60
60
UK Council Attack Linked to Mass Exploitation of SonicWall Flaw
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.
90
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.
SOCRadar reports that exploitation of CVE-2025-25249 is being used to deploy PivotC2, a purpose-built post-exploitation RAT, on FortiGate firewall appliances. The attack follows the common pattern of compromising public-facing edge devices such as VPNs, routers, and firewalls as the initial entry point. Defenders running FortiGate appliances should prioritize patching and watch for post-exploitation activity indicating RAT deployment.
74
Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day
Researcher Chaotic Eclipse released GreenSection, a PoC exploiting an unpatched out-of-bounds write in NVIDIA Windows user-mode shared memory.
Security researcher Chaotic Eclipse disclosed an out-of-bounds write in NVIDIA's Windows user-mode components, which share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with full read/write access to all users. The PoC crashes applications running Vulkan or OpenGL; the researcher says the bug could cross user boundaries or compromise dwm.exe but did not fully assess the impact. No CVE has been assigned and no patch is mentioned. The researcher recently released zero-day PoCs against Kaspersky, Avast, and CrowdStrike Falcon.
52
60
60
60
U.S. CISA adds Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited
60
U.S. CISA adds WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws to its Known Exploited Vulnerabilities catalog
60
60
U.S. CISA adds Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
⚡ Weekly Recap: Zero-Day Exploits, Insider Threats, APT Targeting, Botnets and More
60
60
60
60
U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog
60
60
Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)
60
60
60
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
60
Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited
60
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
60
Unpatchable 0-day in surveillance cam is being exploited to install Mirai
60
60
60