ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “rapids”

28 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 19Industry 17AI safety & security 14AI industry 12Threat actor 10AI research 8Research 8Malware 7Policy & legal 6Phishing & fraud 6Tools 5Vulnerability 4AI policy 4Data breach 3
SeverityAllcritical 10high 31medium 13low 1info 74

CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability

GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.

GitLab disclosed CVE-2026-85706, a CVSS 3.1 10.0 path traversal flaw in the repository commits API of self-managed GitLab CE/EE (18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2), exploitable without authentication to read arbitrary server files. Successful exploitation can expose credentials, tokens, SSH keys, and database credentials accessible to the GitLab process. Fixed versions 19.1.8, 19.2.6, and 19.3.2 were released September 10, 2026; GitLab.com and Dedicated were already patched and no workaround is provided. Horizon3 released a NodeZero Rapid Response test to validate exposure and advises credential rotation for internet-facing instances.

Horizon3.aiupdated · 2d agofirst · 5d agoVulnerability 18 sourcesCVE-2026-857061

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security News · 2d agoThreat actor in the wild

Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds

Attackers exploited pre-auth RCE CVE-2026-39987 in Marimo notebooks to steal AWS credentials and SSH into a bastion host in eight seconds.

Sysdig Threat Research Team documented an intrusion abusing CVE-2026-39987, an unauthenticated RCE in Marimo's terminal WebSocket endpoint affecting versions up to 0.20.4 and fixed in 0.23.0. The attacker harvested AWS credentials from the host environment and Redis backend, queried AWS Secrets Manager to retrieve an SSH private key, and authenticated to an internet-facing SSH bastion host just eight seconds after opening the WebSocket session. Human-operated custom tooling, not an AI agent, executed the full exploit-to-lateral-movement chain.

Cyber Security Newsupdated · 1d agofirst · 2d agoExploit / PoC in the wild 4 sourcesCVE-2026-39987

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputerupdated · 18h agofirst · 5d agoPhishing & fraud in the wild 8 sources3

Hackers Abuse Claude AI Agents to Automate Cyberattacks, Exploitation and Data Theft

Anthropic reports actors including GTG-20006 (Midnight Blizzard-linked) and ShinyHunters clusters abused Claude AI agents to automate phishing, credential harvesting, and data theft against 20+ organizations.

Anthropic's September 2026 threat intelligence report describes threat actors operating multi-agent workflows built on Claude models to automate the cyber kill chain, from reconnaissance and phishing to exfiltration. The group GTG-20006, assessed as consistent with Midnight Blizzard, targeted Ukrainian and European government, diplomatic, defense, and intelligence entities plus the drone supply chain, with more than 20 organizations identified. Clusters tied to ShinyHunters used 10 AWS EC2 instances to decompile 1.8 million Android APKs for hard-coded secrets and, in a separate SaaS supply chain intrusion, dumped over 2,100 Azure AD token sets across 40+ corporate tenants in about 34 hours. Reported malware families include PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc, the GiftDrop Android RAT, and the DarkSword iOS exploit chain.

GBHackersupdated · 15h agofirst · 6d agoThreat actor in the wild 20 sources1

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers · 19h agoPhishing & fraud in the wild2

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Google Pixel improper authorization flaw CVE-2026-58704 to its KEV catalog, mandating federal remediation.

CISA added CVE-2026-58704, an improper authorization vulnerability in Google Pixel devices, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of KEV-listed vulnerabilities on exposed assets. CISA urges all organizations to prioritize patching KEV entries.

CISA Advisoriesupdated · 19h agofirst · 21h agoExploit / PoC in the wild 17 sourcesCVE-2026-58704

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added actively exploited CVE-2026-76460 (Cisco Identity Services Engine) and CVE-2026-87886 (Acronis Backup) to its KEV catalog.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that grant total control post-exploitation, and check whether systems were compromised before patching.

CISA Advisories · 21h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-87886

Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials

Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.

Group-IB attributes a large-scale SMS phishing campaign to Outsider, an operator sub-cluster within the Smishing Triad phishing-as-a-service ecosystem, using a kit dubbed JWR. The Vue 2-based platform maintains real-time WebSocket communication with operators, enabling them to adapt pages live and harvest roughly 70 PII fields, card data, PINs, OTPs, identity document images, and digital wallet credentials via a dedicated PayPal sub-funnel. Unit 42 previously tied 194,345 malicious domains across 136,933 root domains to the broader operation since January 2024. Defenders can hunt for /api/open/ endpoints, /webSocket/QT/ paths, JWR-prefixed storage artifacts, and a hard-coded WebSocket token.

