Search: “c2pa”

32 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 4 Phishing & fraud 4 Advisory 3 Vulnerability 2 AI tools & infra 2 AI industry 2 Research 2 Malware 1 Threat actor 1 Ransomware 1 AI research 1 Exploit / PoC 1 Model release 1

SeverityAll critical 11 high 1 medium 1 low 5 info 7

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added CVE-2026-76461, an actively exploited SQL injection in Cisco Secure Email Gateway, to the KEV catalog.

CISA added CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets and to check whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

CISA Advisoriesupdated Sep 16, 13:57 UTC · 23h agofirst Sep 14, 12:00 UTC · 3d agoExploit / PoC in the wild 17 sources CVE-2026-76461

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · securitySep 16, 13:24 UTC · 1d agoResearch

Adobe security advisory (AV26-848)

Canada's Cyber Centre relayed Adobe advisories covering vulnerabilities in Campaign Classic, Substance 3D apps, Adobe XD, Illustrator, and C2PA tools.

Bulletin AV26-848 lists Adobe vulnerabilities affecting Campaign Classic (through 7.4.4 build 9400), Substance 3D Designer, Painter, and Sampler, Adobe XD, C2PA Tool, Content Credentials Rust SDK, and Illustrator 2025/2026. The Canadian Centre for Cyber Security encourages users and administrators to review the linked Adobe bulletins and apply updates. Specific CVE identifiers are not enumerated in the advisory text.

Canadian Centre for Cyber SecurityAug 26, 13:56 UTC · 21d agoAdvisory

Zero-Day Flaw in TP-Link Cameras Enables Eavesdropping

OPSWAT disclosed two zero-days in TP-Link Tapo C200 cameras: CVE-2026-15315 authentication replay bypass enabling surveillance and CVE-2026-15316 denial-of-service, both patched in firmware.

OPSWAT found two zero-days in the TP-Link Tapo C200 camera, widely used for baby/pet monitoring and SOHO security: CVE-2026-15315, an authentication bypass via replay granting administrative access without the password, and CVE-2026-15316, an unauthenticated denial-of-service that crashes the camera's HTTPS service via oversized encrypted credentials. Both were fixed in firmware version V5_1.4.6 released August 18. A third, still-unpatched zero-day rated critical could allow full camera compromise for use as a network foothold; details await an available fix.

Infosecurity Magazineupdated Sep 16, 13:27 UTC · 1d agofirst Sep 16, 10:00 UTC · 1d agoVulnerability 3 sources CVE-2026-15315 CVE-2026-15316

Instagram’s AI detection is a mess (again)

Instagram is mislabeling ordinary edited photos as AI Content while some AI imagery goes unlabeled, repeating a 2024 detection failure.

The Verge documents weeks of erroneous AI Content labels on Instagram, including images edited only with Canva's Background Remover or an iPhone Photos app, while some generative images escape tagging. Canva said some of its assistive AI tools were being tagged as generative and claims the issue is fixed, though users still report tagging. Meta scans IPTC and C2PA metadata and uses signals like Google's SynthID, but remains vague about detection criteria; one tester found only Meta AI-created or edited images reliably triggered labels, and an image-poisoned photo was tagged. A similar mislabeling wave hit Instagram in 2024.

The Verge · AISep 4, 12:00 UTC · 13d agoAI industry

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker NewsSep 2, 07:47 UTC · 15d agoResearch CVE-2021-318862

ChatGPT Images 2.5: Faster, more precise, but not the same for everyone

OpenAI released GPT-Image-2.5 (Flare and Sunburst variants), cutting image generation latency up to 50% and improving multi-round edit consistency.

OpenAI launched GPT-Image-2.5 in two API variants: Flare, the faster default with higher quality than GPT-Image-2 at up to 50% lower latency, and Sunburst, built for precise multi-round edits. Both cost $8 per million input and $30 per million output tokens, with new xhigh and max quality tiers; a max-tier 1024x1024 image runs roughly $0.21. Testing found edit consistency strong in ChatGPT Work but inconsistent in Chat, and OpenAI has not documented how ChatGPT routes users between the models.

The DecoderSep 9, 12:17 UTC · 8d agoModel release

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.

CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.

Security AffairsSep 1, 08:13 UTC · 16d agoVulnerability in the wildCVE-2026-81578 CVE-2026-82078

Apple Reference Image: A New Approach for Verified Photography

Apple introduces Reference Image, hardware-backed verifiable photography on iPhone 18 Pro using sensor signing and Private Cloud Compute to counter AI-generated fakes.

