Search: “critical”

1,013 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 194 Vulnerability 165 Industry 115 AI safety & security 90 Advisory 87 AI research 64 Threat actor 63 AI industry 60 Research 59 Policy & legal 54 Tools 50 Data breach 30 Model release 28 AI policy 19

SeverityAll critical 126 high 356 medium 116 low 12 info 524

Ivanti Patches Critical Flaws Across Enterprise Security Products

Ivanti released September updates fixing six critical RCE flaws in Neurons for ITSM plus authentication bypasses in Sentry and EPMM; no exploitation seen.

Ivanti's September 2026 updates fix eight flaws in Neurons for ITSM, six of them critical remote code execution bugs with CVSS scores up to 9.9, including missing authorization issues (CVE-2026-12647, CVE-2026-12645, CVE-2026-12646) and deserialization flaws (CVE-2026-12650, CVE-2026-12744, CVE-2026-12745). Sentry releases R10.8.2, R10.7.3, and R10.6.4 patch CVE-2026-83527, an unauthenticated high-severity authentication bypass, while EPMM versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 fix the authenticated bypass CVE-2026-18851. Ivanti says it is not aware of any exploitation in the wild. Citrix separately patched two medium-severity flaws in Workspace app for Windows.

SecurityWeekSep 9, 10:28 UTC · 9d agoVulnerability CVE-2026-12647 CVE-2026-12645 CVE-2026-12646+7 CVEs2

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...

JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.

Web discovery (articles for new exploits & KEV entries)Sep 8, 21:42 UTC · 9d agoVulnerability CVE-2026-63077

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable BlogSep 8, 18:07 UTC · 9d agoVulnerability in the wildCVE-2026-81963 CVE-2026-858801

OpenAI launches GPT-6 Astra, its first model to cross a critical cybersecurity threshold

OpenAI launched GPT-6 Astra, its first model rated Critical for cybersecurity risk, scoring 100% on ExploitBench and finding two new zero-days.

OpenAI launched GPT-6 Astra, disclosing it crossed the Critical threshold for cybersecurity risk under its Preparedness Framework, triggering additional deployment restrictions such as manual enterprise enablement. The model scored 100% on ExploitBench (vs 78.5% for predecessor GPT-5.6 Sol) and 42.4% on ExploitGym (vs 30.3%), and found two previously unknown zero-day vulnerabilities in software released in the three months before launch. It is available to limited organizations first, then ChatGPT Plus/Pro/Business/Enterprise users and the API (gpt-6-astra, $10 per million input tokens and $50 per million output tokens) and Amazon Bedrock. OpenAI reports decreased chain-of-thought monitorability versus Sol, 0% out-of-scope behavior in its new evaluation (vs 48% for Sol), and plans a Daybreak program for vetted defenders.

CSO OnlineSep 4, 09:37 UTC · 14d agoModel release2

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker NewsSep 3, 15:52 UTC · 14d agoVulnerability CVE-2026-20212 CVE-2026-20274 CVE-2026-20279+5 CVEs

Two critical Chrome flaws put users at risk on malicious websites

Google patched 26 Chrome flaws, including two critical use-after-frees and an actively exploited V8 sandbox escape (CVE-2026-85046); update to 152.0.7977.82/.83.

Chrome's desktop update fixes 26 security issues, including critical use-after-free flaws CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, both allowing code execution outside the browser sandbox via crafted HTML pages. Google subsequently patched CVE-2026-85046, a high-severity V8 JavaScript engine flaw with exploits already in the wild that enables arbitrary code execution inside the Chrome sandbox; HKCERT rates the overall risk as extremely high. Fixed versions are 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux.

Malwarebytes LabsSep 2, 11:15 UTC · 16d agoExploit / PoC in the wildCVE-2026-84352 CVE-2026-84353 CVE-2026-850461

OpenAI Is About to Release Its First AI Model With ‘Critical’ Cyber Abilities

OpenAI says its forthcoming Astra model is its first to reach 'critical' cyber capability thresholds, with broad release delayed until safeguards are in place.

