ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “VPN”

6,852 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 3159Ransomware 1123Policy & legal 639Data breach 609Vulnerability 402Malware 386Threat actor 317Phishing & fraud 210Advisory 18Industry 2Research 1
SeverityAllcritical 6722high 118medium 21low 1info 4

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackers · 2d agoExploit / PoC in the wild 3 sourcesCVE-2024-21762CVE-2020-1938

Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections

Microsoft's September 2026 Windows 11 update KB5124008 breaks certificate-based Always On VPN on some enterprise clients, forcing admins to pause rollout.

Microsoft's September 8, 2026 cumulative update KB5124008 for Windows 11 24H2 (build 26100.9445) and 25H2 (build 26200.9445) breaks certificate-based Always On VPN tunnels on some enterprise clients, with connectivity restored after uninstalling the update and rebooting. The issue was first detailed on Microsoft Q&A on September 9 by an administrator using Intune-deployed VPN profiles with RRAS and NPS on Windows Server 2019. The same mandatory Patch Tuesday package fixes two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, so many teams are pausing only VPN cohorts rather than blocking the full rollout.

Cyber Security Newsupdated · 2d agofirst · 5d agoVulnerability in the wild 8 sourcesCVE-2026-81963CVE-2026-858802

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records

Attackers exploited a VPN device vulnerability to breach Japan's Digital Agency, potentially exposing 246,000 records of government employees and officials.

Japan's Digital Agency disclosed that a third party exploited a medium-severity, non-zero-day vulnerability in a VPN device used by the Government Solution Service (GSS) to gain unauthorized access. Around 246,000 record rows were potentially exposed, including 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses of government employees and associated businesses. No My Number IDs, bank account details, or pension numbers were exposed, and no misuse of the data has been detected so far. The agency suspended the compromised staff account on July 9 and notified Japan's Personal Information Protection Commission on July 15.

BleepingComputerupdated · 2d agofirst · 2d agoData breach in the wild 2 sources