Apple announced Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that produces securely timestamped, verifiable photographs. The design splits into two phases: a secure digital negative created by cryptographically signing pixel data at the sensor immediately after capture (preventing injection or tampering), then developing that negative into a reference image. Private Cloud Compute handles processing without exposing image contents to anyone, including Apple, and fraudulent reference images can be revoked without revealing the photographer's identity. Apple positions the system as stronger than C2PA-based approaches, which sign metadata after capture, are vulnerable to editing-chain compromise, and can tie images to a device or individual.

Hacker News · securitySep 16, 02:07 UTC · 1d agoResearch HN 25↑ · 18 comments

Six npm Packages Read C2 Addresses From Ethereum Wallet

Six malicious npm packages query an Ethereum wallet to resolve C2 addresses, hiding command-and-control infrastructure.

Six malicious packages on the npm registry were found querying an Ethereum wallet to locate their command-and-control infrastructure. Storing C2 addresses on the blockchain lets operators rotate infrastructure while avoiding hard-coded servers that are easy to block or sinkhole. The campaign targets developers installing dependencies from npm.

Infosecurity MagazineAug 11, 15:00 UTC · Aug 11, 2026Malware in the wild

Adobe security advisory (AV26-808) – Update 1

Canada's Cyber Centre updated Adobe advisory AV26-808 to flag that CVE-2026-71362 in Adobe Commerce is being exploited in the wild.

The Canadian Centre for Cyber Security advisory AV26-808 (Update 1) lists vulnerabilities affecting Adobe products including Campaign Classic, Adobe Commerce, Magento Open Source, ColdFusion 2023/2025, Lightroom Classic, and Content Credentials SDKs. Update 1 notes that open-source reporting indicates CVE-2026-71362 is being exploited in the wild. Users and administrators are urged to review the referenced links and apply updates, including those in Adobe bulletin APSB26-92 for Adobe Commerce.

Canadian Centre for Cyber SecuritySep 10, 16:03 UTC · 6d agoAdvisory in the wildCVE-2026-71362

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN continues targeting Israel, using Google Apps Script C2 relays and DNS-based channel routing in a .NET NativeAOT framework.

Kaspersky Securelist documents the continuation of Project CAV3RN operations against Israel. The modular .NET NativeAOT framework uses Google Apps Script as a C2 relay and DNS-based C2 channel selection, blending command traffic with legitimate Google services to evade detection.

Kaspersky SecurelistAug 11, 10:00 UTC · Aug 11, 2026Threat actor in the wild

Apple’s new iPhone camera mode promises to prove your photo isn’t AI

Apple's iPhone 18 Pro adds a Reference Image mode that cryptographically signs camera sensor pixels to prove photos were not AI-generated or edited.

Apple will launch a Reference Image mode with the iPhone 18 Pro lineup, using the new camera sensor to sign every pixel and develop the signed data via Private Cloud Compute into an unalterable reference image viewable in Photos. Users can compare the reference image against edited versions to verify authenticity, building on provenance standards like SynthID, C2PA, and Meta's Content Seal. A Reference Image API will span iOS, iPadOS, and macOS for third-party apps, though the feature launches without EU support, arriving there in iOS 27, iPadOS 27, and macOS 27.

The Verge · AISep 9, 19:30 UTC · 7d agoAI industry

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added actively exploited PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 to the KEV catalog, mandating federal patching.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2026-81578 (PaperCut NG/MF missing authentication for critical function) and CVE-2026-82078 (PaperCut NG/MF unsafe reflection). Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize and apply these updates. The KEV listing signals observed exploitation of the PaperCut print management platform.

CISA AdvisoriesAug 31, 12:00 UTC · 17d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA AdvisoriesSep 10, 12:00 UTC · 7d agoAdvisory CVE-2026-87020

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA AdvisoriesSep 3, 12:00 UTC · 14d agoAdvisory CVE-2026-78012

PaperCut security advisory (AV26-858) – Update 2

CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.

Canada's Cyber Centre updated security advisory AV26-858, noting PaperCut MF and PaperCut NG versions prior to the v24, v25, and v26 Emergency Patch Release 2 are affected by CVE-2026-81578 and CVE-2026-82078. Open-source reporting indicates both vulnerabilities are being exploited in the wild. In Update 2 (August 31, 2026), CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and the Cyber Centre urges administrators to apply the emergency patches immediately.

Canadian Centre for Cyber SecurityAug 31, 16:00 UTC · 16d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable BlogSep 15, 21:00 UTC · 1d agoVulnerability

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

CVE-2026-80047: Hugging Face Transformers 4.49.0 through 5.8.1 writes attacker-controlled Python files to disk before the trust_remote_code consent check.