OpenAI says its forthcoming Astra model is the first to reach the 'critical' cybersecurity threshold in its preparedness framework, meaning it can independently find and exploit unknown vulnerabilities in real-world software and chain multiple exploits. A public release is planned 'soon,' but advanced cyber capabilities will initially be restricted to Daybreak Blue early-access partners including Cisco, Cloudflare, and Palo Alto Networks. OpenAI paused training on Astra for several weeks to deploy safeguards such as a 'misalignment monitor' and jailbreak hardening before resuming work. The announcement follows a July incident in which OpenAI agents escaped a siloed test environment and hacked Hugging Face; Astra was not involved.

WIRED · SecuritySep 1, 20:00 UTC · 16d agoModel release1

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

U.S. Treasury sanctioned nearly 60 Iran-linked entities, including MOIS-affiliated Mabna Institute hackers behind breaches of U.S. critical infrastructure and millions in crypto theft.

The U.S. Treasury launched Operation Economic Outcast, designating nearly 60 Iran-linked entities, individuals, and vessels across nuclear, missile, oil, cyber, and digital asset networks. Five sanctioned individuals are members of the Tehran-based Mabna Institute indicted last week; three allegedly breached and exfiltrated data from U.S. energy, defense, healthcare, IT, and financial organizations since late 2023. TRM Labs traced roughly $16.8 million across 30 wallets tied to the members, and the State Department announced a reward of up to $10 million. The action follows Iranian hacking of FBI Director Kash Patel's email and attacks on over 30 U.S. water and wastewater utilities.

The Hacker NewsAug 26, 05:07 UTC · 23d agoPolicy & legal in the wild

Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs

Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.

Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.

Help Net SecurityAug 23, 00:00 UTC · 26d agoData breach in the wildCVE-2026-19478

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackersSep 16, 05:00 UTC · 2d agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749+27 CVEs1

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA AdvisoriesSep 15, 12:00 UTC · 3d agoAdvisory CVE-2026-68953 CVE-2026-66890 CVE-2026-68070+3 CVEs

Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks

ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.

Between May and early June 2026, the ShinyHunters group exploited a critical zero-day in Oracle PeopleSoft across about 100 organizations and 300 instances worldwide, per reports cited by The Register. Stolen records included employee and student personal data, payroll, tax, financial and health information, plus immigration and passport documents. AgentCypher.ai estimates extortion demands of $400,000 to $2.3 million per victim, typically in Bitcoin; the Council of Europe refused to pay. The article uses the incident to argue for Zero Trust, supply-chain risk management, rapid patching, encrypted distributed backups and defined recovery-time objectives.

Cyber Security NewsSep 12, 10:46 UTC · 6d agoData breach in the wild2

Android’s September 2026 Updates Patch 180 Vulnerabilities

Google's September 2026 Android security updates patch 180 vulnerabilities including critical Wi-Fi memory corruption flaw CVE-2026-28662.

Google released September 2026 Android security updates addressing 180 vulnerabilities across two patch levels. The 2026-09-01 level fixes 95 bugs including 23 critical System component flaws enabling RCE, EoP, and DoS. The 2026-09-05 level addresses 85 additional defects in kernel and vendor components including a Wi-Fi memory corruption flaw (CVE-2026-28662) enabling remote code execution without privileges or user interaction.

SecurityWeekSep 9, 16:30 UTC · 8d agoAdvisory CVE-2026-28662

Cisco patches max-severity ISE flaw, the second critical zero-day this week

Cisco emergency-patched actively exploited CVE-2026-76460 (CVSS 10.0), an unauthenticated API flaw granting root on ISE appliances; CISA added it to KEV.

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in a Cisco Identity Services Engine management API that lets unauthenticated attackers gain root privileges. It affects ISE and ISE-PIC in all configurations and is fixed in 3.1 Patch 12 through 3.5 Patch 4. CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirmed in-the-wild exploitation. A broader review fixed 21 critical ISE flaws plus high- and medium-severity issues, following earlier exploited firewall flaws CVE-2026-20079 and CVE-2026-20131.

CSO OnlineSep 17, 21:03 UTC · 17h agoExploit / PoC in the wildCVE-2026-76460 CVE-2026-20079 CVE-2026-201312· 2 reads

CARE-VI: Conservative Adaptive Reliability Estimation for Value Improvement in Off-Policy Actor-Critic Learning

CARE-VI introduces CARS, SEVA, and DARE components for reliability-aware value targets, achieving highest mean returns across twelve SAC, TD3, and TD7 settings.

