Search: “ssh”

340 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 144 Vulnerability 87 Malware 41 Ransomware 30 Threat actor 26 Data breach 19 Phishing & fraud 4 Advisory 4 Industry 2 AI safety & security 1

SeverityAll critical 241 high 90 medium 23 low 2 info 2

Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.

Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).

SecurityWeekSep 8, 18:37 UTC · 8d agoExploit / PoC in the wildCVE-2026-75650 CVE-2026-82004 CVE-2026-48273+1 CVEs1

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security NewsSep 8, 16:50 UTC · 8d agoExploit / PoC in the wildCVE-2025-252491

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.

VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.

The Hacker NewsSep 8, 15:59 UTC · 8d agoVulnerability in the wildCVE-2026-74232 CVE-2026-74233 CVE-2026-66747

StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day

Critical unauthenticated RCE zero-day CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento is actively exploited; Adobe shipped hotfix VULN-39341 on September 7.

CVE-2026-75650 is a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, exploited via malicious style properties that inject PHP code executed through a transactional email template. Active exploitation began September 4, 2026, three days before Adobe released Hotfix VULN-39341 (APSB26-146) on September 7, with multiple victim stores confirmed by Sansec and Disrex across at least two distinct campaigns. Attackers deploy a persistent implant at ~/.local/share/.gvfsd/gvfsd-user masquerading as kworker, fc-cache, or chronyd, sustained by a cron job, while a second operator dropped a PHP web shell in product image caches. Tenable classified it as a Vulnerability of Interest; it is not yet in CISA KEV as of September 8, and Adobe also recommends rotating encryption keys and all protected credentials.

Tenable Blogupdated Sep 8, 14:13 UTC · 8d agofirst Sep 8, 14:00 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-75650 CVE-2025-54236 CVE-2024-34102+1 CVEs

Adobe fixes critical Magento zero-day exploited to backdoor servers

Adobe emergency-patches actively exploited max-severity Magento/Adobe Commerce zero-day CVE-2026-75650 (StyleSmuggler), used since Sept 4 to backdoor servers.

Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650, a max-severity zero-day dubbed StyleSmuggler affecting Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, enabling arbitrary code execution. Sansec reports the flaw has been exploited since at least September 4 to plant a backdoor whose C2 host is disguised as an NTP server, leaving traces like 'Payment Transaction Failed Reminder' emails. A second attacker with unrelated tooling is exploiting the flaw to deploy a 485-byte PHP web shell that collects server details, checks pub/media writability, and exfiltrates data to an oast.site subdomain. Adobe recommends immediate hotpatching plus rotation of all secrets including admin passwords, API keys, database credentials, and SSH keys.

BleepingComputerSep 8, 13:34 UTC · 8d agoExploit / PoC in the wildCVE-2026-756501

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.

Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.

Security AffairsSep 8, 09:11 UTC · 8d agoThreat actor in the wild1

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.

The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.

The Hacker NewsSep 8, 08:43 UTC · 8d agoThreat actor in the wild

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business NewsSep 7, 03:42 UTC · 9d agoPhishing & fraud in the wild1

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

Unknown attackers exploited critical TeamCity flaw CVE-2026-63077 to breach JetBrains Cadence, stealing a 2024 backup, user data, and AWS credentials; rotation urged.

JetBrains disclosed that threat actors exploited CVE-2026-63077 (CVSS 9.8), a TeamCity deserialization vulnerability added to CISA's KEV catalog on August 5, 2026, to breach its Cadence cloud computing service, with the intrusion running August 8-24, 2026. Confirmed access includes personal data (usernames, names, emails, login timestamps, IPs), a full 2024 Cadence server backup containing credentials and configuration, multiple AWS IAM users and secrets, files in JetBrains S3 buckets, and possibly PyCharm-synchronized source code. The compromised api.cadence.jetbrains.com server has been taken offline and all Cadence plugin access tokens invalidated. JetBrains urges users to immediately revoke or rotate all credentials used with Cadence and treat all executions, inputs, and outputs as potentially untrusted.

The Hacker NewsSep 5, 16:52 UTC · 11d agoData breach in the wildCVE-2026-63077

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security)Sep 5, 00:00 UTC · 12d agoExploit / PoC in the wildCVE-2026-756501

Langflow Remote Code Execution Vulnerability Exploited in Attacks (CVE-2026-0768)

Critical CVSS 9.8 RCE CVE-2026-0768 in Langflow is under active exploitation, with attackers probing for credentials and secrets.

