60
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross
60
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.
48
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero
60
Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa
60
Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022
60
60
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.
80
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe
60
Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.
72
Critical N-able N-central Vulnerability and Active Exploitation
N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.
N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.
83
60
February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
60
60
December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
60
Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)
60
60
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero
60
Network Attack Trends: Internet of Threats (November 2020
60
60
60
60
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
60
60
60
60
60
60
60
60
ToolShell Exploit: Critical SharePoint Zero
60
60
60
60
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
60
CISA adds recently discovered Apple zero-days to Known Exploited Vulnerabilities Catalog
60
A threat actor exploited 11 zero
60
60
60