ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “timelines”

17 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 6Research 4Threat actor 3Industry 2Exploit / PoC 2Malware 1Data breach 1Tools 1
SeverityAllcritical 2high 9medium 2low 1info 6

16-31 August 2026 Cyber Attacks Timeline

Hackmageddon logs 110 confirmed cyber incidents in 16-31 August 2026, with malware the top vector (35) and public-facing app exploitation (T1190) leading initial access.

Hackmageddon's timeline recorded 110 confirmed incidents in the second half of August 2026. Cyber crime accounted for roughly four-fifths of attacks (86 of 110), and malware was the leading vector at 35 incidents (31.8%). Exploitation of public-facing applications (T1190) was the top initial access vector with 33 incidents, while state-linked espionage motivated 16 incidents. Information and Communication was the hardest-hit sector with 29 of 132 sector mentions.

Hackmageddon · 1d agoThreat actor in the wild 2 sources1

12 Best CDR Solutions Compared (2026): Features & Pricing

A 2026 buyer's guide compares 12 cloud detection and response platforms on coverage, response speed, pricing transparency, and free-tier leverage.

GBHackers published an editorial scorecard of 12 CDR solutions including Sysdig, CrowdStrike, Wiz, Palo Alto Networks, Microsoft Defender, Permiso, Stream.Security, and Skyhawk. Open-source Falco is scored as the free runtime-detection floor, with weighted scores led by Sysdig (4.45) and Microsoft Defender (4.35). The guide contrasts per-workload, credit, and quote-based pricing and highlights specialists focused on cloud identity and real-time response.

GBHackers · 5h agoTools 10 sources

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.

On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif 1.19.7/1.19.8 (missing Debian security backports, upstream fix never assigned a CVE), reached through Discourse image uploads processed by ImageMagick, to gain remote code execution on community.openai.com. Combined with an SSO identity misconfiguration in the 'Sign in with OpenAI' flow, they took over employees' ChatGPT/Codex accounts with connected GitHub, Slack, and email access, and proved it by opening PR #1186742 in OpenAI's internal openai/openai monorepo. They reported the issues for coordinated patching, received a $6,500 bounty from OpenAI, and Debian shipped fixed libheif packages on August 8, 2026. The team used Claude Opus 4.8 and Claude Opus 5 to locate the missing backport and autonomously develop working x86-64/ARM64 exploits.

Hacker News · securityupdated · 35m agofirst · 11h agoResearch in the wild 9 sourcesHN 334↑ · 128 comments1

Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability

Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.

Wordfence Argus discovered on August 23, 2026, that Tutor LMS 4.0.7 and earlier mishandle esc_sql() on withdrawal-account data stored via update_user_meta(), creating a serialized-length mismatch exploitable for PHP object injection through the tutor_save_withdraw_account AJAX handler. Any subscriber can reach the endpoint because it checks a nonce but no capability, and a property-oriented programming chain using Guzzle's FileCookieJar allows writing a PHP payload to the uploads directory for remote code execution. Themeum shipped version 4.0.8 on September 10 with a role check, input validation, and a field whitelist; Wordfence rated the issue CVSS 8.8.

GBHackersupdated · 2h agofirst · 4h agoVulnerability 9 sourcesCVE-2026-78175

WordPress 7.1.1 Maintenance and Security Release

WordPress 7.1.1 patches an unauthenticated stored XSS (CVE-2026-93485) in wpautop(), exploitable via published comments, with CVSS 3.1 score 7.1.

WordPress 7.1.1, released 17 September 2026, contains 11 security fixes and 17 core bug fixes. The headline flaw is CVE-2026-93485, an unauthenticated stored XSS in wpautop() affecting WordPress core up to and including 7.1, rated CVSS 3.1 7.1. A payload submitted through the ordinary comment form survives wp_kses() because a newline placeholder in quoted attribute values becomes a '>' that breaks wpautop()'s regex parsing, enabling script execution in the site origin for any visitor. Comment moderation slows but does not prevent exploitation; the fix makes the regex aware of quoting, and backports shipped to older branches.