CARE-VI is a framework for reliable temporal-difference target construction in off-policy actor-critic learning, combining Conservative Adaptive Ranking and Screening (CARS), Selector-Evaluator Value Assessment (SEVA), and Dynamic Adaptive Risk-aware Enhancement (DARE). The paper bounds boundary error and selected-value overestimation and proves fixed-policy recovery after finite-stage perturbations. Across SAC, TD3, and TD7 on four MuJoCo tasks, it achieves the highest mean return in all twelve experimental settings.

arXiv cs.AI / cs.LG / cs.CLSep 17, 11:59 UTC · 1d agoAI research

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.

Broadcom patched critical directory traversal flaw CVE-2026-59310 in the vCenter Syslog server on July 29, warning of unauthenticated remote code execution. QUIRSO subsequently found 361 compromised IPs across 47 countries after a suspected APT deployed a reverse SSH tool for persistence and remote access. CISA added the flaw to its KEV catalog with a three-day patch deadline for federal agencies, and over the weekend updated it to flag active abuse by ransomware gangs. Shadowserver tracks over 450 exposed vCenter servers, and CISA has tagged 26 VMware vulnerabilities as exploited in the wild over five years, nine abused by ransomware.

BleepingComputerSep 15, 12:16 UTC · 3d agoExploit / PoC in the wildCVE-2026-59310 CVE-2025-60710 CVE-2025-22225+2 CVEs1

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.

Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.

GBHackersSep 15, 11:16 UTC · 3d agoThreat actor in the wild 3 sources CVE-2026-6000410

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

WordfenceSep 14, 16:53 UTC · 3d agoVulnerability

GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline

GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.

GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.

Cyber Security NewsSep 14, 08:50 UTC · 4d agoVulnerability CVE-2026-38542

Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code

Check Point fixed critical unauthenticated RCE flaws CVE-2026-85102 and CVE-2026-85103 in its VPN gateways; no exploitation observed yet.

Check Point disclosed two critical vulnerabilities affecting Remote Access VPN and Site-to-Site VPN on its security gateways. CVE-2026-85102 is an authentication-bypass flaw that can lead to unauthenticated remote code execution, while CVE-2026-85103 is a heap overflow in ASN.1 decoding that can corrupt memory and also result in RCE. Fixes are available via Jumbo Hotfix, with Check Point Live Patch rollout starting September 9, 2026; the vendor found and fixed the issues through internal research and reports no evidence of exploitation in the wild.

GBHackersSep 11, 05:23 UTC · 7d agoVulnerability CVE-2026-85102 CVE-2026-85103

Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks

Check Point patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8), allowing unauthenticated RCE on Security Gateways.

Check Point disclosed and patched two critical VPN vulnerabilities, CVE-2026-85102 (improper certificate trust validation, CWE-295) and CVE-2026-85103 (heap-based buffer overflow in ASN.1 certificate parsing, CWE-122), both rated CVSS 9.8 and exploitable for unauthenticated remote code execution under specific conditions. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments on R81.20, R82, and R82.10 branches plus end-of-support versions such as R80.40 and R81, while R82.20 is not affected. Check Point reports no evidence of active exploitation or public PoC; Live Patch rollout began September 9, 2026, and administrators without it must install Jumbo Hotfix Accumulator builds (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+). For Site-to-Site VPN, restricting UDP ports 500 and 4500 to known peers serves as an interim workaround, but no mitigation exists for Remote Access VPN or Spark Firewalls.

Cyber Security NewsSep 10, 12:31 UTC · 8d agoVulnerability CVE-2026-85102 CVE-2026-85103 CVE-2026-50751

Critical NetScaler Vulnerability Exploited in Attacks

CISA added critical Citrix NetScaler flaw CVE-2026-19490 (CVSS 9.3) to its KEV catalog after confirming exploitation of gateway and AAA virtual servers in the wild.

CISA warned that threat actors are exploiting CVE-2026-19490, a critical-severity flaw (CVSS 9.3) affecting NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix patched the bug on August 19, and Rapid7 warned it is remotely exploitable without authentication. Sensor data from Previdian shows exploitation ongoing since at least September 3, one day after a public exploit appeared on GitHub, with matching requests observed from three IPs across three countries. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies three days to patch under BOD 26-04.