GBHackersupdated · 19h agofirst · 21h agoPhishing & fraud in the wild 2 sources

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security News · 1d agoVulnerability in the wildCVE-2026-627211

OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign

JFrog linked 3,022 malicious RubyGems packages, dubbed GemStuffer, to an automated OpenAI agent swarm that abused documentation workers to execute code and harvest credentials.

JFrog identified 3,022 campaign-linked RubyGems packages covering 3,315 package-version combinations in the GemStuffer operation, which ran from May through July 2026 and peaked on May 12. Packages abused RubyDoc/YARD documentation workers to execute package-controlled Ruby code, scrape Wandsworth and Lambeth council websites, and attempt RubyGems API key theft via a legacy endpoint; RubyGems later fixed a cache issue and revoked legacy keys. Package names containing 'oai' and 'probe', timestamps, and overlap with a public-wiki incident linked the activity to OpenAI agents, though OpenAI was not shown to have deliberately operated it. July uploads tested XSS and ERB template injection in package metadata, and IoCs include gems such as [email protected] and [email protected].

Cyber Security News · 1d agoMalware in the wild 2 sources

Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities

Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.

Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.

GBHackers · 1d agoAdvisory

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated · 18h agofirst · 1d agoExploit / PoC in the wild 6 sourcesCVE-2026-27540

Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting

Google GTIG documents a financially motivated actor using a multi-agent AI framework to automate credential harvesting, compromising over 23,800 secrets within hours.

Google Threat Intelligence Group (GTIG) documented a financially motivated actor that compromised an unnamed organization's cloud infrastructure and used a multi-agent AI framework to automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. The operation went from planning to mass credential compromise in under six hours, harvesting more than 23,800 secrets including cloud and AI-service API keys via an exposed C2 dashboard called 'Recon'. The actor directed specialized agents using an AI coding chatbot and Markdown instruction files such as AGENTS.KNOWLEDGE.md and agentic_vuln_research.md. Google has not observed fully autonomous zero-day exploitation; the shift automates labor-intensive tasks like reconnaissance, account validation, and infrastructure management, sharply shrinking detection windows.

GBHackers · 2d agoThreat actor in the wild1

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Volexity attributes spear-phishing campaign exploiting Chrome-Windows zero-day chain to Chinese actors UTA0560 and APT31 deploying GRIMWEDGE and LONGTALE.

Volexity attributes a September 1, 2026 spear-phishing campaign targeting NGOs to China-linked UTA0560, which abused a reflected XSS flaw on a US university website to trigger a three-part exploit chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) escaping the Chrome V8 and browser sandboxes to deploy the GRIMWEDGE JavaScript backdoor with reconnaissance, file management, and command execution capabilities. The same chain was used near-simultaneously by JungleBamboo (APT31) to deploy SUPERSTOMP, installing the LONGTALE/GemStone credential-stealing Chrome extension masquerading as Google Gemini. The Chrome flaws were patched in Chromium but not yet in stable Chrome, creating an unusual patch-gap zero-day window attackers raced to exploit.

The Hacker Newsupdated · 1d agofirst · 2d agoThreat actor in the wild 9 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858801· 1 read

HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware

Hijacked HBO Max verified Reddit account ran 108 ClickFix malvertising ads delivering AMOS and Amatera stealers plus crypto clippers to macOS and Windows users.

Threat actors hijacked HBO Max's verified Reddit account (u/hbomax) to run 108 malicious ClickFix ads over 48 hours in a campaign tracked as PasteSwitch, researched by Hudson Rock and ADAMnetworks. macOS victims were served curl | zsh chains deploying MacSync and Atomic macOS Stealer (AMOS), which harvest browser credentials, Telegram data, Apple Notes, and macOS passwords, while fake Ledger, Trezor, and Exodus apps targeted BIP39 seed phrases. Windows users received an InstallFix chain using an MP3/HTA polyglot with mshta and PowerShell, scheduled-task persistence, AMSI disabling, and in-memory Amatera Stealer that hid C2 traffic (77.91.65.13:443) behind a facebook.com TLS SNI. AnimateClipper and ZigClipper components swapped copied crypto wallet addresses and used Binance Smart Chain contracts as mutable C2 dead drops; Reddit paused the ads and the initial access path remains undisclosed.