CERT/CC vulnerability note VU#456290 describes CVE-2026-80047 in the Hugging Face Transformers library, affecting versions 4.49.0 through 5.8.1. The library performs a remote module fetch and writes attacker-controlled Python files to the local disk before evaluating the trust_remote_code consent prompt, without user authorization. This violates the security contract enforced across other dynamic module-loading paths in the library. Transformers is a primary framework for training and inference across NLP, vision, audio, video, and multimodal machine learning systems.

CERT/CC Vulnerability NotesSep 1, 13:35 UTC · 15d agoVulnerability CVE-2026-800471

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.

CISA added CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these high-risk vulnerabilities on exposed assets and verify whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.

CISA AdvisoriesSep 9, 12:00 UTC · 8d agoExploit / PoC in the wildCVE-2025-25249 CVE-2026-19490 CVE-2026-87491+1 CVEs

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security NewsSep 11, 07:15 UTC · 6d agoIndustry1

Fake CVE-2023

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42Aug 17, 10:57 UTC · Aug 17, 2026Malware CVE-2023-40477 CVE-2023-25157

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

Cisco patched an authenticated SSRF flaw in Packaged CCE and Unified CCE that lets credentialed users send arbitrary network requests from affected devices.

A server-side request forgery vulnerability caused by improper input validation of specific HTTP requests affects Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. An authenticated, remote attacker with valid user credentials can send crafted HTTP requests to make the device issue arbitrary network requests. Cisco has released software updates; no exploitation is reported in the advisory.

Cisco Security AdvisoriesAug 19, 16:00 UTC · 28d agoAdvisory

$536 and 8 Hours: AI Learns to Attack a Different PLC

Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.

Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.

Security AffairsSep 2, 13:50 UTC · 14d agoResearch CVE-2021-318861

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371· 1 read

Cisco security advisory (AV26-197) – Update 3

CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.

The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.

Canadian Centre for Cyber SecuritySep 9, 20:04 UTC · 7d agoExploit / PoC in the wildCVE-2026-20131 CVE-2026-20079

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.

CISA added CVE-2026-75650 (Adobe Commerce and Magento, improper neutralization in a template engine), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow), and CVE-2026-86218 (N-able N-central static code injection) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on exposed assets that grant total control post-exploitation and check for pre-patch compromise. All organizations are encouraged to prioritize these flaws in risk-based patching.

CISA AdvisoriesSep 8, 12:00 UTC · 9d agoExploit / PoC in the wildCVE-2026-75650 CVE-2026-81963 CVE-2026-85880+1 CVEs1

Oracle Corporation security advisory (AV26-929)

CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.

The Canadian Centre for Cyber Security (AV26-929) relays Oracle's September 2026 Critical Security Patch Update, which addresses vulnerabilities in dozens of product families as of September 15, 2026. Affected products include Oracle WebLogic Server, Database Server, E-Business Suite, Fusion Middleware, PeopleSoft Enterprise, Siebel Applications, GraalVM, VirtualBox, Coherence, and numerous banking and communications suites. The bulletin lists no CVE identifiers and encourages administrators to review Oracle's advisory and apply patches.

Canadian Centre for Cyber SecuritySep 16, 19:29 UTC · 18h agoAdvisory 3 sources

CTEM Is Not About the Stages. It’s About the Outcome.

Horizon3 argues CTEM programs should measure continuously reduced exposure rather than mapping technologies to Gartner's five stages.

Horizon3 contends that Continuous Threat Exposure Management should be judged by one outcome: continuously reducing attacker-reachable exposure, not by mapping a technology to each of Gartner's five stages. The post argues validation and verification, not visibility or closed tickets, provide evidence that attack paths are actually broken. It describes a Discover, Validate, Prioritize, Remediate, Verify, Repeat motion as its operationalization of CTEM.

Horizon3.aiSep 2, 13:11 UTC · 15d agoIndustry

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security NewsSep 16, 15:31 UTC · 21h agoExploit / PoC in the wild 4 sources CVE-2026-848695

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.

In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.

Zscaler ThreatLabzAug 17, 14:06 UTC · Aug 17, 2026Malware in the wild1

GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE

Six memory-safety and denial-of-service flaws disclosed in the GDCM DICOM parsing library, affecting versions through 3.2.7.

Researcher Abhinav Agarwal disclosed six vulnerabilities in GDCM (Grassroots DICOM), an open-source C++ library for parsing and processing DICOM files. All six were confirmed against GDCM 3.2.6 using AddressSanitizer and UndefinedBehaviorSanitizer, and source review found the vulnerable patterns through version 3.2.7 and the upstream master snapshot. Potential impacts include heap corruption, process-memory disclosure, stack exhaustion, and process termination in applications parsing untrusted DICOM files. No CVE identifiers have been assigned at the time of disclosure.

oss-securitySep 10, 03:35 UTC · 7d agoVulnerability