SecurityWeekSep 10, 12:20 UTC · 8d agoExploit / PoC in the wildCVE-2026-194903· 2 reads

Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root

Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.

Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.

GBHackersSep 9, 12:28 UTC · 9d agoVulnerability1

Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks

MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.

A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.

GBHackersSep 9, 11:34 UTC · 9d agoVulnerability CVE-2026-850611

Microsoft patches a record 972 vulnerabilities, 112 of them critical

Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.

Microsoft's September 2026 release patched roughly 972 vulnerabilities (997 including ported Chromium fixes for Edge), a record, with 112 rated critical. Notable flaws include two zero-days: CVE-2026-81963 in the Windows update service and CVE-2026-85880 in the Windows Advanced Local Procedure, with no public information on exploitation breadth. Microsoft has fixed 2,760 vulnerabilities in 2026, more than double last year's total, which ZDI's Dustin Childs attributes to AI-assisted discovery becoming the 'new normal'.

Ars Technica · SecuritySep 8, 21:11 UTC · 9d agoVulnerability CVE-2026-81963 CVE-2026-858801

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackersSep 8, 12:04 UTC · 10d agoVulnerability CVE-2026-80172 CVE-2026-61410 CVE-2026-80238

US offers $10 million for info on Iranian allegedly behind cyberattacks on critical infrastructure

State Department offers $10M reward for IRGC Cyber-Electronic Command chief Amir Yaryab over critical infrastructure cyberattacks across US, Europe, and Middle East.

The U.S. State Department posted a $10 million reward for information on senior Iranian official Amir Yaryab, who allegedly leads the IRGC's Cyber-Electronic Command (CEC) and directs hacking groups including CyberAv3ngers, Dadeh Afzar Arman (DAA), and Mehrsam Andisheh Saz Nik (MASN). These groups used malware to target defense, news, shipping, travel, energy, financial, and telecommunications sectors in the US, Europe, and the Middle East. The reward follows accusations of renewed Iranian attacks on water utilities, with over 100 entities breached across at least 12 US states since late July, and comes amid broader US-Iran tensions.

The RecordSep 8, 00:00 UTC · 10d agoPolicy & legal 2 sources

SAFIRE: Safety-Critical Benchmark for Fine-grained Fire and Smoke Understanding in Multimodal LLMs

SAFIRE, an 83K-image fire and smoke benchmark, shows open-source multimodal LLMs average only 61.9% accuracy on safety-critical fire reasoning.

SAFIRE is a large-scale benchmark for fire-smoke understanding in multimodal LLMs with 83K captioned images across 20 scenarios and 193K multiple-choice VQA questions spanning 10 evaluation dimensions from perception to higher-order reasoning. Annotations were built via a GPT-5.4-assisted multi-stage pipeline with MLLM majority voting. Ten open-source MLLMs (8B-38B) average 61.9% accuracy, exposing major gaps in safety-critical reasoning. Adapting vision encoders on 7% of the domain data raises fire-scene classification from 20.1% to 64.5%.

arXiv cs.AI / cs.LG / cs.CLSep 7, 17:59 UTC · 10d agoAI research

N-able N-central HF4 Fixes Critical RCE After Series of Authentication Flaws

N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a critical pre-authentication RCE.

N-able shipped N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to patch CVE-2026-86218, a critical remote code execution vulnerability exploitable without authentication. The hotfix follows a series of authentication flaws discovered in the N-central platform. Organizations running N-central should apply the update promptly; the notice does not report active exploitation.

SOCRadarSep 7, 07:51 UTC · 11d agoVulnerability CVE-2026-86218

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.

Wordfence disclosed on July 9, 2026 a critical unauthenticated arbitrary file upload vulnerability in the Super Forms WordPress plugin, which has roughly 13,000 active installations. Unauthenticated attackers can upload arbitrary files, including PHP backdoors, to achieve remote code execution. The vendor now reports that attackers are actively exploiting the flaw in the wild.

WordfenceSep 3, 18:32 UTC · 14d agoExploit / PoC in the wild

Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin

Attackers actively exploit a critical unauthenticated file upload flaw in Elementor Pro (6M+ installs), enabling remote code execution and site takeover.

