Source: The Hacker News

2 stories in the last 3d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 4 Threat actor 3 Exploit / PoC 2 Tools 2 Vulnerability 2 Phishing & fraud 1 Data breach 1 Industry 1 AI safety & security 1 Research 1

SeverityAll critical 1 high 9 medium 5 low 0 info 3 source: The Hacker News ✕

Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

Cisco warns CVE-2026-76461 in Secure Email Gateway AsyncOS is actively exploited, letting unauthenticated attackers run root commands via crafted emails.

Cisco disclosed CVE-2026-76461, a CVSS 9.8 flaw in AsyncOS for Cisco Secure Email Gateway caused by insufficient validation in email parsing, allowing unauthenticated remote attackers to execute arbitrary SQL statements leading to root command execution. Active exploitation began in September 2026, and CISA added the flaw to its KEV catalog, requiring FCEB agencies to patch by September 17, 2026. Fixes are available in AsyncOS 15.5.5-0141, 16.0.4-302, and 16.5.0-780, with no workarounds. Cisco also contacted Secure Email Cloud customers where malicious activity was detected, and the article separately notes large-scale credential attacks on Fortinet VPN appliances generating tens of millions of authentication failures.

The Hacker Newsupdated 20:46 UTC · 1h agofirst 06:11 UTC · 16h agoExploit / PoC in the wild 15 sources CVE-2026-76461

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.

Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.

The Hacker News11:52 UTC · 10h agoExploit / PoC in the wild 4 sources CVE-2026-39987 CVE-2021-33044 CVE-2021-33045