Search: “HTTP File Server”

806 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 787 Vulnerability 494 Exploit / PoC 258 Ransomware 190 Threat actor 156 Data breach 71 Phishing & fraud 29 AI safety & security 14 Industry 13 Policy & legal 13 Research 12 AI tools & infra 11 Advisory 9 Tools 6

SeverityAll critical 667 high 812 medium 501 low 63 info 26

Exposed Vite servers are being probed for AWS and Azure credentials

F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.

F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.

CSO OnlineSep 15, 14:36 UTC · 1d agoExploit / PoC in the wildCVE-2026-39364 CVE-2025-30208 CVE-2025-31125+4 CVEs

Full Analysis of Flame’s Command & Control servers

Kaspersky SecurelistSep 17, 17:00 UTC · Sep 17, 2012Vulnerability

Protecting Your Microsoft IIS Servers Against Malware Attacks

The Hacker NewsSep 8, 12:56 UTC · Sep 8, 2023Malware

OneClik APT campaign targets energy sector with stealthy backdoors

Security AffairsJun 27, 13:01 UTC · Jun 27, 2025Malware

Lazarus Trojanized DeFi app for delivering malware

Kaspersky SecurelistMar 31, 12:00 UTC · Mar 31, 2022Malware

Head Mare and Twelve: Joint attacks on Russian entities

Kaspersky SecurelistMar 13, 10:07 UTC · Mar 13, 2025Ransomware CVE-2023-38831 CVE-2021-26855

North Korean Kimsuky Hackers Strike Again with Advanced Reconnaissance Malware

The Hacker NewsMay 24, 06:59 UTC · May 24, 2023Malware

China-backed Hackers Hijack Software Updates to Implant "NSPX30" Spyware

The Hacker NewsJan 25, 13:45 UTC · Jan 25, 2024Malware CVE-2019-1652 CVE-2019-1653

UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager

Cisco TalosDec 17, 16:55 UTC · Dec 17, 2025Malware

Hacking campaign compromised at least 16 Chrome browser extensions

Security AffairsDec 31, 15:40 UTC · Dec 31, 2024Threat actor

North Korean Hackers Target Energy and Aerospace Industries with New MISTPEN Malware

The Hacker NewsSep 19, 03:06 UTC · Sep 19, 2024Malware

Knife Cutting the Edge: Disclosing a China-nexus gateway

Cisco TalosFeb 5, 11:00 UTC · Feb 5, 2026Malware

Detecting the "Next" SolarWinds

The Hacker NewsApr 15, 00:00 UTC · Apr 15, 2021Malware

Iranian MuddyWater Hackers Adopt New C2 Tool 'DarkBeatC2' in Latest Campaign

The Hacker NewsApr 15, 00:00 UTC · Apr 15, 2024Threat actor

Quasar Linux RAT (QLNX): A Fileless Linux Implant Built for Stealth and Persistence

Security AffairsMay 9, 13:11 UTC · May 9, 2026Malware

TinyTurla Next Generation

Cisco TalosFeb 15, 13:00 UTC · Feb 15, 2024Threat actor

North Korean Hackers Weaponize Seoul Intelligence Files

Infosecurity MagazineAug 29, 15:30 UTC · Aug 29, 2025Malware

JanelaRAT targeting online banking users in Latin America

Kaspersky SecurelistApr 13, 09:00 UTC · Apr 13, 2026Malware

ViceLeaker Operation: mobile espionage targeting Middle East

Kaspersky SecurelistJun 26, 10:00 UTC · Jun 26, 2019Threat actor

Shade: not by encryption alone

Kaspersky SecurelistAug 10, 10:58 UTC · Aug 10, 2016Ransomware

Cracking APT28 traffic in a few seconds

Security AffairsOct 22, 09:47 UTC · Oct 22, 2017Threat actor

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

Cisco TalosMar 28, 10:00 UTC · Mar 28, 2025Malware

CVE-2023-33538 under attack for a year, but exploitation still unsuccessful

Security AffairsApr 20, 13:44 UTC · Apr 20, 2026Vulnerability in the wildCVE-2023-33538

MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP

The Hacker NewsFeb 23, 17:21 UTC · Feb 23, 2026Vulnerability

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco TalosJul 23, 10:00 UTC · Jul 23, 2026Ransomware

Taking over Milesight UR32L routers behind a VPN: 22 vulnerabilities and a full chain

Cisco TalosJul 6, 15:38 UTC · Jul 6, 2023Vulnerability CVE-2023-22319 CVE-2023-23902

Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory

Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.

Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.

Help Net SecuritySep 9, 11:05 UTC · 7d agoMalware in the wildCVE-2025-535211

U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog

Security AffairsJul 8, 14:13 UTC · Jul 8, 2025Exploit / PoC in the wildCVE-2014-3931 CVE-2016-10033 CVE-2019-5418+1 CVEs