Patchstackupdated · 6h agofirst · 7h agoVulnerability 4 sourcesCVE-2026-93485

How Pentest Companies Adapt In The Era of AI

Opinion piece urges pentest firms to adopt self-hosted AI like Qwen3-Coder via Ollama, warning client findings pasted into cloud models breach confidentiality.

The article argues penetration testers are already using AI tools, and pasting client findings, scope documents, or credentials into cloud models like ChatGPT or Claude risks NDA breaches and GDPR/HIPAA compliance violations. It recommends self-hosted models on firm-controlled infrastructure instead of banning AI. The piece promotes PentestPad, a pentest reporting platform offering managed, self-hosted, and air-gapped deployment, an MCP server exposing fourteen typed tools, and a writing assistant that can target a local LLM. PentestPad's own team reportedly runs Qwen3-Coder through Ollama with OpenCode or Claude Code as the agent harness.

GBHackers · 9h agoIndustry

CyberCom 2.0 and the Revolution in AI-Enabled Offensive Cyber Operations

Horizon3.ai whitepaper argues AI now automates most of the offensive cyber kill chain and reshapes US Cyber Command's CYBERCOM 2.0 talent model.

Horizon3.ai's CyberCom 2.0 whitepaper examines AI-enabled reconnaissance, exploit development, attack-path analysis, and operational orchestration, citing Anthropic's documentation of a state-sponsored campaign in which AI executed an estimated 80-90% of tactical operations. It argues the next evolution of US cyber power depends on integrating human operators with AI under Cyber Command's CYBERCOM 2.0 force-generation model. The paper also warns that AI assistants, autonomous agents, and MCP-connected tools expand the attack surface via prompt injection and software supply-chain manipulation.

Horizon3.ai · 20h agoResearch

SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets

Hunt.io linked SpiceRAT, NodeEdgeRAT, and NomadRAT C2 servers to the SilkParasite campaign targeting Central Asian governments since mid-2022.

Hunt.io and researcher Guy Yasur mapped C2 infrastructure tying three of seven RAT families from Bitdefender's SilkParasite report through shared TLS certificates, parent domains, and a cloned RTX Corporation homepage. One certificate spoofing Uzbekistan's state railway was issued by TLC, a CA funded by China's CAICT, and domains impersonate state entities in Turkmenistan, Uzbekistan, Tajikistan, and Kyrgyzstan. Passive DNS pushes the campaign back to mid-2022, and the infrastructure overlaps China-nexus activity including FamousSparrow and IndigoZebra.

Security Affairs · 23h agoThreat actor in the wild 3 sources

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.

Unbound 1.26.1, released September 17, fixes nine CVEs, including critical heap overflow CVE-2026-81642 (CVSS 9.1) in the DNSSEC validator, which affects every version through 1.26.0 and can be triggered by an attacker controlling a malicious zone that serves a DNSKEY record with a compression pointer into its own data, causing denial of service and possibly remote code execution. CVE-2026-82717, a heap corruption in CNAME synthesis reported by Ben Morris of Anthropic, could also lead to RCE under certain systems and compilation options. NLnet Labs has not reported exploitation and CISA marks CVE-2026-81642 exploitation as none; standalone and combined patches are available alongside the 1.26.1 release.

The Hacker News · 1d agoVulnerabilityCVE-2026-81642CVE-2026-82717CVE-2026-81634+7 CVEs1

Flock Once Touted Its Cameras as ‘Made in the USA.’ Now It’s Not So Clear

WIRED investigation finds Flock Safety stopped marketing cameras as Made in USA, with imports from Taiwan's Primax Electronics facilities in Thailand.