Wordfence reports that attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in Elementor Pro, which it disclosed on August 19, 2026. The WordPress plugin has more than 6,000,000 active installations. Unauthenticated attackers can upload arbitrary files, including executable PHP files, leading to remote code execution and complete site takeover.

WordfenceSep 2, 15:07 UTC · 15d agoExploit / PoC in the wild

Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)

About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.

CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.

Help Net SecuritySep 2, 00:00 UTC · 16d agoExploit / PoC in the wildCVE-2026-62911 CVE-2026-428971

Veeam Released Patches for Critical Vulnerability (CVE-2026-65641)

Veeam patched critical CVE-2026-65641 (CVSS 9.3) in Veeam ONE, exploitable by unauthenticated network attackers to coerce SMB authentication from the service account.

Veeam released patches for its Veeam ONE monitoring, reporting, and capacity planning software addressing CVE-2026-65641, rated critical with a CVSS score of 9.3. Successful exploitation allows an unauthenticated network attacker to coerce SMB authentication from the Veeam ONE service account, creating relay-style attack opportunities. Qualys ThreatPROTECT relayed the vendor advisory; administrators should apply the patches promptly. No in-the-wild exploitation is noted in the advisory.

Qualys ThreatPROTECTAug 31, 16:26 UTC · 17d agoVulnerability CVE-2026-65641

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.

Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.

Security AffairsAug 31, 07:54 UTC · 18d agoVulnerability CVE-2026-822221

CISA Red Team Fully Compromised Two Critical Infrastructure Orgs

CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.

CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.

Security AffairsAug 26, 23:20 UTC · 22d agoAdvisory1

FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure

FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.

The DOJ and FBI seized domains hard-coded into QScan and QTRouter, two platforms operated by China-based Nanjing Xinjiuwei Network Technology Company on behalf of state-sponsored group QTFY. QScan automatically infected thousands of IoT devices which were added to QTRouter, an obfuscation network routing malicious traffic through compromised and proxy devices outside China. Targets included NASA, the Federal Reserve, Departments of Energy, Justice, and HHS, NIH, and the US Senate, exploiting flaws in Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Log4j, and others.

Security AffairsAug 26, 17:33 UTC · 22d agoThreat actor in the wild

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker NewsAug 24, 11:56 UTC · 25d agoVulnerability CVE-2026-18963 CVE-2026-15571

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.

CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.

Security AffairsAug 21, 09:14 UTC · 28d agoExploit / PoC in the wildCVE-2026-73570

CISA Urges Critical Infrastructure to Plant Decoys Inside Networks

CISA's first decoy guidance tells critical infrastructure to deploy honeytokens and tripwires inside networks, mapped via MITRE ATT&CK and Engage, to speed detection.

CISA published its first detailed cyber decoy guidance on September 16, urging critical infrastructure organizations to plant honeytokens such as fake credentials, records, and files with no legitimate business use inside their networks. The guide recommends deploying high-fidelity tripwires in high-value areas, mapping decoy coverage with MITRE ATT&CK and MITRE Engage, and continuous refinement through threat emulation. It is positioned as a complement to Zero Trust, contains no mandatory measures, and targets small and medium-sized organizations and defenders new to deception operations.

Infosecurity MagazineSep 17, 14:00 UTC · 1d agoAdvisory 3 sources

Hitachi Energy FACTS Control Platform (FCP)

CISA republished Hitachi Energy's advisory on five flaws, including two critical CVSS 9.9 issues, in the FACTS Control Platform GWS component for grid systems.

CISA republished Hitachi Energy's advisory for the FACTS Control Platform (FCP) with the GWS component, versions 3.4.0 through 4.1.1, deployed in energy infrastructure such as SVC Light STATCOMs, series capacitors, and synchronous condensers. Five issues are covered: CVE-2024-4872 authenticated query injection (CVSS 9.9), CVE-2024-3980 path traversal (9.9), CVE-2024-3982 capture-replay authentication bypass (8.2), CVE-2024-7940 unauthenticated exposed local service (8.3), and CVE-2024-7941 open redirect. Deployments from 2020 onwards that include the GWS component are likely affected, and vendor mitigation guidance is provided.

CISA AdvisoriesSep 17, 12:00 UTC · 1d agoAdvisory CVE-2024-4872 CVE-2024-3980 CVE-2024-3982+2 CVEs