Search: “c”

2 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 11 Malware 9 Vulnerability 5 AI research 4 Research 4 AI tools & infra 3 Policy & legal 2 Industry 2 AI industry 2 AI policy 2 AI safety & security 2 Exploit / PoC 2 Advisory 2 Tools 1

SeverityAll critical 2 high 19 medium 8 low 3 info 20

Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

China-linked UNC3569 actively exploited critical Sogou Input Method flaw CVE-2026-51990 for one-click system-level code execution, deploying the GrayRabbit backdoor.

Gen Threat Labs reports that China-linked threat actor UNC3569, possibly tied to contractor i-SOON, exploited critical CVE-2026-51990 in Tencent's Sogou Input Method, a Windows IME used by hundreds of millions, via crafted sgbiz URLs. The chain combines unvalidated command-line argument injection, unrestricted URL navigation, and an un-sandboxed Chromium 80 engine missing roughly six years of security patches. The exploit gives system-level code execution and was used to deploy the GrayRabbit backdoor, which provides a reverse shell, plugin loading, file upload to C2, and system info collection, and has appeared in UNC3569 intrusions since at least 2021. Tencent patched the issue in version 16.3.0.3498 via automatic update, but the outdated Chromium configuration reportedly remained unchanged as of September 10.

SecurityWeekSep 14, 11:51 UTC · 2d agoExploit / PoC in the wild 2 sources CVE-2026-519901· 1 read

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.

Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.

GBHackersSep 15, 11:16 UTC · 2d agoThreat actor in the wild 3 sources CVE-2026-6000410