ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “ConnectSecure Platform”

26 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 4Exploit / PoC 2Policy & legal 2Data breach 1Ransomware 1Tools 1
SeverityAllcritical 5high 1medium 4low 0info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security News · 7h agoExploit / PoC in the wild 4 sourcesCVE-2026-848691

ConnectSecure helps MSPs automate Microsoft 365 security remediation

ConnectSecure launches Microsoft 365 Auto Remediation and AI-powered Training Assessments to help MSPs automate M365 security fixes and compliance training.

ConnectSecure's platform now automates remediation of supported Microsoft 365 security findings through conditional access policies, covering gaps such as missing MFA enforcement, legacy authentication and risky sign-ins. A new AI-assisted Training Assessments module generates, assigns and measures security assessments with configurable difficulty, pass thresholds and multilingual support. The previously announced Patch 360 patch management capability, including pilot-first validation, staged rollouts and rollback, is also now available.

Help Net Security · Aug 12, 2026Tools

Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability

Cisco patched an sftunnel flaw in Secure Firewall Management Center letting an authenticated remote attacker execute arbitrary commands as root.

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center allows an authenticated remote attacker to execute commands as root. The flaw stems from incorrect permissions allowing a registered sftunnel peer to write an arbitrary file anywhere on the device, exploitable via connection hijacking or crafted sftunnel commands. Cisco has released software updates.

Cisco Security Advisories · 6h agoAdvisory 6 sources

Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant

Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.

cPanel warned that a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise (fixed in 6.3.7) lets a malicious low-privilege website user bypass account isolation controls including CloudLinux CageFS and gain root on shared-hosting servers, enabling cross-tenant compromise. No CVE, severity rating, or technical details have been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420, which were actively exploited and added to CISA's KEV catalog.

Security Affairs · 1d agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-54420

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security · 1d agoTools1

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News · 1d agoVulnerability

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

CERT Polska warns attackers exploit internet-exposed MikroTik SSH for unauthenticated full admin control; attacks observed since at least September 2.

CERT Polska warned on September 5 that attackers exploit MikroTik routers with internet-reachable SSH to gain full administrative control without authentication, calling the two-flaw combination 'MikroTrick'. Successful attacks date to at least September 2; no victim count or attacker identity was disclosed. MikroTik shipped fixed RouterOS releases: 6.49.21, 7.23.4 (with 7.23.5 fixing an IPv6 DHCP regression), 7.24.2, and 7.25beta3. CERT recommends immediate updates, checking for unauthorized configuration changes, and restricting SSH, WWW/WWW-SSL, and bandwidth-test services on unpatched devices.

The Hacker News · 10d agoExploit / PoC in the wild

Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication

CERT Polska confirms attackers exploit chained MikroTik RouterOS SSH flaws to hijack devices without authentication; patches released in four RouterOS versions.

CERT Polska discovered six RouterOS vulnerabilities and confirmed active attacks chaining CVE-2026-67276 (CVSS 9.2, SSH authentication bypass caused by comparing only RSA key moduli) and CVE-2026-86060 (CVSS 9.2, privilege escalation via crafted usernames), dubbed MikroTrick. A third flaw, CVE-2026-67277 (CVSS 8.8) in the bandwidth-test service, can expose kernel memory or crash devices. Shadowserver counted about 122,500 MikroTik devices with SSH exposed; attackers created a privileged 'ops' account from IP 82.192.72.4, active since September 2. Fixes shipped in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding startup configuration scanning with a 'Flagged' marker for unauthorized changes.

Help Net Security · 9d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-86060CVE-2026-67277

MikroTik router flaws allow takeover without a password

Attackers actively exploit chained MikroTik RouterOS SSH flaws CVE-2026-67276 and CVE-2026-86060, bypassing authentication and escalating to admin to seize edge routers.

CERT Polska warns of active exploitation of a two-flaw chain dubbed 'MikroTrick' against internet-exposed MikroTik RouterOS devices with SSH remote management enabled. CVE-2026-67276 is an SSH authentication bypass in RSA public-key handling, and CVE-2026-86060 is a privilege-escalation flaw triggered via a specially crafted username, letting attackers gain full administrator control without a password. Patched RouterOS packages are already public, and MikroTik added a startup detection that flags unauthorized configuration changes. Compromised edge routers enable DNS hijacking, traffic capture, remote-access tunnels, firewall changes, and lateral attacks.

