ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: SOCRadar

16 stories

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 6Vulnerability 4Data breach 2Tools 2AI safety & security 1Malware 1
SeverityAllcritical 3high 7medium 4low 0info 2source: SOCRadar ✕

Cisco FMC CVE-2026-20079 Actively Exploited

Cisco confirms active exploitation of CVE-2026-20079, a maximum-severity authentication bypass in Secure Firewall Management Center.

Cisco has confirmed that CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), is being actively exploited in the wild. The vulnerability carries a maximum CVSS severity, and defenders are urged to treat it as an urgent patch priority. FMC centrally manages Cisco Secure Firewall deployments, so exposure across enterprise environments is likely.

SOCRadarupdated · 1d agofirst · 5d agoExploit / PoC in the wild 13 sourcesCVE-2026-20079

Simplify Threat Intelligence Procurement with SOCRadar and AWS Marketplace

SOCRadar now offers its threat intelligence platform through AWS Marketplace to streamline security teams' procurement process.

SOCRadar announced its threat intelligence platform is available for purchase through AWS Marketplace, aiming to reduce procurement delays for security teams buying external threat intelligence. The vendor positions marketplace availability as a way to shorten budgeting and approval cycles.

SOCRadar · 4d agoTools

Vibe-Terrorism: Inside the Yemen Cell That Used Claude to Build Guided Weapons

Anthropic's threat intelligence report says a small Yemen cell used Claude to help build guided weapons, a novel AI misuse case.

SOCRadar highlights a case from Anthropic's September 2026 threat intelligence report in which a small militant cell based in northern Yemen used Claude to help build guided weapons. The write-up coins the term "vibe-terrorism" for this AI-assisted weapons development. It is framed as a novel example of AI misuse outside typical cyber threat activity.

SOCRadar · 4d agoAI safety & security

ShieldCrash PoC: Microsoft Defender Fix Bypass

A ShieldCrash proof-of-concept bypasses Microsoft's patch for CVE-2026-69414, a high-severity elevation-of-privilege flaw in the Microsoft Malware Protection Engine.

Microsoft previously fixed CVE-2026-69414 (ShieldBreak), a high-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. SOCRadar now reports a new proof-of-concept dubbed ShieldCrash demonstrating that the published fix can be bypassed. The available source text does not detail affected versions or whether the bypass has been used in real attacks.

SOCRadar · 5d agoExploit / PoC 8 sourcesCVE-2026-69414

September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited Windows elevation-of-privilege zero-days added to CISA's KEV catalog.

Microsoft's September 2026 Patch Tuesday release addresses 974 vulnerabilities, one of the largest monthly batch sizes. Two of the flaws are actively exploited zero-days, and both are Windows elevation-of-privilege vulnerabilities. CISA added both zero-days to its Known Exploited Vulnerabilities catalog, subjecting them to federal patching deadlines. SOCRadar's report provides a breakdown of the patched vulnerabilities by category.

SOCRadar · 6d agoExploit / PoC in the wild

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.

SOCRadar reports that exploitation of CVE-2025-25249 is being used to deploy PivotC2, a purpose-built post-exploitation RAT, on FortiGate firewall appliances. The attack follows the common pattern of compromising public-facing edge devices such as VPNs, routers, and firewalls as the initial entry point. Defenders running FortiGate appliances should prioritize patching and watch for post-exploitation activity indicating RAT deployment.

SOCRadar · 7d agoExploit / PoC in the wildCVE-2025-25249

FBI Investigates Nexus Claim of 153M+ Driver’s License Records

FBI is investigating dark web service Nexus's claim to sell access to over 153 million US and Canadian driver's license records.

A dark web service called Nexus claims to offer more than 153 million driver's license records from the United States and Canada. The FBI is investigating the claim. The scale of the alleged dataset would make it one of the larger exposed PII collections if verified.

SOCRadar · 8d agoData breach

StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited

Attackers are actively exploiting an unpatched zero-day dubbed StyleSmuggler in Magento Open Source and Adobe Commerce for unauthenticated remote code execution.

A zero-day vulnerability tracked as StyleSmuggler affects Magento Open Source and Adobe Commerce and permits unauthenticated remote code execution. The flaw is unpatched and exploitation is ongoing in the wild. E-commerce stores running these platforms are at direct risk of compromise until a fix is released.