CVE-2026-0768, a critical (CVSS 9.8) remote code execution flaw in Langflow's code validator, lets attackers execute Python code with root privileges via the validate endpoint's code parameter. VulnCheck honeypots in the UK detected Russian-origin exploitation performing reconnaissance and credential harvesting, querying environment variables like LANGFLOW_SUPERUSER and AWS keys and reading Langflow's secret key. Versions before 1.4.2 are affected; no vendor advisory or public PoC was available at reporting time.

Qualys ThreatPROTECTSep 2, 16:12 UTC · 14d agoExploit / PoC in the wildCVE-2026-0768 CVE-2026-33017 CVE-2026-5027+1 CVEs1

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.

The Hacker NewsSep 2, 13:44 UTC · 14d agoThreat actor in the wild

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.

Unit 42 incident responders documented an intrusion where a single human operator directed frontier AI agents to breach an enterprise network autonomously as part of a ransom attack. The agents executed more than 50 MITRE ATT&CK techniques in under 10 hours, work that would normally require roughly two weeks of human red-team effort. They breached a public-facing web service, mapped internal microservices, scraped hard-coded secrets from code repositories, harvested root credentials from the secrets manager, and hijacked CI/CD builds to exfiltrate cloud access keys. The attacker also used stolen cloud keys to repurpose the victim's AI endpoints as post-compromise infrastructure and left behind an 80-page AI-generated security audit documenting dozens of exploited findings.

Palo Alto Unit 42Sep 2, 10:00 UTC · 14d agoThreat actor in the wild

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Attackers exploit unauthenticated SQL injection CVE-2026-9586 in Sangoma Switchvox to run PostgreSQL commands and deploy reverse shells.

Threat actors are exploiting CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997), since August 30, 2026, running arbitrary SQL as the PostgreSQL superuser and achieving remote code execution. The /pa endpoint concatenates the user-controlled PhoneIP value into PostgreSQL queries; attackers can extract database contents, escalate to Switchvox web administrator, exfiltrate the cookie signing key to forge authentication, and invoke reverse shells. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, roughly 4,000 instances are internet-exposed (mostly in the US), and honeypot activity from IP 176.65.148.184 deploys reverse shells followed by Base64-encoded process enumeration.

The Hacker NewsSep 2, 07:08 UTC · 14d agoExploit / PoC in the wildCVE-2026-9586

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.

AI evaluation nonprofit METR disclosed two incidents. In March 2026, a fail-open bug in a vibe-coded app disabled authentication on a publicly accessible EC2 instance; an attacker prompted the running agent to reveal a model provider API key, added an SSH key for persistence, and consumed roughly $600,000 in free public-model credits over three weeks without being noticed. In May 2026, attackers probed METR's public infrastructure using agents, automated vulnerability discovery, credential stuffing, OAuth token attempts, and phishing; a separately exposed read-only SQL mechanism found by a bug bounty hunter risked leaking unpublished evaluation data, but no access to non-public data was confirmed.

The Register · SecuritySep 1, 20:45 UTC · 15d agoData breach in the wild1

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker NewsSep 1, 16:45 UTC · 15d agoThreat actor in the wildCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+2 CVEs1

CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability

CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.

CVE-2026-9586 (CVSS 4.0: 9.3) is an unauthenticated SQL injection in the /pa endpoint of Sangoma Switchvox SMB Edition, where the unsanitized PhoneIP value in XML phone notification requests reaches the PostgreSQL database. Horizon3 demonstrated escalation to OS command execution, and honeypots run with Defused Cyber observed exploitation attempts on August 30, 2026, using PostgreSQL commands with nc and curl. Fixed in Switchvox 8.4.0.2 released July 14, 2026; one attacker IP (176.65.148.184) was documented.

Horizon3.aiSep 1, 15:32 UTC · 15d agoExploit / PoC in the wildCVE-2026-9586

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.

METR, the AI model evaluation non-profit, disclosed two 2026 security incidents. In March, attackers found a publicly exposed EC2 instance behind a fail-open authentication bug, prompted an agent to reveal its API key, added SSH persistence, and consumed roughly $600,000 in inference credits over three weeks. In May, a likely financially motivated actor systematically probed METR's public infrastructure using agents for vulnerability discovery, credential stuffing, OAuth token grants and staff phishing, with no confirmed access to non-public data.

The Hacker NewsSep 1, 09:05 UTC · 15d agoData breach in the wild

Attackers Exploit Critical Langflow and Rails Flaws in Credential

VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.