Malwarebytes Labs · 8d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-860603

Securin Platform helps security teams prove when attack paths are closed

Securin launches the AI-native Securin Platform unifying exposure management, attack surface discovery, offensive validation and remediation to prove attack paths are closed.

Securin announced general availability of the Securin Platform, an AI-native preemptive exposure management product combining attack surface discovery, vulnerability and threat intelligence, prioritization, offensive validation and remediation verification in one workflow. It includes modules Surface, Signals, Exposure, Validate and Assure, orchestrated by the VERA multi-agent AI framework, and aims to verify whether real attack paths are closed rather than ranking findings by severity alone.

Help Net Security · 7d agoTools

ConnectWise warns of new ScreenConnect flaw without patch

ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.

ConnectWise disclosed a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in both cloud and on-premises deployments; no CVE ID or patch is available yet, with a fix planned later this week. The vendor published temporary mitigation steps that remove TransferFiles permissions from session groups across all roles. Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances. Previous ScreenConnect flaws, including CVE-2024-1709, were exploited by ransomware gangs and North Korea's Kimsuky, and three ScreenConnect vulnerabilities are on CISA's actively exploited catalog.

BleepingComputer · 9d agoVulnerabilityCVE-2024-1709CVE-2025-3935CVE-2026-35641

Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.

Poland's CERT, with help from GPT-5.5-cyber and GPT-5.6-sol, discovered and confirmed active exploitation of a MikroTik RouterOS chain dubbed MikroTrick: SSH authentication bypass CVE-2026-67276 (incomplete RSA public key validation) chained with privilege escalation CVE-2026-86060 (crafted usernames granting full administrative privileges). A third flaw, CVE-2026-67277, allows unauthenticated kernel memory leaks or router crashes via the bandwidth-test service. Fixes shipped September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding a startup compromise-detection mechanism. Shadowserver data showed 122,500 MikroTik devices with exposed SSH interfaces as of September 5, and the CERT published IoCs including two attacker IP addresses.

BleepingComputer · 9d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-86060CVE-2026-67277

MikroTik patches flaws currently being exploited to take over routers

MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.

MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 for six vulnerabilities found by CERT Polska, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig. CVE-2026-67276, an RSA public-key validation flaw in the SSH server, lets an attacker who knows a username and key modulus authenticate as that user; CVE-2026-86060 then escalates privileges to root via special-character username handling. CERT Polska confirmed attackers are exploiting the chain to take full control of RouterOS devices with SSH exposed to the internet. Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.

CSO Online · 7d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-860602

Attackers use rogue ScreenConnect clients to spread malware

Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.

ConnectWise confirmed a file transfer flaw in ScreenConnect affecting both Cloud and On-Premise deployments, with a CVE identifier and official fix promised within the week; administrators can mitigate immediately by disabling TransferFiles (or TransferFilesInSession) in each role. Huntress documented incidents where social engineering installs rogue ScreenConnect clients that spawn Windows Script Host processes running four VBScript files (1.vbs-4.vbs), add a WindowsServiceHost registry Run key, and propagate to newly connected endpoints. Payloads enabled host profiling, persistence, additional ScreenConnect installs, tunneling, security-control changes, and cryptocurrency mining. ConnectWise has not confirmed a technical link between the flaw and this campaign.

Help Net Security · 9d agoExploit / PoC in the wild

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik RouterOS SSH auth-bypass chain MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is actively exploited; patch to 7.24.2/7.23.5/6.49.21.

Attackers are actively exploiting a chain dubbed MikroTrick that combines CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass in RouterOS RSA public key verification, and CVE-2026-86060, an SSH session privilege escalation, giving full admin control of internet-exposed MikroTik devices without the private key. Exploitation began around September 2, 2026, a day before MikroTik's September 3 patches, with confirmed compromises including creation of an 'ops' account; attacks traced to IPs 82.192.72.4 (Leaseweb) and 103.102.31.18. Fixed versions include 7.25beta3, 7.24.2, 7.23.4, 7.23.5 and 6.49.21. Defenders should check logs for failed logins with username '-2' and inspect /system history for ssh:-2@<IP> entries attached to configuration changes.

Security Affairs · 10d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-860602

Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)

MikroTik patched a critical SSH authentication bypass already exploited in the wild; attackers add accounts to affected routers for post-patch persistence.

