Search: “approximation”

5 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI research 37 Data breach 18 Research 16 Policy & legal 12 AI safety & security 12 Model release 11 Exploit / PoC 11 Threat actor 10 AI industry 9 Vulnerability 8 Industry 8 Malware 8 Phishing & fraud 5 Tools 2

SeverityAll critical 5 high 31 medium 36 low 3 info 95

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Multiple Class Action Lawsuits Filed Against IDScan

At least four class-action lawsuits filed against IDScan.net over an alleged breach exposing 153 million driver's licenses; FBI investigating.

At least four class-action lawsuits were filed in the US District Court for the Eastern District of Louisiana against IDScan.net following reports of a potential mega-breach of driver's license data. A Russian cybercrime forum service called Nexus claimed over 153 million driver's licenses, mainly American and Canadian, plus over 10 million ID cards, travel documents, and medical cards. The FBI is investigating the incident, which was first reported by journalist Brian Krebs, and IDScan.net says it is investigating. IDScan.net provides B2B ID verification services for clients including Hertz, FedEx, and hundreds of US cannabis dispensaries.

Infosecurity MagazineSep 7, 09:10 UTC · 9d agoData breach

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.

Defiant warns that attackers are exploiting CVE-2026-32475 (CVSS 9.8), an unauthenticated arbitrary file upload flaw in the Elementor Pro WordPress plugin's form submission handling, which affects all versions up to 4.2.1 and was patched in version 4.2.2 on August 19. Exploitation began immediately after the fix shipped, with Defiant blocking over 190,000 exploit attempts to date; roughly two-thirds of Elementor's 10 million installations still ran a vulnerable version as of September 4. Successful exploitation writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/ and can lead to full site compromise; administrators should check that directory for PHP files and review requests to /wp-admin/admin-ajax.php.

SecurityWeekSep 5, 13:00 UTC · 11d agoExploit / PoC in the wildCVE-2026-32475

Crooks Behind Manchester Airports Group Hack Leaked Data of 8.8 Million People

FulcrumSec leaked about 550 GB of Manchester Airports Group data, exposing emails, phones and vehicle registrations of roughly 8.8 million people after a refused ransom.

Manchester Airports Group, operator of Manchester, London Stansted and East Midlands airports, confirmed a breach of a third-party database after extortion group FulcrumSec leaked roughly 550 GB of data. The exposed data includes about 8.8 million email addresses and phone numbers, 108,077 vehicle registration plates, 2.48 million purchases and 1.16 billion email events, with no payment-card data accessed. FulcrumSec claims it gained access using Iterable admin keys hardcoded in the frontend JavaScript of all three airport websites, a claim MAG has not confirmed. Have I Been Pwned added the incident to its breach database.

Security AffairsSep 4, 19:37 UTC · 12d agoData breach

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker NewsSep 3, 15:52 UTC · 13d agoVulnerability CVE-2026-20212 CVE-2026-20274 CVE-2026-20279+5 CVEs