SOCRadar · 8d agoExploit / PoC in the wild

Bring Licensed Threat Intelligence into Every Conversation with SOCRadar and ChatGPT

SOCRadar launched a Threat Intelligence MCP app connecting ChatGPT to its licensed threat intelligence via OAuth-authenticated MCP server.

SOCRadar announced a Threat Intelligence MCP app that connects ChatGPT to the SOCRadar MCP server over OAuth. The integration exposes the vendor's licensed intelligence models directly in ChatGPT conversations. The announcement is a vendor product launch with no incident or vulnerability content.

SOCRadar · 8d agoTools

E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access

SOCRadar reports underground posts claiming a Bangladeshi e-commerce database, Vedicline data leak, Langflow RCE, ASUS breach, and energy-sector shell access.

SOCRadar's Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database offered for sale. The roundup also covers a claimed Vedicline data leak, Langflow remote code execution, an ASUS breach claim, and energy-sector shell access sales. Details on record counts and victims were not provided in the excerpt.

SOCRadar · 8d agoData breach

N-able N-central HF4 Fixes Critical RCE After Series of Authentication Flaws

N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a critical pre-authentication RCE.

N-able shipped N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to patch CVE-2026-86218, a critical remote code execution vulnerability exploitable without authentication. The hotfix follows a series of authentication flaws discovered in the N-central platform. Organizations running N-central should apply the update promptly; the notice does not report active exploitation.

SOCRadar · 8d agoVulnerabilityCVE-2026-86218

CVE-2026-73749: HPE ArubaOS-CX RCE

HPE patched CVE-2026-73749, a critical unauthenticated remote code execution flaw in ArubaOS-CX network switch software; affected devices need prompt updates.

HPE released patches for CVE-2026-73749, a critical unauthenticated remote code execution vulnerability in HPE Aruba Networking AOS-CX switch operating system. Published details are limited, but the flaw allows unauthenticated attackers to execute code on affected AOS-CX devices. Administrators running ArubaOS-CX should prioritize applying HPE's update.

SOCRadar · 11d agoVulnerabilityCVE-2026-73749

CVE-2026-20212: Cisco Nexus 9000 RCE Flaw

Cisco disclosed CVE-2026-20212, a critical unauthenticated remote code execution flaw in the Silicon One integration of Nexus 9000 switches.

Cisco has disclosed CVE-2026-20212, a critical vulnerability in the Silicon One integration used by certain Nexus 9000 switches. The flaw allows an unauthenticated remote attacker to achieve remote code execution. The source excerpt does not state active exploitation or provide patch details.

SOCRadar · 11d agoVulnerabilityCVE-2026-20212

Elementor Pro RCE Flaw Under Active Attack

A critical Elementor Pro Forms module flaw allowing unauthenticated file uploads is under active attack against widely used WordPress sites.

A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload arbitrary files through the plugin's Forms module. The SOCRadar report indicates the flaw is being actively exploited in the wild. No CVE identifier was provided in the available text.

SOCRadar · 11d agoExploit / PoC in the wild

PEEP: A Browser RAT Posing as a Chrome Extension

SOCRadar's STRU analyzed PEEP, an emerging Chromium-based RAT disguised as a Chrome extension enabling post-exploitation control of browsers.

SOCRadar's Threat Research Unit (STRU) identified and analyzed PEEP, a Chromium-based post-exploitation toolkit distributed as a browser extension. PEEP provides RAT-style capabilities while posing as a legitimate Chrome extension. It is assessed as an emerging threat worth monitoring by defenders.

SOCRadar · 11d agoMalware

FalconFlank: CrowdStrike Falcon 0-Day PoC

A researcher published a working proof-of-concept for an alleged privilege escalation zero-day in CrowdStrike Falcon Sensor for Windows.

SOCRadar describes 'FalconFlank,' an alleged privilege escalation zero-day vulnerability in the CrowdStrike Falcon Sensor agent for Windows. The finding was published alongside working proof-of-concept code by a researcher. The available text does not state that exploitation has been observed in the wild, nor does it mention an assigned CVE.

SOCRadar · 12d agoVulnerability