Search: “Command Center”

11 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 17 Research 5 AI safety & security 5 Industry 4 Advisory 4 Malware 3 Threat actor 3 Policy & legal 2 Phishing & fraud 1 AI policy 1 Vulnerability 1 Tools 1 Data breach 1

SeverityAll critical 15 high 12 medium 9 low 1 info 11

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Cisco fixed an unauthenticated Java deserialization RCE in FMC's External Database Access feature allowing root command execution via a TCP port.

Insecure deserialization of a user-supplied Java byte stream in Cisco Secure Firewall Management Center's External Database Access feature lets an unauthenticated remote attacker execute arbitrary commands and elevate to root. Exploitation requires sending a crafted serialized stream to a specific TCP port from a host configured in the external database access list. Cisco has released software updates.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 12h agoAdvisory 7 sources

Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites

Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.

Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.

Cyber Security NewsSep 16, 11:44 UTC · 17h agoThreat actor 2 sources

Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection

Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.

Anthropic Threat Intelligence's report covering December 2025 to August 2026 details AI-automated campaigns by espionage groups, criminals, and hacktivists. GTG-20006, aligned with Russia-linked Midnight Blizzard, targeted Ukrainian and European government and drone supply chains, used Claude to autonomously rebuild malware when detected, hijacked hotel Wi-Fi DNS to serve ClickFix lures, and stole over 300,000 identity records from a North African government. Operators linked to ShinyHunters decompiled roughly 1.8 million Android packages for hardcoded secrets and pivoted from an XSS flaw in a SaaS vendor into 200+ downstream organizations in about 34 hours, harvesting 2,100+ Azure AD token sets across 40 tenants. The Chinese-linked GTG-10007 ran parallel agent swarms that surfaced more than a dozen candidate zero-day vulnerabilities in a single month.

Cyber Security Newsupdated Sep 16, 17:41 UTC · 11h agofirst Sep 11, 02:40 UTC · 6d agoAI safety & security in the wild 19 sources1

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.

CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center authentication bypass, CVSS 10.0), CVE-2026-19490 (Citrix NetScaler ADC/Gateway authentication bypass, CVSS 9.3), and CVE-2025-25249 (FortiOS heap buffer overflow, CVSS 7.3) to the Known Exploited Vulnerabilities catalog with a September 12, 2026 deadline for FCEB agencies. Cisco confirmed active exploitation of CVE-2026-20079 in August 2026, while Previdian honeypots logged 56 NetScaler exploitation attempts since September 3. SOCRadar attributes Fortinet exploitation to a financially motivated Russian-speaking actor deploying the PivotC2 Node.js RAT, infecting 178 of over 3,000 targeted IP addresses, mostly in the US.

The Hacker Newsupdated Sep 10, 18:57 UTC · 6d agofirst Sep 10, 10:36 UTC · 6d agoExploit / PoC in the wild 6 sources CVE-2026-20079 CVE-2026-19490 CVE-2025-252491

Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

JFrog's 'ParaShells' research details CVE-2026-90894, a Parallels Desktop local privilege escalation letting unprivileged macOS users gain root via tar argument injection.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 ('ParaShells'), a critical local privilege escalation flaw demonstrated against Parallels Desktop 26.4.0 build 57513 on Apple silicon. The world-writable /var/run/prl_disp_service.socket accepts connections from unsigned clients, and argument injection into a tar extraction command via the --use-compress-program option executes attacker-controlled code with root privileges. The attack needs no administrator permissions, running VM, or Parallels-signed client, and a one-line PoC yielded a root shell. Risk is highest on developer workstations, shared training systems, and enterprise Macs.

GBHackersupdated Sep 16, 13:14 UTC · 15h agofirst Sep 16, 11:29 UTC · 17h agoVulnerability 4 sources CVE-2026-90894

China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks

Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.

Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.

GBHackersupdated Sep 16, 16:06 UTC · 12h agofirst Sep 12, 08:04 UTC · 4d agoExploit / PoC in the wild 14 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858802· 1 read

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security NewsSep 14, 13:33 UTC · 2d agoMalware in the wild

New DDRop Attack Breaks Intel TDX and AMD SEV-SNP With $159 DDR5 Device

DDRop uses a $159 DDR5 RDIMM interposer to silently drop memory writes and break Intel TDX and AMD SEV-SNP confidential VMs.

Researchers published DDRop, a physical attack built from about $159 in parts that uses a custom DDR5 RDIMM interposer to inject parity errors and silently discard selected cache-line writebacks. Intel TDX, Intel Scalable SGX, and AMD SEV-SNP are affected because they lack per-line cryptographic freshness, so processors can accept stale encrypted data as valid state. The team demonstrated deterministic plaintext copying between pages, malicious Secure EPT entry injection, forcing trust domains into debug mode, and forging attestation measurements. The attack requires privileged host control plus brief physical access, and researchers say no simple software patch exists.

Cyber Security NewsSep 15, 09:57 UTC · 1d agoResearch 2 sources

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UKSep 15, 12:00 UTC · 1d agoThreat actor in the wild2

DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.

Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.

GBHackersSep 15, 09:57 UTC · 1d agoResearch

Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.

Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.

BleepingComputerupdated Sep 14, 09:27 UTC · 2d agofirst Sep 10, 15:43 UTC · 6d agoExploit / PoC in the wild 9 sources CVE-2026-20079 CVE-2026-203161