Source: GBHackers

16 stories in the last 30d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 27 Vulnerability 23 Malware 17 Exploit / PoC 17 Threat actor 11 AI safety & security 9 Phishing & fraud 7 Advisory 5 Tools 4 Research 4 AI tools & infra 1 Policy & legal 1 Model release 1

SeverityAll critical 6 high 49 medium 29 low 1 info 42 source: GBHackers ✕

Apache Superset SQL Injection Flaw Gets Public PoC Exploitnew

A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.

A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.

GBHackers09:23 UTC · 25m agoExploit / PoC 2 sources CVE-2026-23980

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 05:48 UTC · 4h agofirst Sep 15, 12:05 UTC · 21h agoExploit / PoC in the wild 4 sources CVE-2026-27540

Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root

Cisco patched critical unauthenticated SQL injection CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway enabling root command execution, with malicious activity already detected.

Cisco disclosed CVE-2026-76461, a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway appliances running AsyncOS, letting unauthenticated remote attackers execute arbitrary commands as root via crafted emails containing malicious SQL statements. Cisco detected malicious activity and directly contacted Secure Email Cloud customers, indicating active exploitation. No workaround exists; fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with migration to 16.5.0-780 advised. Secure Email and Web Manager and Secure Web Appliance are not affected.

GBHackersupdated Sep 15, 20:46 UTC · 13h agofirst Sep 15, 05:01 UTC · 1d agoExploit / PoC in the wild 15 sources CVE-2026-76461

Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds

Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.

Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.

GBHackersupdated Sep 15, 11:52 UTC · 21h agofirst Sep 15, 09:58 UTC · 23h agoExploit / PoC in the wild 4 sources CVE-2026-399872· 1 read

Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens

Attackers mass-scanned exposed Vite dev servers exploiting CVE-2026-39364 to read .env files and steal AWS keys and Azure tokens, per F5 Labs honeynet data.

Honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against exposed Vite development servers. CVE-2026-39364 (CVSS 7.5) is an unauthenticated file-read flaw in Vite 7.1.0 through 7.3.2 and 8.0.5 that bypasses server.fs.deny via query parameters like ?raw and ?import&raw to return files in plaintext. Attackers also probed older Vite flaws CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, and used wordlists to locate .env files, AWS credential files, Azure token stores, and Terraform state across Linux, container, and web paths. Exposed secrets could enable lateral movement or full cloud account takeover.

GBHackersupdated Sep 15, 11:12 UTC · 22h agofirst Sep 15, 05:35 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-39364 CVE-2025-30208 CVE-2025-31125+1 CVEs

China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks

Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.

Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.

GBHackersupdated Sep 15, 10:17 UTC · 23h agofirst Sep 12, 08:04 UTC · 4d agoExploit / PoC in the wild 20 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858802· 1 read

Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.

CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.

GBHackersSep 15, 08:18 UTC · 1d agoExploit / PoC CVE-2026-43502 CVE-2026-43501 CVE-2026-43074+4 CVEs

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersSep 15, 05:20 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2024-21762 CVE-2020-1938

CISA Warns of Critical GitLab Vulnerability Exploited in Attacks

CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.

CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.

GBHackersupdated Sep 15, 00:52 UTC · 1d agofirst Sep 12, 05:17 UTC · 4d agoExploit / PoC in the wild 17 sources CVE-2026-857061

Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware

Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.

Cisco Talos warns of active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center allowing unauthenticated root-level code execution, and CVE-2026-20316 (CVSS 5.3), which permits login via a low-privileged static account for privilege escalation. Hotfixes are available now, with a broader hardening release planned for the week of September 14. Three post-compromise activity clusters were identified: UAT-12197 deployed a home.jsp web shell and cmd.jar command executor; UAT-11823, attributed with high confidence to a Sandworm-linked APT, deployed a Netcat reverse shell and Cyclops Blink; and UAT-11988 showed Qilin ransomware tactics including Active Directory enumeration and credential theft before deploying Qilin ransomware.

GBHackersupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 05:30 UTC · 5d agoExploit / PoC in the wild 13 sources CVE-2026-20079 CVE-2026-20316

Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access

Wiz Research observes multiple attackers exploiting three JFrog Artifactory flaws, including default-configuration authentication bypass CVE-2026-82329, to gain admin access and deploy backdoors.

Attackers chain CVE-2026-42018 and CVE-2026-42016 to exchange anonymous JWTs for administrator-scoped tokens, or exploit CVE-2026-82329 directly via the registry join endpoint to obtain admin privileges under default configuration. Post-exploitation observed by Wiz includes persistent admin users created within five minutes, malicious Groovy plugins for command execution, and Rust-based backdoors dropped to /tmp, /var/tmp, and /dev/shm with C2 communications. Compromise exposes software artifacts, repository credentials, CI/CD integrations, and cluster secrets, creating supply chain risks. Fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.

GBHackersupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 09:59 UTC · 4d agoExploit / PoC in the wild 7 sources CVE-2026-42016 CVE-2026-42018 CVE-2026-82329

CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert

CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.

CISA added CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS to the Known Exploited Vulnerabilities catalog on September 10, giving federal agencies until September 13 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; CVE-2026-86060 (CWE-88) lets attackers manipulate the trusted RouterOS policy mask for privilege escalation. CISA designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. Compromised routers could have altered routing rules, persistence, traffic interception, or use as pivots into internal networks.

GBHackersSep 11, 11:57 UTC · 4d agoExploit / PoC in the wild 3 sources CVE-2026-67277 CVE-2026-860601

Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers

AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.

GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.

GBHackersupdated Sep 11, 10:05 UTC · 4d agofirst Sep 10, 05:20 UTC · 6d agoExploit / PoC in the wild 8 sources CVE-2026-81578 CVE-2026-82078 CVE-2021-42278+1 CVEs1

Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.

Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.

GBHackersSep 9, 08:40 UTC · 7d agoExploit / PoC CVE-2026-69414

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.

GBHackersSep 9, 06:17 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-87464 CVE-2026-87488+19 CVEs1

Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers

RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.

Hunt.io researchers track a large-scale cryptojacking operation named RedisRaider that scans IPv4 ranges for Redis services exposed on TCP port 6379 and targets instances accepting unauthenticated connections. From a master list of 12,966 candidate hosts, 2,342 were confirmed to accept commands without authentication. Attackers abuse Redis commands (CONFIG SET dir/dbfilename, SET, BGSAVE) to write malicious cron entries into /etc/cron.d or /var/spool/cron, launching XMRig-based Monero miners, with branches including SSH authorized-key injection, Lua probing, and WordPress spraying. The article also references CVE-2026-81934, a Redis TLS use-after-free allowing unauthenticated command execution, fixed in releases including 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.

GBHackersSep 9, 05:28 UTC · 7d agoExploit / PoC in the wildCVE-2026-81934