ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “naming”

1,001 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 1016Ransomware 455Vulnerability 399Malware 345Data breach 312Threat actor 237Policy & legal 145Phishing & fraud 124AI safety & security 40Advisory 22Research 7Industry 5Model release 2
SeverityAllcritical 2507high 377medium 190low 18info 17

Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022

Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.

Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2022-26134

One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.

Gen Digital researchers found three weaknesses in Sogou Input Method's sgbiz protocol handler that chain into a one-click RCE running with the signed-in user's permissions. UNC3569 used the chain in an active intrusion, leveraging an unsandboxed Chromium 80 embedded browser, the known V8 flaw CVE-2021-38003, and DLL sideloading via 7-Zip to deploy the GRAYRABBIT backdoor. Tencent fixed the issue in version 16.3.0.3498 within 12 days of disclosure; Sogou is used by hundreds of millions of people, mainly in China.

Cyber Security News · 2d agoExploit / PoC in the wild 3 sourcesCVE-2026-51990CVE-2021-38003

Threat Brief: OWASSRF Vulnerability Exploitation

Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.

Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2022-41080CVE-2022-41082CVE-2022-410401

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security) · 12d agoExploit / PoC in the wildCVE-2026-756501

CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities

Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.

PaperCut NG/MF is affected by CVE-2026-81578, an improper access control flaw (CVSS 4.0 8.8) allowing unauthenticated configuration changes, and CVE-2026-82078, an unsafe dynamic class loading flaw (CVSS 4.0 9.4) enabling arbitrary Java bytecode execution. Chained, they yield pre-authentication remote code execution on the PaperCut Application Server. PaperCut confirmed active exploitation and customer incidents, and Huntress observed exploitation starting August 26, 2026. Emergency Patch Release 2 is available for NG/MF v24-v26, with IOCs including suspicious pc-app.exe child processes, truncated server.log files, and AnyDesk installs.

Horizon3.ai · 15d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.

Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.

Security Affairs · 9d agoExploit / PoC in the wild

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker News · 14d agoExploit / PoC in the wildCVE-2026-82078CVE-2026-815782

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

Huntress · 10d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.

Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.

The Hacker News · 11d agoExploit / PoC in the wild

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42 · 28d agoExploit / PoC in the wildCVE-2023-335381

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)

Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.

CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2022-22965CVE-2022-22963CVE-2010-16221