Search: “third-party”

35 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 1723 Ransomware 1452 Data breach 1319 Malware 955 Policy & legal 777 Industry 637 Exploit / PoC 519 Phishing & fraud 451 Threat actor 413 AI tools & infra 144 AI safety & security 139 Research 100 Advisory 63 Tools 62

SeverityAll critical 3325 high 2533 medium 1441 low 1175 info 408

Hackers target WordPress sites via third-party WooCommerce plugin

Attackers exploit unauthenticated file-upload flaw CVE-2026-27540 in WooCommerce Wholesale Lead Capture plugin to install PHP webshells; Wordfence blocked 100,000+ attacks.

CVE-2026-27540 is an unauthenticated arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture premium plugin (versions 2.0.3.1 and older), caused by the exposed wwlc_file_upload_handler AJAX action trusting a user-controlled file_settings allowlist. Discovered by researcher Teemu Saarentaus, it was fixed in version 2.0.3.2 released February 20. Defiant reports Wordfence blocked over 100,000 attacks, with exploitation spikes between June 4-17, July 1, and August 30, delivering shell.php webshells for reconnaissance and additional payload uploads.

BleepingComputerupdated 15:00 UTC · 8h agofirst Sep 15, 14:45 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-275402· 1 read

Developer account body snatchers pose risks to the software supply chain

Cisco TalosOct 4, 12:51 UTC · Oct 4, 2022Exploit / PoC

Cybersecurity Webinar — SolarWinds Sunburst: The Big Picture

The Hacker NewsMar 9, 10:42 UTC · Mar 9, 2021Exploit / PoC

Three flaws allow attackers to bypass UEFI Secure Boot feature

Security AffairsAug 13, 09:39 UTC · Aug 13, 2022Exploit / PoC CVE-2022-34301 CVE-2022-34302 CVE-2022-34303

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

The Hacker NewsAug 8, 08:54 UTC · Aug 8, 2026Exploit / PoC in the wild

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Exploit / PoC in the wildCVE-2026-31431 CVE-2022-27666 CVE-2026-43284+1 CVEs

Beazley Exposure Management platform identifies external exposures and prioritizes cyber risk

Help Net SecurityApr 15, 10:16 UTC · Apr 15, 2026Exploit / PoC in the wild

Cybersecurity jobs available right now: August 19, 2025

Help Net SecurityJan 28, 13:12 UTC · Jan 28, 2026Exploit / PoC

SolarWinds fixed multiple flaws in Serv

Security AffairsJun 7, 21:37 UTC · Jun 7, 2024Exploit / PoC CVE-2024-28996 CVE-2024-28999 CVE-2024-29004

CISA adds Plex Media Server bug, exploited in LastPass attack, to Known Exploited Vulnerabilities Catalog

Security AffairsMar 13, 20:43 UTC · Mar 13, 2023Exploit / PoC in the wildCVE-2020-5741

Securing open-source code supply chains may help prevent the next big cyberattack

Help Net SecurityNov 24, 00:00 UTC · Nov 24, 2021Exploit / PoC

I know what you did last summer, MuddyWater blending in the crowd

Kaspersky SecurelistApr 29, 08:00 UTC · Apr 29, 2019Exploit / PoC

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.