GBHackersupdated · 1d agofirst · 2d agoMalware 7 sources

GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

GPUThor uses non-uniform hammering to amplify Rowhammer on NVIDIA GPUs, achieving 500X-23,500X more bit flips and first exploits of ECC-protected GPUs.

GPUThor is a Rowhammer attack on NVIDIA GPUs that reverse-engineers memory-access coalescing behavior to enable non-uniform hammering patterns activating aggressor rows more intensely than decoy rows. By identifying refresh instances where in-DRAM mitigations apply, it constructs longer patterns that escape mitigation across refresh intervals. It yields 500X to 23,500X more bit flips than prior GPU Rowhammer attacks across NVIDIA A4000, A4500, A5000, and A6000 GPUs, and enables the first Rowhammer exploits on ECC-protected GPUs via uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical.

arXiv cs.CR · 2d agoResearch

Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials

F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.

F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.

Cyber Security Newsupdated · 1d agofirst · 2d agoExploit / PoC in the wild 4 sourcesCVE-2026-39364CVE-2025-29927CVE-2025-30208+2 CVEs1

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

China-linked Red Heron exploited Gitea RCE CVE-2026-60004 to compromise 13 organizations across six countries, stealing source code.

Acronis Threat Research Unit attributes a China-nexus actor tracked as Red Heron to rapid exploitation of Gitea RCE CVE-2026-60004, scanning 1,386 instances across seven countries plus 477 Taiwan-based systems, with confirmed compromises of 13 organizations in Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka. Within days of the July 2026 disclosure, the actor weaponized a public PoC into an automated Python framework registering accounts, exploiting servers, stealing repositories, and removing traces, then deployed the JITTERLY C++ Linux implant (30+ post-exploitation commands) and the undocumented SIXZUT LD_PRELOAD rootkit. In one Taiwanese environment the actor reached root-level access across a three-node Proxmox cluster, targeting defense, elections, energy, aerospace, telecom, government, and research sectors.

The Hacker Newsupdated · 1d agofirst · 2d agoThreat actor in the wild 3 sourcesCVE-2026-60004

Pro-Ukraine Hacking Cat group deploying new malware against Russian targets

Kaspersky links pro-Ukraine hacktivist group Hacking Cat to Gorilla RAT and Monkey Ransomware in destructive attacks on Russian targets.

Kaspersky reports that pro-Ukraine group Hacking Cat, active since February 2024, has shifted from defacements to destructive encryption attacks, using a previously undocumented Gorilla RAT remote-access tool and Monkey Ransomware, which appends the .monkey extension to files. Initial access in some attacks came from exploited Microsoft Exchange vulnerabilities, and rapid multi-language malware variants suggest possible generative AI assistance. Shared tools like Nemo Wiper across groups including Ukrainian Cyber Alliance complicate attribution, and targets include Rosatom contractor and heating provider Donbassteploenergo.

The Record · 2d agoThreat actor in the wild

Hackers Leverage Claude to Exfiltrate Secrets from 1.8M Android apps

ShinyHunters-linked operators used Claude to scan 1.8M Android apps for hardcoded secrets, fueling intrusions across 40+ tenants.

Anthropic's September 2026 threat intelligence report describes a French-speaking operator (aliases MeowSHA, frkoo, blazespider) tied to ShinyHunters who ran 10 AWS EC2 workers and used Claude to decompile and scan 1.8 million Android APKs for hardcoded secrets with TruffleHog. Verified credentials were sorted into 100+ Telegram channels and paired with GitHub PAT harvesting, providing initial access for confirmed intrusions. In one supply-chain incident the actors extracted data from roughly 200 downstream customer organizations and dumped 2,100+ Azure AD token sets across 40+ corporate tenants in about 34 hours using AI agents. Anthropic banned tied accounts and stressed its own systems were not compromised.

Cyber Security News · 2d agoThreat actor1

GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline

GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.

GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.

Cyber Security News · 3d agoVulnerabilityCVE-2026-38542

Houthis Used Claude Code to Develop Missile Guidance Software: Anthropic

Anthropic's threat report details a Houthi-linked Yemeni cell using parallel Claude Code sessions to build missile guidance software, evading safeguards by fragmenting tasks.

