Search: “Unit 42 Incident Response”

19 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 79 Malware 47 Vulnerability 43 Threat actor 21 Exploit / PoC 21 Data breach 16 Research 16 Phishing & fraud 10 Industry 10 Policy & legal 7 AI safety & security 7 Tools 1

SeverityAll critical 124 high 77 medium 40 low 12 info 25

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42Aug 17, 13:03 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2025-32433

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022

Palo Alto Unit 42Jun 5, 20:43 UTC · Jun 5, 2024Exploit / PoC in the wildCVE-2022-22954 CVE-2022-22960 CVE-2022-22972+8 CVEs

Unit 42: Nearly two-thirds of breaches now start with identity abuse

CyberScoopFeb 17, 11:00 UTC · Feb 17, 2026Exploit / PoC

Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024

Help Net SecurityFeb 22, 00:00 UTC · Feb 22, 2026Exploit / PoC in the wildCVE-2026-2441 CVE-2026-22769 CVE-2026-2329+1 CVEs

Unit 42 Threat Bulletin

Palo Alto Unit 42May 18, 16:19 UTC · May 18, 2026Exploit / PoC in the wild

NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise?

Help Net SecurityAug 9, 00:00 UTC · Aug 9, 2024Exploit / PoC

Microsoft: Attackers Actively Compromising On

Infosecurity MagazineJul 21, 11:00 UTC · Jul 21, 2025Exploit / PoC CVE-2025-53770 CVE-2025-53771

Attackers exploit another zero-day in ManageEngine software (CVE-2021-44515)

Help Net SecurityDec 21, 09:45 UTC · Dec 21, 2021Exploit / PoC CVE-2021-44515 CVE-2021-44077

Chinese hackers exploiting React2Shell bug impacting countless websites, Amazon researchers say

The RecordDec 5, 16:22 UTC · Dec 5, 2025Exploit / PoC in the wildCVE-2025-55182

CISA's new JCDC worked as intended, witnesses say at Senate hearing on Log4Shell bug

CyberScoopFeb 8, 18:22 UTC · Feb 8, 2022Exploit / PoC in the wild

SolarWinds Hack — New Evidence Suggests Potential Links to Chinese Hackers

The Hacker NewsMar 9, 09:58 UTC · Mar 9, 2021Exploit / PoC CVE-2020-10148

CISA alerts federal agencies of widespread attacks using Cisco zero

CyberScoopSep 25, 19:05 UTC · Sep 25, 2025Exploit / PoC in the wildCVE-2025-20333 CVE-2025-20363 CVE-2025-20362

DHS assembles Cyber Safety Review Board to imitate fed agency that studies aviation accidents

CyberScoopFeb 3, 15:30 UTC · Feb 3, 2022Exploit / PoC in the wild

Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool

The Hacker NewsFeb 25, 17:13 UTC · Feb 25, 2022Exploit / PoC

Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42Aug 17, 12:20 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+3 CVEs