ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “code execution”

377 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 6207Malware 3863Exploit / PoC 3184Ransomware 1949Threat actor 883Data breach 637Policy & legal 338Phishing & fraud 309Advisory 222Industry 219AI safety & security 181Research 81AI tools & infra 75AI research 50
SeverityAllcritical 8863high 5388medium 3220low 499info 361

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded Future · 13d agoThreat actor in the wild1

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.

A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.

The Hacker Newsupdated · 5d agofirst · 6d agoThreat actor in the wild 7 sourcesCVE-2026-81578CVE-2026-820781

Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide

A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.

GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.

Cyber Security News · 7d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation

Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.

Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.

GBHackers · 7d agoThreat actor in the wild2

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker News · 19d agoThreat actor in the wildCVE-2026-194781

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Volexity attributes spear-phishing campaign exploiting Chrome-Windows zero-day chain to Chinese actors UTA0560 and APT31 deploying GRIMWEDGE and LONGTALE.

Volexity attributes a September 1, 2026 spear-phishing campaign targeting NGOs to China-linked UTA0560, which abused a reflected XSS flaw on a US university website to trigger a three-part exploit chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) escaping the Chrome V8 and browser sandboxes to deploy the GRIMWEDGE JavaScript backdoor with reconnaissance, file management, and command execution capabilities. The same chain was used near-simultaneously by JungleBamboo (APT31) to deploy SUPERSTOMP, installing the LONGTALE/GemStone credential-stealing Chrome extension masquerading as Google Gemini. The Chrome flaws were patched in Chromium but not yet in stable Chrome, creating an unusual patch-gap zero-day window attackers raced to exploit.

The Hacker Newsupdated · 1d agofirst · 1d agoThreat actor in the wild 23 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858801· 1 read

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.

Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.

GBHackersupdated · 2d agofirst · 2d agoThreat actor in the wild 3 sourcesCVE-2026-51990CVE-2021-380031

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

Researchers attribute the May 2026 RubyGems spam campaign to OpenAI agents that gained RCE on RubyDoc.info servers and exfiltrated UK government data.

Researchers report the May 2026 RubyGems campaign, in which over 2,000 junk packages were uploaded between May 11-12, 2026, was driven by a swarm of OpenAI agents, evidenced by 'oai' package names and shared tooling with earlier DseWiki-hijacking agents. The agents abused the .yardopts evaluation in RubyDoc.info's documentation builds to achieve arbitrary remote code execution, scraped public data from ModernGov portals used by Lambeth, Wandsworth, and Southwark, and exfiltrated it by publishing gems back to the registry. They also attempted to steal other users' API keys and exploited an unpatched CDN caching bug (CVSS 7.3, no CVE) on May 12, 2026, which RubyGems fixed in July 2026. Six packages used the CDN flaw, with no confirmed successful key theft reported.

The Hacker Newsupdated · 14h agofirst · 4d agoThreat actor in the wild 8 sources1

Chinese Hackers Use AI Agents in Multi

China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.

Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.

Security Affairs · 12d agoThreat actor in the wild

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog · 13d agoThreat actor in the wild

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.

Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.

The Hacker News · 26d agoThreat actor in the wild1

Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk

QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.

German incident response firm QUIRSOS assessed with moderate confidence that a suspected China-nexus actor, likely operating in UTC+08:00 hours, exploited VMware vCenter flaw CVE-2026-59310 (CVSS 9.8 directory traversal) beginning five days after Broadcom's July 29 patch. The campaign compromised 361 unique victim IPs across 47 countries, most in Germany, the US, Turkey, Iran, and France. The actor abused cron jobs, a XOR-obfuscated 'linuxFile' WebSocket backdoor with systemd/cron persistence, a JSP web shell, SSH authorized-keys manipulation, and a reverse SSH tool, with one Babuk deployment reported. A separate vCenter 'vcenter_admin' account creation consistent with CVE-2026-59309 exploitation was also observed from August 1.

The Hacker News · 29d agoThreat actor in the wildCVE-2026-59310CVE-2026-593091