Anthropic's September threat report describes a Yemen-based cell, assessed as highly likely Houthi-linked, that used Claude Code across multiple parallel instances to develop guidance software for a tactical guided rocket, a ballistic missile with over 2,000 km range, and a hypersonic glide vehicle concept called 'R2000'. The operators integrated open-source autopilot software, built six-degree-of-freedom trajectory simulations, and used reinforcement learning to tune flight-control algorithms, ultimately compiling an offline executable. The group test-fired a guided rocket that failed, then used Claude within hours to analyze launch telemetry. Anthropic blocked numerous requests, but operators evaded safeguards by obscuring intent and dividing work across separate conversations before accounts were banned; the case is one of six conventional-weapons cases (three China-linked, two Russia-linked) in a report covering disrupted operations from December 2025 to August 2026.

Hacker News · AI · 3d agoAI safety & securityHN 47↑ · 38 comments1

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA added three actively exploited vulnerabilities — two JFrog Artifactory and one ConnectWise ScreenConnect — to its KEV Catalog.

CISA added CVE-2026-42016 (JFrog Artifactory incorrect authorization), CVE-2026-42018 (JFrog Artifactory improper authentication), and CVE-2026-84869 (ConnectWise ScreenConnect improper privilege management and missing authorization) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of such high-risk vulnerabilities on publicly exposed assets and to check for prior compromise. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

CISA Advisories · 5d agoExploit / PoC in the wildCVE-2026-42016CVE-2026-42018CVE-2026-84869

CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert

CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.

CISA added CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS to the Known Exploited Vulnerabilities catalog on September 10, giving federal agencies until September 13 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; CVE-2026-86060 (CWE-88) lets attackers manipulate the trusted RouterOS policy mask for privilege escalation. CISA designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. Compromised routers could have altered routing rules, persistence, traffic interception, or use as pivots into internal networks.

GBHackers · 5d agoExploit / PoC in the wild 2 sourcesCVE-2026-67277CVE-2026-860601

AI-powered attack exploited PaperCut flaws to hack 395 organizations

AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.

GreyNoise reports a likely Russian-speaking threat actor used hundreds of AI agents combining OpenAI Codex and DeepSeek models to build, test, and refine exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, launching the campaign on August 31. At least 440 PaperCut instances at 395 organizations across 48 countries were compromised, with the education sector accounting for roughly half of victims and the US most targeted. Attackers harvested credentials from 280 victims, obtained OS or domain secrets from 147, and gained admin privileges at 12 organizations, using LSASS dumping, pass-the-hash, noPac, and DCSync to dump NTDS.DIT. The adversary went from empty workspace to first RCE in under four hours, and compromised at least 11 organizations within 26 seconds once the campaign launched.

BleepingComputerupdated · 5d agofirst · 6d agoExploit / PoC in the wild 6 sourcesCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1· 1 read

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two actively exploited MikroTik RouterOS vulnerabilities, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog, mandating federal remediation.

CISA added CVE-2026-67277 (missing authentication for a critical function) and CVE-2026-86060 (improper neutralization of argument delimiters in a command), both in MikroTik RouterOS, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these flaws on publicly exposed assets that grant total control post-exploitation. Agencies are also required to check whether systems were compromised before patches were applied.

CISA Advisories · 6d agoExploit / PoC in the wildCVE-2026-67277CVE-2026-86060

Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root

Palo Alto Networks fixed CVE-2026-0310, a CVSS 9.2 unauthenticated PAN-OS buffer overflow enabling root code execution on PA-Series firewalls.

Palo Alto Networks published an advisory on September 9, 2026 for CVE-2026-0310, a CWE-787 out-of-bounds write in PAN-OS XML processing with a CVSS v4.0 base score of 9.2, affecting the management and dataplane interfaces. Unauthenticated attackers could execute arbitrary code as root on PA-Series hardware firewalls, while VM-Series faces denial-of-service impact and Prisma Access and Cloud NGFW have reduced, authenticated exposure. Affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before fixed maintenance releases such as 12.2.3, 12.1.4-h10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround is available. Palo Alto is not aware of malicious exploitation but classifies remediation urgency as highest.

GBHackersupdated · 6d agofirst · 6d agoVulnerability 3 sourcesCVE-2026-0310