Search: “breach trends”

112 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 779 Data breach 570 Vulnerability 346 Malware 236 Phishing & fraud 127 Exploit / PoC 112 Policy & legal 104 Threat actor 93 Industry 65 AI safety & security 19 Advisory 16 Research 14 AI tools & infra 9 Tools 3

SeverityAll critical 1268 high 851 medium 241 low 104 info 34

Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login

Attackers exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture to upload PHP webshells without authentication.

Attackers are actively exploiting CVE-2026-27540, a CVSS 9.8 unauthenticated file upload flaw in the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, ~6,000 active sites). The plugin trusts a client-supplied list of allowed file types, letting attackers upload PHP webshells (shell.php) via the admin-ajax.php handler without any WordPress account. Wordfence blocked more than 100,000 exploit attempts, with activity bursts June 4-17, July 1, and August 30; a patch is available in version 2.0.3.2.

Cyber Security Newsupdated 15:00 UTC · 8h agofirst Sep 15, 11:41 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540

One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.

Gen Digital researchers found three weaknesses in Sogou Input Method's sgbiz protocol handler that chain into a one-click RCE running with the signed-in user's permissions. UNC3569 used the chain in an active intrusion, leveraging an unsandboxed Chromium 80 embedded browser, the known V8 flaw CVE-2021-38003, and DLL sideloading via 7-Zip to deploy the GRAYRABBIT backdoor. Tencent fixed the issue in version 16.3.0.3498 within 12 days of disclosure; Sogou is used by hundreds of millions of people, mainly in China.

Cyber Security NewsSep 14, 13:01 UTC · 2d agoExploit / PoC in the wild 3 sources CVE-2026-51990 CVE-2021-38003

LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials

Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.

Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.

Cyber Security Newsupdated Sep 10, 12:56 UTC · 6d agofirst Sep 10, 12:26 UTC · 6d agoExploit / PoC in the wild 3 sources CVE-2026-59821 CVE-2026-59822 CVE-2026-35029

Hackers tried to exploit two zero-days in Trend Micro's Apex One EDR platform

The RecordDec 13, 00:00 UTC · Dec 13, 2022Exploit / PoC CVE-2021-36741 CVE-2021-36742 CVE-2019-18187+3 CVEs

Tenable CEO blasts 'smoke and mirrors' of cybersecurity industry

CyberScoopMar 19, 12:00 UTC · Mar 19, 2019Exploit / PoC

Week in review: Critical Chrome zero-day, TLS certs for sale on dark web, RSA Conference 2019

Help Net SecurityMar 10, 00:00 UTC · Mar 10, 2019Exploit / PoC in the wildCVE-2019-5786 CVE-2018-8476

Russian hackers heavily targeted news outlet in days after U.S. election, researchers say

CyberScoopApr 25, 18:24 UTC · Apr 25, 2017Exploit / PoC in the wild

Week in review: PoC for Trend Micro Apex Central RCE released, Patch Tuesday forecast

Help Net SecurityJan 11, 00:00 UTC · Jan 11, 2026Exploit / PoC in the wildCVE-2025-69258 CVE-2025-37164

⚡ Weekly Recap: Fortinet Exploits, RedLine Clipjack, NTLM Crack, Copilot Attack & More

The Hacker NewsJan 20, 07:01 UTC · Jan 20, 2026Exploit / PoC in the wildCVE-2025-64155

Cloud security incidents make organizations turn to AI-powered prevention

Help Net SecurityJan 7, 07:59 UTC · Jan 7, 2025Exploit / PoC

Trend Micro fixes two actively exploited zero-days in enterprise products

Help Net SecurityMar 18, 00:00 UTC · Mar 18, 2020Exploit / PoC in the wildCVE-2020-8467 CVE-2020-8468 CVE-2020-8470+3 CVEs

Week in review: Apple fixes exploited zero-days, 1,900 Signal users exposed, Amazon Ring app vuln

Help Net SecuritySep 9, 10:34 UTC · Sep 9, 2022Exploit / PoC CVE-2022-32894 CVE-2022-32893

⚡ Weekly Recap: Zero-Day Exploits, Insider Threats, APT Targeting, Botnets and More

The Hacker NewsMay 19, 14:35 UTC · May 19, 2025Exploit / PoC in the wildCVE-2025-30397 CVE-2025-30400 CVE-2025-32701+22 CVEs

⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI

The Hacker NewsJan 20, 09:20 UTC · Jan 20, 2026Exploit / PoC CVE-2025-29824 CVE-2025-2775 CVE-2025-2776+19 CVEs

Closed loop automation combats IoT security threats in the 5G age

Help Net SecurityApr 15, 17:00 UTC · Apr 15, 2019Exploit / PoC

Zero-day patched by Microsoft has been exploited by attackers for over a year (CVE-2024-38112)

Help Net SecurityJul 16, 13:38 UTC · Jul 16, 2024Exploit / PoC in the wildCVE-2024-38112 CVE-2024-38021

Water Hydra’s Zero-Day Attack Chain Targets Financial Traders

Infosecurity MagazineFeb 14, 17:15 UTC · Feb 14, 2024Exploit / PoC CVE-2024-21412 CVE-2023-38831

Week in review: VirusTotal data leak, Citrix NetScaler zero-day exploitation

Help Net SecurityJul 23, 00:00 UTC · Jul 23, 2023Exploit / PoC in the wildCVE-2023-3519 CVE-2023-29298 CVE-2023-38203+3 CVEs

CrowdStrike cuts 5% of workforce after revenue jumped 29% last year

CyberScoopMay 7, 20:28 UTC · May 7, 2025Exploit / PoC in the wild

Identity-in-depth and the evolution of defense

Help Net SecurityDec 15, 12:23 UTC · Dec 15, 2023Exploit / PoC

Week in review: PoC for Splunk Enterprise RCE flaw released, scope of Okta breach widens

Help Net SecurityDec 3, 00:00 UTC · Dec 3, 2023Exploit / PoC in the wildCVE-2023-46214 CVE-2023-49103 CVE-2023-41998+5 CVEs2

Outcomes for 2010 and Predictions for 2011

Kaspersky SecurelistDec 13, 17:38 UTC · Dec 13, 2010Exploit / PoC

China-linked Murky Panda targets and moves laterally through cloud services

Help Net SecurityAug 22, 00:00 UTC · Aug 22, 2025Exploit / PoC CVE-2023-3519 CVE-2025-3928

API Security Trends 2023 – Have Organizations Improved their Security Posture?

The Hacker NewsOct 3, 11:59 UTC · Oct 3, 2023Exploit / PoC

Security tools still among the fastest

CyberScoopJan 28, 15:42 UTC · Jan 28, 2020Exploit / PoC in the wild1

Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)

Help Net SecurityNov 26, 13:25 UTC · Nov 26, 2024Exploit / PoC in the wildCVE-2024-43451 CVE-2024-49039 CVE-2024-43639+3 CVEs

How a $10B Enterprise Customer Drastically Increased their SaaS Security Posture with 201% ROI by Using SSPM

The Hacker NewsFeb 20, 10:22 UTC · Feb 20, 2024Exploit / PoC

Researcher Spotlight: You should have been listening to Lurene Grenier years ago

Cisco TalosAug 1, 12:00 UTC · Aug 1, 2022Exploit / PoC

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs