Search: “mitigation”

95 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 66 Vulnerability 53 Advisory 40 Research 33 Industry 32 AI safety & security 30 AI research 23 Tools 17 Threat actor 13 Policy & legal 12 AI industry 10 Phishing & fraud 7 Data breach 6 Malware 5

SeverityAll critical 39 high 101 medium 59 low 8 info 153

CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert

CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.

CISA added CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS to the Known Exploited Vulnerabilities catalog on September 10, giving federal agencies until September 13 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; CVE-2026-86060 (CWE-88) lets attackers manipulate the trusted RouterOS policy mask for privilege escalation. CISA designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. Compromised routers could have altered routing rules, persistence, traffic interception, or use as pivots into internal networks.

GBHackersSep 11, 11:57 UTC · 5d agoExploit / PoC in the wild 2 sources CVE-2026-67277 CVE-2026-860601

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft tracked a campaign of over one million AI-crafted CEO-impersonation emails seeking ~$50,000 ACH payments with fabricated ServiceNow invoices.

Between August 3 and 5, Microsoft detected a campaign of more than one million fraud emails, 87.7% of them targeting US enterprise users, sent through multiple third-party email delivery service accounts. The actor impersonated CEOs, CFOs, and presidents of targeted companies, urging accounts payable staff to process an ACH payment of nearly $50,000. Lures layered executive impersonation, lookalike domains, a fabricated ServiceNow 'Annual Subscription' invoice personalized to the recipient, and forged forwarded email threads; Microsoft found no evidence ServiceNow or the referenced executives were compromised. Microsoft observed indicators consistent with generative AI-assisted template creation, while leftover inconsistencies such as missing forwarding headers and mismatched display names gave defenders detection cues.

Microsoft Security BlogSep 10, 17:23 UTC · 6d agoPhishing & fraud1

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UKSep 15, 12:00 UTC · 1d agoThreat actor in the wild2

ConnectWise warns of new ScreenConnect flaw without patch

ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.

ConnectWise disclosed a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in both cloud and on-premises deployments; no CVE ID or patch is available yet, with a fix planned later this week. The vendor published temporary mitigation steps that remove TransferFiles permissions from session groups across all roles. Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances. Previous ScreenConnect flaws, including CVE-2024-1709, were exploited by ransomware gangs and North Korea's Kimsuky, and three ScreenConnect vulnerabilities are on CISA's actively exploited catalog.

BleepingComputerSep 7, 10:06 UTC · 9d agoVulnerability CVE-2024-1709 CVE-2025-3935 CVE-2026-35641

CISA KEV: Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 (CVE-2026-85046)

CISA added actively exploited Chromium V8 type confusion CVE-2026-85046 to the KEV catalog, requiring federal mitigation by September 18.

CISA added CVE-2026-85046, a type confusion vulnerability in Google Chromium's V8 JavaScript engine, to the Known Exploited Vulnerabilities catalog. The flaw allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page and affects Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. Federal agencies must apply vendor mitigations by 2026-09-18 under BOD 26-04; CISA notes known ransomware campaign use is currently unknown.

CISA Known Exploited VulnerabilitiesSep 4, 00:00 UTC · 13d agoExploit / PoC in the wildCVE-2026-85046

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.

CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-4827

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-38059 CVE-2026-38057 CVE-2026-38056+1 CVEs

Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.

Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.

GBHackersSep 9, 08:40 UTC · 7d agoExploit / PoC CVE-2026-694141

Cisco searched for IOS XR bugs and found so many it rolled them into an update release

Cisco patched three critical flaws, including CVE-2026-20212 unauthenticated remote root code execution in Nexus 9000 switches; no exploitation observed yet.

Cisco disclosed three critical-rated flaws found during a comprehensive internal security review. CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, affect the IOS XR carrier-grade operating system and are fixed in newly released versions. CVE-2026-20212 lets unauthenticated remote attackers execute code with root privileges on some Nexus 9000 Series Switches by reaching TCP ports 43210 and 43211 in the default Layer 3 VRF; no software fix exists yet, only infrastructure ACL mitigations. Cisco says it has not observed attacks against these flaws.

The Register · SecuritySep 4, 02:18 UTC · 13d agoVulnerability CVE-2026-20274 CVE-2026-20279 CVE-2026-20212

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 14d agoThreat actor in the wild1

Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)

Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.

Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.

Help Net SecurityAug 24, 06:16 UTC · 23d agoVulnerability CVE-2026-69836

Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution

Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.

Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID caused by deserialization of untrusted data, and said the issue was fully mitigated on the service side with no customer action required. The security bulletin initially marked the flaw as exploited, but Microsoft corrected the status to not exploited in the wild on August 21, 2026. Microsoft credited principal security engineer Robert Fitzpatrick with the discovery. The article also recalls the Lazarus Group's exploitation of Windows WinSock AFD zero-day CVE-2026-68820 (CVSS 7.0) in the Operation Dream Job campaign.

The Hacker NewsAug 21, 19:56 UTC · 26d agoVulnerability CVE-2026-69836 CVE-2026-688201

NCSC and Allies Warn of Iranian Spyware Campaign

NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.

NCSC, the FBI and the Netherlands' AIVD published a joint advisory warning that a Tehran-backed campaign, active since at least 2025, targets dissidents, activists and journalists with Chosen Brick spyware. The malware persists via Windows registry keys, adds Microsoft Defender exclusions, uses Telegram for C2, and captures screens, audio, emails and Telegram or WhatsApp messages. Stolen data has surfaced on pro-Iranian leak sites in some cases, raising risks to victims' personal safety.

Infosecurity Magazineupdated Sep 16, 20:24 UTC · 8h agofirst Sep 16, 08:25 UTC · 20h agoThreat actor in the wild 6 sources

Siemens Mendix SAML

Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).

CISA republished Siemens advisory SSA-887643 for CVE-2026-80465 (CVSS 8.7) in the Mendix SAML module, affecting Mendix 10/11-compatible versions before 4.2.3 and Mendix 9.24-compatible versions before 3.6.27. The module improperly validates SAML response signatures (CWE-347), letting unauthenticated remote attackers hijack an account in specific SSO configurations. Mendix has released fixed versions and recommends updating.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-80465

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-73807 CVE-2026-82567

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-68953 CVE-2026-66890 CVE-2026-68070+3 CVEs

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2024-42384 CVE-2024-42385 CVE-2024-42386+11 CVEs

UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists

Joint advisory details Iranian spear-phishing campaign deploying CHOSEN BRICK spyware to surveil dissidents, activists, and journalists across UK, US, Netherlands.

The NCSC (part of GCHQ), FBI, and AIVD jointly warned that Iranian state actors impersonate trusted contacts on WhatsApp and Telegram to deploy the CHOSEN BRICK spyware against dissidents, activists, and journalists worldwide. The Windows-only malware is persistent across reboots and collects contacts, emails, social media messages, screen captures, and microphone audio. Stolen personal details of some victims have been published on pro-Iranian leak sites. The FBI published complementary technical analysis, and the NCSC offers free cyber defence services for high-risk individuals.

NCSC UKSep 15, 12:00 UTC · 1d agoThreat actor in the wild1

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-78225 CVE-2026-81855

CareCam CM2507

CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.

CISA advisory ICSA-26-258-08 discloses seven vulnerabilities in CareCam HMT.CM2507 IP cameras running firmware v251211.1507. Issues include missing authentication for network video streaming (CVE-2026-88259, CVSS 3.1 7.5), an empty password on a privileged ONVIF account (CVE-2026-84398), weak legacy hashing of the root password (CVE-2026-85497, CVSS 4.0 9.3 critical), and cleartext storage of Wi-Fi credentials (CVE-2026-81321). Physical-access flaws allow arbitrary code execution from scripts on removable media (CVE-2026-81305) and unauthenticated bootloader access (CVE-2026-85478). The cameras are deployed worldwide in commercial facilities.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-88259 CVE-2026-84398 CVE-2026-84400+4 CVEs

GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

GPUThor uses non-uniform hammering to amplify Rowhammer on NVIDIA GPUs, achieving 500X-23,500X more bit flips and first exploits of ECC-protected GPUs.

GPUThor is a Rowhammer attack on NVIDIA GPUs that reverse-engineers memory-access coalescing behavior to enable non-uniform hammering patterns activating aggressor rows more intensely than decoy rows. By identifying refresh instances where in-DRAM mitigations apply, it constructs longer patterns that escape mitigation across refresh intervals. It yields 500X to 23,500X more bit flips than prior GPU Rowhammer attacks across NVIDIA A4000, A4500, A5000, and A6000 GPUs, and enables the first Rowhammer exploits on ECC-protected GPUs via uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical.

arXiv cs.CRSep 15, 02:46 UTC · 2d agoResearch

New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks

ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.

CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.

Cyber Security NewsSep 14, 13:29 UTC · 2d agoVulnerability CVE-2026-43502

Amasty patches dozens of Magento extensions, 2 critical

Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.

Extension vendor Amasty released fixes for a large batch of Magento and Adobe Commerce modules, with critical unauthenticated file upload flaws in Advanced Product Reviews and Gift Card that allow attackers to plant web shells and take full control of stores. Dozens of additional high-, medium- and low-severity extensions were also patched. The vendor says the release affects almost every Magento and Adobe Commerce store. A related Order Attributes flaw was previously exploited heavily, with Sansec Shield blocking over 12,000 attempts against 25% of Magento stores in three days.

Sansec (Magento / e-commerce security)Sep 9, 15:27 UTC · 7d agoVulnerability

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 8d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.

CSO OnlineSep 9, 03:27 UTC · 8d agoVulnerability in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-69730+2 CVEs1

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...

JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.

Web discovery (articles for new exploits & KEV entries)Sep 8, 21:42 UTC · 8d agoVulnerability CVE-2026-63077

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 8d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

“Zero-click” WeChat worm could hijack accounts and spread via a single call

Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.

Calif researchers weaponized a memory corruption issue in WeChat's VoIP stack into "WeWorm", a worm that spreads through WeChat calls without user interaction, hijacks each victim's account, and propagates via saved contacts across iOS and Android, potentially reaching millions of devices within hours. Exploitation takes seconds and grants full account control, and chaining with other reported Android/iOS bugs could lead to full device control. Tencent issued updated WeChat versions for iOS and Android and applied server-side mitigations; technical details remain withheld. WeChat has over a billion users, overwhelmingly in China.

Help Net SecuritySep 8, 13:40 UTC · 8d agoVulnerability

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Researchers demonstrated a zero-click WeChat worm that hijacked accounts via incoming calls; Tencent blocked the exploit server-side after July disclosure, no real attacks reported.

Security firm Calif built a worm that seized WeChat accounts via incoming calls without any target interaction, demonstrating it spreading across three test phones (Android to iPhone to Android). Once exploited, the attacker gains full control of the WeChat account, including messages, calls, payments, and mini programs, though not the phone itself. Tencent mitigated the flaw server-side, confirmed blocked on 28 August, shipping WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August. No CVE has been assigned, Tencent published no advisory, and no attacks in the wild have been reported; WeChat/Weixin counts 1.439 billion monthly active users.

The Hacker NewsSep 8, 11:54 UTC · 8d agoVulnerability1

CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...

CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.

CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.

Web discovery (articles for new exploits & KEV entries)Sep 8, 06:48 UTC · 8d agoExploit / PoC in the wildCVE-2026-34908

Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits

Researcher Nightmare Eclipse released working zero-day PoCs for Avast, CrowdStrike Falcon, and Nvidia, prompting a Gen patch, CrowdStrike mitigation, and Nvidia investigation.

Security researcher Nightmare Eclipse released three zero-day exploits within a short window: PrettyPrague targeting the Avast sandbox for full system privileges (possibly affecting other GenDigital products including AVG and Norton), FalconFlank exploiting CrowdStrike Falcon Sensor's Office malicious macros remediation feature for privilege escalation, and GreenSection targeting an out-of-bounds memory write in a shared global memory section used by Nvidia user-mode components. GenDigital said it has fixed the Avast issue; CrowdStrike advised disabling the Microsoft Office File Suspicious Macro Removal policy setting; Nvidia said it is actively investigating the PoC. Kevin Beaumont reported that the Avast, CrowdStrike, and Kaspersky exploits work. The researcher previously released the HardBreacher privilege escalation zero-day in Kaspersky endpoint security, patched August 31.

SecurityWeekSep 7, 12:15 UTC · 9d agoExploit / PoC

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-78012

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

CISA details CVE-2026-61884 (CVSS 9.8) in Tycon Systems TPDIN-Monitor-WEB2: unauthenticated access to power relays when credentials are unset; fixed in 2.4.5.

CISA updated its advisory for Tycon Systems TPDIN-Monitor-WEB2 firmware below 2.4.5, covering two vulnerabilities. CVE-2026-61884 (CVSS 9.8, CWE-306) lets any network attacker reach full device controls, including power relay management and reboots, on units left without configured HTTP credentials. CVE-2026-55985 exposes stored system credentials in cleartext to authenticated dashboard users, enabling compromise of other local systems. No public exploitation has been reported to CISA.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory 2 sources CVE-2026-61884 CVE-2026-55985

IXON VPN Client

CISA warns CVE-2026-75925 (CVSS 9.6) in IXON VPN Client <1.4.7 lets attackers inject config directives for root/SYSTEM remote code execution.

IXON's CRLF injection flaw (CVE-2026-75925, CWE-93) in VPN Client before 1.4.7 lets the unauthenticated local configuration service inject additional directives into a file consumed by a privileged subprocess. Injected configuration persists across client and OS restarts, enabling code execution as root or SYSTEM while the VPN connection keeps functioning normally. Deployments span energy, manufacturing, water, and IT sectors; no public exploitation has been reported to CISA.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-75925

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security BlogSep 2, 22:51 UTC · 14d agoThreat actor in the wild

Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Attackers exploited a critical Cosmos EVM balance bug (GHSA-7g4w-cg88-2cq2) to drain funds from six blockchains; fixed in v0.6.2 and v0.7.2.

Cosmos Labs disclosed that a critical balance-handling flaw in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2, no CVE) was exploited to drain funds from six blockchains between August 20 and 25, 2026. The bug, reported April 25 and initially judged harmless, lets vesting accounts delegate more than their spendable balance, wrapping balances to roughly 2^256 and triggering unintended mint/burn in reconciliation, potentially halting chains or burning victims' holdings. Fixes shipped in v0.6.2 and v0.7.2 on August 19 as state-breaking coordinated network upgrades; operators who cannot upgrade must halt their chains. The post-mortem notes the team used public silent patching for a fund-threatening issue, contrary to its own bug bounty policy, and that eleven deployments had never registered with its security channels.

The Hacker NewsAug 28, 20:38 UTC · 19d agoExploit / PoC in the wild

Print management outfit PaperCut is under 0-day attack, and it’s drawing customers’ blood

PaperCut print management software is under active zero-day attack, with only an unofficial emergency patch or server shutdown available as mitigation.

Attackers are actively exploiting an unpatched zero-day vulnerability in PaperCut print management software. The only available fix is an unvalidated, unofficial emergency patch, or taking affected servers offline. PaperCut is widely deployed in enterprise environments, giving exposed instances a broad and consequential attack surface.

The Register · SecurityAug 28, 05:29 UTC · 19d agoExploit / PoC in the wild

VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

CERT/CC details CVE-2026-90999: attacker-controlled Sentry telemetry can steer the Seer coding agent into executing attacker code with repository access.

CERT/CC published VU#212479 for CVE-2026-90999 in Sentry Seer: attacker-submitted events through public DSN endpoints flow into Seer's root-cause analysis, which is embedded directly into the coding agent's initial prompt. In the documented chain, the privileged coding agent downloads and executes an attacker-controlled package before any human review, yielding arbitrary code execution with access to connected source repositories. No vendor patch is available yet; mitigations include disabling automated remediation, restricting coding-agent package installation, and filtering telemetry before Seer analysis.

CERT/CC Vulnerability NotesSep 16, 15:18 UTC · 13h agoVulnerability CVE-2026-90999

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

US Coast Guard and FBI boarded two foreign tankers bound for the US after indications their vessel networks were compromised, investigating possible Iranian involvement.

The Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24 to examine their operational and IT systems following indications both networks were compromised. The vessels reportedly carried oil and natural gas, and one was hacked in the Strait of Gibraltar and lost communications for over 30 hours. No operational disruptions, vessel instability, or environmental impacts have been reported, and authorities are investigating whether Iran or another group exploiting US-Iran tensions was behind the attacks.

CyberScoopupdated Sep 16, 18:46 UTC · 9h agofirst Sep 16, 14:48 UTC · 13h agoData breach in the wild 2 sources

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackersSep 16, 13:41 UTC · 15h agoPhishing & fraud in the wild2