ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Let's Encrypt”

253 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 400Vulnerability 400Ransomware 391Exploit / PoC 253Data breach 207Policy & legal 174Industry 142Threat actor 113Phishing & fraud 100Research 42AI safety & security 23AI tools & infra 23AI industry 19Tools 13
SeverityAllcritical 909high 598medium 434low 293info 90

BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.

Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.

Ars Technica · Security · 14d agoExploit / PoC in the wild1

BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access

Attackers used a BGP hijack to divert Softaculous traffic and push a malicious Virtualizor update granting root persistence on some hypervisors.

Virtualizor reported that a BGP hijack between August 28 20:57 UTC and August 30 06:10 UTC diverted Softaculous update traffic to an attacker-operated server holding a valid Let's Encrypt certificate. Installations checking for updates during the window could receive a malicious package that added an attacker SSH key to root, created a proxyuser account, and installed a Java payload persisted via a systemd service. Hosting provider AlbaHost confirmed 5 of its 34 Virtualizor hypervisors were root-compromised. Virtualizor shipped Patch 9 with a Security Analyzer on September 1, but cryptographic package signing remains future work.

The Hacker News · 14d agoExploit / PoC in the wild

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.

TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.

The Hacker News · 9d agoExploit / PoCCVE-2026-13181CVE-2026-13182CVE-2026-13183+5 CVEs1

MikroTik router flaws allow takeover without a password

Attackers actively exploit chained MikroTik RouterOS SSH flaws CVE-2026-67276 and CVE-2026-86060, bypassing authentication and escalating to admin to seize edge routers.

CERT Polska warns of active exploitation of a two-flaw chain dubbed 'MikroTrick' against internet-exposed MikroTik RouterOS devices with SSH remote management enabled. CVE-2026-67276 is an SSH authentication bypass in RSA public-key handling, and CVE-2026-86060 is a privilege-escalation flaw triggered via a specially crafted username, letting attackers gain full administrator control without a password. Patched RouterOS packages are already public, and MikroTik added a startup detection that flags unauthorized configuration changes. Compromised edge routers enable DNS hijacking, traffic capture, remote-access tunnels, firewall changes, and lateral attacks.

Malwarebytes Labs · 8d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-860603