ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “HTTP File Server”

13 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 24Malware 12AI safety & security 4AI tools & infra 4Vulnerability 3Tools 2Advisory 2AI research 1Threat actor 1
SeverityAllcritical 14high 20medium 11low 0info 8

Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.

Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.

BleepingComputerupdated · 2d agofirst · 5d agoExploit / PoC in the wild 13 sourcesCVE-2026-20079CVE-2026-20316

Hackers target exposed Vite dev servers to steal AWS, Azure secrets

Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.

F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.

BleepingComputerupdated · 1d agofirst · 1d agoExploit / PoC in the wild 4 sourcesCVE-2026-39364CVE-2025-30208CVE-2025-31125+1 CVEs1

Exposed Vite servers are being probed for AWS and Azure credentials

F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.

F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.

CSO Online · 20h agoExploit / PoC in the wildCVE-2026-39364CVE-2025-30208CVE-2025-31125+4 CVEs

Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers

AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.

GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.

GBHackersupdated · 5d agofirst · 6d agoExploit / PoC in the wild 8 sourcesCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security News · 1d agoMalware in the wild

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal enabling arbitrary file reads, already probed in the wild.

GitLab released patches for a maximum-severity path traversal flaw (CVE-2026-85706, CVSS 10.0) in the repository commits API, caused by improper path confinement and missing authentication enforcement, allowing unauthenticated arbitrary file reads. watchTowr observed active in-the-wild probes starting 06:00 UTC on September 11, 2026; exploitation requires at least one public project and enables theft of credentials, secrets, and configuration data. GitLab also patched CVE-2026-87719 (CVSS 9.9), an insecure deserialization bug in Enterprise Edition allowing authenticated Duo Chat users to access Advanced Search configurations and sensitive credentials via crafted GraphQL subscription arguments. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and the flaw follows the recently exploited GraphQL code injection bug CVE-2026-19478.

The Hacker Newsupdated · 1d agofirst · 4d agoExploit / PoC in the wild 17 sourcesCVE-2026-85706CVE-2026-87719CVE-2026-194781

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.

GBHackersupdated · 6d agofirst · 6d agoThreat actor in the wild 2 sources1

Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft

Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.

An internet scan of 3,074 exposed LiteLLM instances found 294 (9.6%) accepting the default sk-1234 master key and 191 (6.2%) requiring no authentication. CVE-2026-59822 lets a single-character Bearer token establish a valid MCP session via an OAuth2 fallback in versions before 1.84.0; the flaw is in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-59821 allows Python code execution as root in the gateway container via unsanitized Custom Code Guardrails registration before 1.82.0-stable, and CVE-2026-35029 permits config changes leading to RCE and admin takeover. Admin access plus pass-through endpoints can reach cloud metadata services to steal IAM credentials.

GBHackers · 5d agoAI safety & security in the wild 4 sourcesCVE-2026-59822CVE-2026-59821CVE-2026-35029

Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root

Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.

Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.

GBHackersupdated · 6d agofirst · 6d agoVulnerability 2 sources1

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.

Elastic Security Labs documents KREMLIN (tracked as REF9334), a Brazilian banking malware toolkit active since at least May 2025 that impersonates a dozen Brazilian banks. It uses multi-stage JavaScript loaders, a C++ installer that DLL-sideloads via a legitimate SentinelOne binary, and a malicious Chrome/Edge extension named 'AVSync System Inc.' Ethereum smart contracts act as dead-drop resolvers for C2 endpoints, a shift that occurred May 19, 2026, making infrastructure hard to disrupt. The extension harvests cookies, sessionStorage/localStorage, browsing history, screenshots, and full page HTML via WebSocket plus CSS-disguised polling endpoints. The group has run seven distinct campaigns and also distributes Pulsar RAT and Remcos RAT.

The Hacker Newsupdated · 6h agofirst · 16h agoMalware in the wild 2 sources

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA Advisories · 23h agoAdvisoryCVE-2024-42384CVE-2024-42385CVE-2024-42386+11 CVEs

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated · 23h agofirst · 1d agoMalware in the wild 7 sources

Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days

Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.

Proofpoint tracked an exploit kit dubbed BlueMoon that chains CVE-2026-85046, a Chrome V8 type-confusion bug, with an unnamed V8 sandbox escape and CVE-2026-85880, a Windows kernel privilege escalation using ALPC and the Windows Notification Facility. The first observed use was by China-nexus TA412 (APT31, Violet Typhoon, JungleBamboo) on August 28, 2026 against US NGOs, mining companies, and commodity trading firms, followed by UNK_LateNight targeting US aerospace and defense companies on September 2. Both V8 bugs were patch-gap zero-days: the fix was committed to Chromium on August 7 but reached stable Chrome on September 3, enabling rapid weaponization from public patches. TA412's post-exploitation payload, GemStone, is a malicious browser extension posing as an AI-powered Google Gemini companion that captures keystrokes, cookies, screenshots, and browsing history via a Cloudflare Worker C2.

Security Affairsupdated · 1d agofirst · 6d agoExploit / PoC in the wild 20 sourcesCVE-2026-85046CVE-2026-858801