Search: “Traps”

2 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 9 Industry 6 Malware 5 Exploit / PoC 5 Vulnerability 4 Phishing & fraud 4 Threat actor 3 AI research 3 AI industry 2 Ransomware 1 Research 1 Tools 1

SeverityAll critical 2 high 8 medium 12 low 0 info 22

Cisco email security boxes can be rooted by... an email

Attackers actively exploit critical Cisco Secure Email Gateway flaw CVE-2026-76461, turning a malicious email into unauthenticated root access.

Cisco Secure Email Gateway appliances are being actively exploited via CVE-2026-76461, a CVSS 9.8 AsyncOS flaw requiring no authentication—a crafted email can yield root command execution with no workarounds. Cisco's PSIRT became aware of active exploitation in September; some Secure Email Cloud customers showed indicators of compromise and all cloud devices were upgraded to AsyncOS 16.5.0-780. The bug is in CISA's KEV catalog with federal agencies ordered to remediate by September 17; Shadowserver counted 400+ exposed appliances. Fixes are available in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780, and attackers with root may tamper with logs to hide activity.

The Register · Securityupdated Sep 16, 13:57 UTC · 20h agofirst Sep 15, 16:01 UTC · 1d agoExploit / PoC in the wild 17 sources CVE-2026-76461 CVE-2025-20393

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.

CVE-2026-66066 (KindaRails2Shell), discovered by Ethiack researchers and independently by RyotaK of GMO Flatt Security, lets attackers upload crafted files that exploit libvips' handling of specialty formats to read arbitrary files, including process environment secrets, potentially escalating to RCE. Default Rails 7.0+ setups using Active Storage with the vips processor are affected before versions 7.2.3.2, 8.0.5.1, and 8.1.3.1; fixes shipped July 29, 2026, with VIPS_BLOCK_UNTRUSTED as a partial mitigation. Proof-of-concept exploits circulated after disclosure, and VulnCheck updated that it observed active exploitation originating from a single French IP establishing C2 to a host in Israel. Akamai deployed WAF rules, but experts stress patching and credential rotation over filtering alone.

Help Net SecurityAug 31, 12:00 UTC · 16d agoVulnerability in the wildCVE-2026-66066