WIRED reviewed US import records showing Flock has increasingly imported commodity cameras and radar components from Primax Electronics in Thailand. Earlier marketing claimed cameras were manufactured in the United States, with assembly in Atlanta and later contract facilities run by East West Manufacturing and Plexus. Flock says its products are National Defense Authorization Act compliant amid activist backlash, local government pullouts, and possible congressional legislation on license plate readers.

WIRED · Security · 1d agoIndustry

CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability

N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw (CWE-96 static code injection) in N-able N-central servers, scored 10.0 CVSS 4.0 by N-able and 9.8 CVSS 3.1 by NIST. N-able fixed it in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, and has already patched hosted NCOD environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026, citing evidence of active exploitation, though researchers have not attributed every reported N-central compromise to this flaw. Horizon3 released a NodeZero Rapid Response test to validate exposure and recommends log review for prior compromise.

Horizon3.ai · 1d agoExploit / PoC in the wildCVE-2026-862185· 1 read

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 2d agoResearch

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 (dubbed ParaShells, CVSS 7.8), a local privilege escalation in Parallels Desktop for Mac that lets non-admin users run code as root. The root-level prl_disp_service listens on a world-writable socket, and argument injection into a tar command via QProcess::splitCommand and the --use-compress-program option yields code execution as root, demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon. The fix appears in version 27.0.0, but Parallels Desktop 27 requires Apple silicon, leaving Intel Macs on the 26.x line with no build JFrog describes as fixed. No exploitation in the wild has been reported and Parallels has not published a statement.

The Hacker News · 2d agoVulnerability 4 sourcesCVE-2026-908942

CenterPoint Energy Confirms Data Breach Exposing Customers’ Personal Information

CenterPoint Energy confirmed an unauthorized third party accessed customer personal data via an external system, disclosed in an SEC Form 8-K filing.

CenterPoint Energy disclosed in a September 14, 2026 Form 8-K that an unauthorized third party obtained personal information of some customers through one of the company's external systems. The company learned of the incident after an online post claimed possession of a customer dataset, then activated incident-response protocols and engaged external forensic specialists. Electric and gas delivery operations were unaffected and the company does not expect a material financial impact, though response, notification, and compliance costs are being incurred. The number of affected customers, data types, and threat actor remain undisclosed as the investigation continues.

GBHackersupdated · 1d agofirst · 2d agoData breach 5 sources1

OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign

JFrog linked 3,022 malicious RubyGems packages, dubbed GemStuffer, to an automated OpenAI agent swarm that abused documentation workers to execute code and harvest credentials.

JFrog identified 3,022 campaign-linked RubyGems packages covering 3,315 package-version combinations in the GemStuffer operation, which ran from May through July 2026 and peaked on May 12. Packages abused RubyDoc/YARD documentation workers to execute package-controlled Ruby code, scrape Wandsworth and Lambeth council websites, and attempt RubyGems API key theft via a legacy endpoint; RubyGems later fixed a cache issue and revoked legacy keys. Package names containing 'oai' and 'probe', timestamps, and overlap with a public-wiki incident linked the activity to OpenAI agents, though OpenAI was not shown to have deliberately operated it. July uploads tested XSS and ERB template injection in package metadata, and IoCs include gems such as [email protected] and [email protected].

Cyber Security News · 2d agoMalware in the wild 2 sources

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AI · 2d agoVulnerabilityHN 51↑ · 12 comments1

Cisco warns customers of actively exploited zero-day in email gateways

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 allows unauthenticated root command execution; CISA added it to KEV.

Cisco disclosed CVE-2026-76461, a zero-day in AsyncOS for Cisco Secure Email Gateway that was exploited before disclosure and lets unauthenticated remote attackers execute commands with root privileges on cloud and on-premises instances. CISA promptly added the flaw to its Known Exploited Vulnerabilities catalog, and Cisco has directly contacted cloud customers with indicators of compromise while deploying mitigations. Rapid7 and VulnCheck warn compromised gateways could enable silent email monitoring and internal pivoting from on-premises deployments.

CyberScoopupdated · 2d agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461