Search: “parental controls”

4 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 9 Malware 9 Vulnerability 7 Research 6 AI policy 5 Policy & legal 5 AI safety & security 5 Exploit / PoC 4 Industry 3 Threat actor 3 AI research 2 Phishing & fraud 1 Tools 1 AI tools & infra 1

SeverityAll critical 2 high 15 medium 11 low 2 info 31

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 8d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks

China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.

Proofpoint researchers identified BlueMoon, an exploit kit combining a V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel privilege-escalation flaw (CVE-2026-85880), first observed August 28, 2026. At least four clusters adopted it, led by TA412 (also tracked as APT31/Violet Typhoon) and followed by UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, targeting aerospace, manufacturing, government, consulting, and financial sectors. The kit exploited a nearly four-week patch gap between the public Chromium commit (August 7) and stable rollout (September 3). TA412 delivered the GemStone Chrome extension masquerading as a Gemini companion, while other clusters deployed ShadowPad via DLL sideloading, a Rust loader, and DoH-based C2.

GBHackersupdated Sep 16, 16:06 UTC · 11h agofirst Sep 10, 05:15 UTC · 6d agoExploit / PoC in the wild 14 sources CVE-2026-85046 CVE-2026-858801

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security)Sep 5, 00:00 UTC · 12d agoExploit / PoC in the wildCVE-2026-756501