MikroTik released a patch late last week for a critical vulnerability allowing SSH authentication bypass that is already being exploited in the wild, per the vendor's September 2026 advisory. Attackers have been adding new accounts to affected devices to maintain access even after the patch is installed. The patch attempts to detect compromise and set a 'Flagged' status on affected devices, and SANS ISC advises administrators to assume compromise.

SANS Internet Storm Center · 10d agoExploit / PoC in the wild

Dell Secure Connect Gateway Vulnerabilities Allow Hackers to Gain Unauthorized Access

Dell patches three critical flaws (CVSS up to 9.8) in Secure Connect Gateway 5.0 enabling admin token replay, unauthenticated RCE, and root escalation.

Dell disclosed three critical vulnerabilities in Secure Connect Gateway 5.0 appliance and application deployments. CVE-2026-80172 (CVSS 9.8) lets unauthenticated attackers replay captured requests, which lack nonce validation and time limits, to repeatedly mint administrator access and refresh tokens. CVE-2026-61410 (9.4) is a missing-authorization flaw enabling unauthenticated remote command execution, and CVE-2026-80238 (9.3) is an exposed Docker socket allowing local privilege escalation to root and container escape. Fixes ship in appliance 5.36.00.16 and application 5.36.00.00.

Cyber Security News · 8d agoVulnerabilityCVE-2026-80172CVE-2026-61410CVE-2026-80238

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

Cisco patched an ASA/FTD IKEv2 certificate authentication flaw letting unauthenticated remote attackers crash the IKEv2 process and reload devices with crafted certificates.

A logic error during the certificate authentication phase of IKEv2 connection setup in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to crash the IKEv2 process. Exploitation involves attempting to establish an IKEv2 VPN connection with a crafted certificate, causing a denial of service through an unexpected device reload. Cisco has released software updates.

Cisco Security Advisories · 6h agoAdvisory 9 sources

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.

CISA added five actively exploited vulnerabilities to the KEV catalog: CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, CVE-2026-84869 in ConnectWise ScreenConnect (CVSS 9.9), and CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS. The Artifactory bugs are chained with CVE-2026-82329 to gain administrative control, deploy malicious Groovy plugins, and install Rust-based backdoors. CERT Polska dubbed the RouterOS chain 'MikroTrick'; FCEB agencies must patch between September 13 and 25, 2026.

The Hacker Newsupdated · 2d agofirst · 4d agoExploit / PoC in the wild 2 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-84869+3 CVEs2· 1 read

Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer

Attackers actively exploit patched macOS Screen Sharing bug CVE-2026-65400 on systems with port 5900 exposed, gaining root to install a Monero cryptominer.

The Netherlands' National Cyber Security Centre (NCSC) reports active exploitation of CVE-2026-65400, an authentication flaw in macOS Screen Sharing that lets attackers authenticate without valid login credentials. Apple patched the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1, and the NCSC escalated its advisory on August 12 after proof-of-concept code went public and reports arrived of attacks on internet-exposed systems. In every reported case attackers obtained root access and installed a Monero crypto miner; users who cannot patch immediately are advised to disable Screen Sharing.

Help Net Security · Aug 17, 2026Exploit / PoC in the wildCVE-2026-65400

Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)

ArXiv paper shows the trusting-trust compiler backdoor technique can compromise an entire Linux distribution via the strip utility.

The paper (arXiv 2607.24888) demonstrates that Ken Thompson's trusting-trust attack, long viewed as a compiler-specific threat, can backdoor an entire Linux distribution by targeting the strip utility. A compromised tool reproduces its backdoor in subsequent rebuilds of itself, generalizing the attack surface beyond compilers. The finding has supply-chain implications for build reproducibility and distribution trust, though it is a research result with no observed real-world exploitation.

Lobsters · security · 11d agoResearch

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online · 6d agoMalware in the wildCVE-2025-53521

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.

The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.

SecurityWeek · 7d agoTools1

MikroTik Patches Critical Flaws Chained to Hack Routers

MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.

MikroTik released patches for six RouterOS vulnerabilities, including actively exploited MikroTrick chain: CVE-2026-67276 (9.2, SSH auth bypass) and CVE-2026-86060 (9.2, privilege manipulation), plus CVE-2026-67277 (8.8). CERT Poland confirms exploitation since September 2, creating an 'ops' account from IPs 82.192.72.4 and 103.102.31.18. Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; Shadowserver found 120,000+ SSH-exposed MikroTik devices.

SecurityWeek · 8d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-67277CVE-2026-67278+3 CVEs1

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackers · 7d agoMalware in the wildCVE-2025-252492