via update), PrettyPrague, an Avast Sandbox flaw that dumps the SAM database for a SYSTEM shell (Gen Digital is developing a patch), and GreenSection, an Nvidia memory corruption bug that crashes systems. CrowdStrike advises customers to disable the Suspicious Macro Removal Windows policy while it investigates.

The Register · SecuritySep 3, 18:08 UTC · 12d agoExploit / PoC

[webapps] PodcastGenerator 3.2.9 - Stored XSS

A stored cross-site scripting flaw in PodcastGenerator 3.2.9 is documented with a public proof-of-concept exploit on Exploit-DB.

Exploit-DB published exploit ID 52677 targeting PodcastGenerator 3.2.9, a web application affected by stored cross-site scripting. The listing provides a proof-of-concept for the flaw but includes no CVE identifier or reports of active exploitation.

Exploit-DBSep 2, 00:00 UTC · 14d agoExploit / PoC1

[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

A reflected cross-site scripting flaw in Bludit CMS 3.20.0 is documented with a public proof-of-concept exploit on Exploit-DB.

Exploit-DB published exploit ID 52678 targeting Bludit CMS 3.20.0, a web application affected by reflected cross-site scripting. The listing contains a proof-of-concept but includes no CVE identifier or evidence of active exploitation.

Exploit-DBSep 2, 00:00 UTC · 14d agoExploit / PoC

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 05:48 UTC · 6h agofirst Sep 15, 12:05 UTC · 23h agoExploit / PoC in the wild 4 sources CVE-2026-27540

Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider

Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.

Hunt.io found an open directory on server 92.63.180[.]133 holding 298 files detailing an intrusion into Triple T Broadband's 3BB brand, starting from a FortiGate 60F SSL-VPN at mail.3bb.co[.]th:10443. The actor weaponized CVE-2024-21762 (CVSS 9.8, KEV-listed since February 2024) using heap spraying and a ROP chain to gain a reverse shell. Post-exploitation included MeshCentral root-level persistence via www.ayuthayatech[.]com, Dirty COW/PwnKit privilege escalation, credential harvesting, SSH spraying against 55+ internal addresses, and log-deleting cleanup scripts; a stolen OpenVPN certificate and key from Triple T's PKI may still be valid.

Cyber Security Newsupdated Sep 15, 05:20 UTC · 1d agofirst Sep 14, 17:08 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2024-217622

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.

CISA added five actively exploited vulnerabilities to the KEV catalog: CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, CVE-2026-84869 in ConnectWise ScreenConnect (CVSS 9.9), and CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS. The Artifactory bugs are chained with CVE-2026-82329 to gain administrative control, deploy malicious Groovy plugins, and install Rust-based backdoors. CERT Polska dubbed the RouterOS chain 'MikroTrick'; FCEB agencies must patch between September 13 and 25, 2026.

The Hacker Newsupdated Sep 14, 14:08 UTC · 1d agofirst Sep 12, 15:54 UTC · 3d agoExploit / PoC in the wild 2 sources CVE-2026-42016 CVE-2026-42018 CVE-2026-84869+3 CVEs2· 1 read

Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks

Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.

Proofpoint identified a new exploit kit dubbed BlueMoon chaining a Chromium V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880). At least four distinct threat clusters, most with suspected China nexus, adopted the kit within days starting with TA412 (Violet Typhoon/APT31) on August 28, 2026. Both Chrome-side flaws were patch-gap zero-days with roughly a four-week exploitation window; the Windows LPE only works on Windows 10 and Server 2019/2022. TA412 used spearphishing posing as university interns to deliver the GemStone browser backdoor disguised as a Google Gemini extension; other clusters delivered ShadowPad via DLL sideloading and a Rust loader against targets in aerospace, government, and finance.

Cyber Security Newsupdated Sep 15, 10:17 UTC · 1d agofirst Sep 9, 16:59 UTC · 6d agoExploit / PoC in the wild 20 sources CVE-2026-85046 CVE-2026-858801

Microsoft fixes record 964 flaws, including 2 exploited zero-days

Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.

Microsoft's September 2026 Patch Tuesday addresses 964 customer-patchable CVEs (104 Critical, 860 Important), the largest release on record, out of 974 total listed. Two actively exploited zero-days are fixed: CVE-2026-81963, a link-following elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape, both with CVSS 7.8. Both zero-days were exploited before a patch was available and grant SYSTEM-level access after an initial foothold. The release also includes high-severity RCE fixes for Windows DNS Server, Remote Desktop Services, Exchange Server, SharePoint, and SQL Server.

Malwarebytes LabsSep 9, 10:01 UTC · 7d agoExploit / PoC in the wildCVE-2026-81963 CVE-2026-858801

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.

Security AffairsSep 9, 07:53 UTC · 7d agoExploit / PoC CVE-2026-69414

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.

The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.

The Hacker NewsSep 9, 06:47 UTC · 7d agoExploit / PoC CVE-2026-694141

wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)

Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 7d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371

StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day

Critical unauthenticated RCE zero-day CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento is actively exploited; Adobe shipped hotfix VULN-39341 on September 7.

CVE-2026-75650 is a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, exploited via malicious style properties that inject PHP code executed through a transactional email template. Active exploitation began September 4, 2026, three days before Adobe released Hotfix VULN-39341 (APSB26-146) on September 7, with multiple victim stores confirmed by Sansec and Disrex across at least two distinct campaigns. Attackers deploy a persistent implant at ~/.local/share/.gvfsd/gvfsd-user masquerading as kworker, fc-cache, or chronyd, sustained by a cron job, while a second operator dropped a PHP web shell in product image caches. Tenable classified it as a Vulnerability of Interest; it is not yet in CISA KEV as of September 8, and Adobe also recommends rotating encryption keys and all protected credentials.

Tenable Blogupdated Sep 8, 14:13 UTC · 7d agofirst Sep 8, 14:00 UTC · 7d agoExploit / PoC in the wild 2 sources CVE-2026-75650 CVE-2025-54236 CVE-2024-34102+1 CVEs

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 8d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Attackers use rogue ScreenConnect clients to spread malware

Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.

ConnectWise confirmed a file transfer flaw in ScreenConnect affecting both Cloud and On-Premise deployments, with a CVE identifier and official fix promised within the week; administrators can mitigate immediately by disabling TransferFiles (or TransferFilesInSession) in each role. Huntress documented incidents where social engineering installs rogue ScreenConnect clients that spawn Windows Script Host processes running four VBScript files (1.vbs-4.vbs), add a WindowsServiceHost registry Run key, and propagate to newly connected endpoints. Payloads enabled host profiling, persistence, additional ScreenConnect installs, tunneling, security-control changes, and cryptocurrency mining. ConnectWise has not confirmed a technical link between the flaw and this campaign.

Help Net SecuritySep 7, 00:00 UTC · 9d agoExploit / PoC in the wild

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

HuntressSep 6, 11:00 UTC · 10d agoExploit / PoC in the wildCVE-2026-86218 CVE-2026-86206 CVE-2026-86207+2 CVEs

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.

Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.

The Hacker NewsSep 5, 20:14 UTC · 10d agoExploit / PoC in the wild

CVE-2026-16232: Check Point SmartConsole Auth Bypass

Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.

CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.

Web discovery (articles for new exploits & KEV entries)Sep 4, 10:49 UTC · 12d agoExploit / PoC in the wildCVE-2026-162321

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

HuntressSep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.

CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.

The Hacker NewsSep 3, 05:19 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549 CVE-2026-9586+10 CVEs1

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker NewsSep 2, 10:21 UTC · 14d agoExploit / PoC in the wildCVE-2026-82078 CVE-2026-815781

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.

Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.

The Hacker NewsSep 2, 06:24 UTC · 14d agoExploit / PoC in the wildCVE-2025-31277 CVE-2025-43529 CVE-2025-43398+2 CVEs

Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Attackers exploited a critical Cosmos EVM balance bug (GHSA-7g4w-cg88-2cq2) to drain funds from six blockchains; fixed in v0.6.2 and v0.7.2.

Cosmos Labs disclosed that a critical balance-handling flaw in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2, no CVE) was exploited to drain funds from six blockchains between August 20 and 25, 2026. The bug, reported April 25 and initially judged harmless, lets vesting accounts delegate more than their spendable balance, wrapping balances to roughly 2^256 and triggering unintended mint/burn in reconciliation, potentially halting chains or burning victims' holdings. Fixes shipped in v0.6.2 and v0.7.2 on August 19 as state-breaking coordinated network upgrades; operators who cannot upgrade must halt their chains. The post-mortem notes the team used public silent patching for a fund-threatening issue, contrary to its own bug bounty policy, and that eleven deployments had never registered with its security channels.

The Hacker NewsAug 28, 20:38 UTC · 18d agoExploit / PoC in the wild

PaperCut warns of hackers using printer management software flaw in attacks

PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.

PaperCut issued an emergency advisory saying vulnerabilities in PaperCut NG and MF, tracked as CVE-2026-82078 and CVE-2026-81578 with severity scores above 8.8, are under active exploitation with confirmed customer incidents. Huntress reported at least two customers impacted, and an initial patch was revised with input from Huntress and watchTowr researchers. PaperCut software is widely deployed at universities, corporations, and governments managing printers from Canon, Epson, Xerox, and Brother, and the vendor urged removing server web interfaces from the public internet. Previous PaperCut flaws were used by ransomware gangs like Bl00dy and Clop, and CISA has warned the education sector is particularly exposed.

The RecordAug 28, 16:37 UTC · 18d agoExploit / PoC in the wildCVE-2026-82078 CVE-2026-81578

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.

CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.

Security AffairsAug 21, 09:14 UTC · 26d agoExploit / PoC in the wildCVE-2026-73570