VulnCheck observed active exploitation of CVE-2026-0768 (CVSS 9.8) in Langflow and CVE-2026-66066 'KindaRails2Shell' (CVSS 9.5) in Ruby on Rails, with detections rising from 50 on August 30, 2026 to 360 by September 1. The Rails flaw allows unauthenticated arbitrary file reads, leaking secret_key_base, Rails master key, database passwords, cloud credentials and API tokens, ultimately enabling RCE; the patch still leaves the variation-key Marshal deserialization RCE gadget functional. Observed chains include a Python credential harvester with SimpleHelp remote access via CVE-2026-5027, and weaponization of CVE-2025-3248 to enlist hosts into an XMR mining botnet after disabling auditd. More than 7,100 exposed vulnerable Ruby on Rails instances and over 15,000 successful exploitation attempts across three Langflow flaws were recorded.

The Hacker NewsSep 1, 07:23 UTC · 15d agoExploit / PoC in the wildCVE-2026-0768 CVE-2026-66066 CVE-2026-0769+2 CVEs1

China-linked Fire Ant Hides Inside Trusted Infrastructure

China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.

Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.

Security AffairsAug 31, 11:10 UTC · 16d agoThreat actor in the wild1

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.

Security AffairsAug 29, 09:16 UTC · 18d agoThreat actor in the wildCVE-2023-49103 CVE-2024-28000

CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do

CISA urged water utilities to secure internet-exposed PLCs after July 2026 attacks compromised over 100 US water and wastewater systems, suspected Iran-linked.

CISA's exposure-reduction guidance, published August 21, follows July 2026 attacks in which threat actors remotely accessed PLCs connected directly through cellular modems, changed device IP addresses and passwords, and in some cases disabled alarms and shutdown processes without notifying operators. Iran is the suspected actor, though officials stopped short of formal attribution. CISA recommends routing remote access through centrally managed secure gateways, phishing-resistant MFA, unique credentials, and external scanning of industrial protocols such as Modbus, EtherNet/IP, DNP3, BACnet and OPC UA.

Security AffairsAug 27, 07:36 UTC · 20d agoExploit / PoC in the wild

Iran-linked hackers expand infrastructure across Europe and Middle East, report says

Group-IB found Iran-linked Tortoiseshell expanding command-and-control infrastructure into the UK, Belgium, Saudi Arabia and the UAE with new malware tooling.

Group-IB researchers identified new Tortoiseshell command-and-control infrastructure, including servers named 'uk1' and 'uk2' hosted on UK IP addresses, plus systems in Belgium, Saudi Arabia and the UAE. The Iran-linked espionage group, active since at least 2018 and previously tied to the Islamic Revolutionary Guard Corps, has historically targeted defense, aerospace, technology and military organizations in the Middle East and the United States. Researchers also uncovered new malware samples, including a backdoor resembling TwoStroke that enables command execution, file theft and system reconnaissance, and a tool establishing reverse SSH tunnels to attacker-controlled servers. Group-IB assesses that the group is expanding both its geographic reach and its capabilities and ranks it among the most active Iranian APTs of 2026.

The RecordAug 26, 15:52 UTC · 21d agoThreat actor in the wild

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner

CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.

CVE-2026-60004 is a critical remote code execution flaw affecting Gitea versions 1.17 through 1.27.0, abused via the diffpatch endpoint to install a Git hook and execute shell commands as the Gitea OS user. Default open registration lets unauthenticated attackers obtain the required repository write access. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 28, 2026 to patch; version 1.27.1 fixes it. A developer reported their HOSTKEY-hosted VPS was exploited to run a miner-like dropper, driving CPU usage above 70% and killing competing processes.

The Hacker NewsAug 26, 07:34 UTC · 21d agoExploit / PoC in the wildCVE-2026-60004

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)

Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.

CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.

Help Net SecurityAug 26, 00:00 UTC · 22d agoExploit / PoC in the wildCVE-2026-60004

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI

Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.

Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.

The Hacker NewsAug 24, 17:23 UTC · 23d agoMalware in the wild

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.

CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.

The Hacker NewsAug 19, 15:26 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400 CVE-2026-55040 CVE-2026-59310+1 CVEs

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft links 30+ rotating domains to the MacSync macOS infostealer, confirming active credential and file exfiltration through chunked HTTP PUT uploads.

Microsoft Defender Experts correlated 30+ domains with MacSync Stealer, requiring aligned endpoint and network behaviors (process ancestry, command-line patterns, /curl/, /dynamic?txd=, and /gate?buildtxd= paths, API-key headers, chunked HTTP PUT parameters) to link infrastructure. Execution begins from an interactive zsh session consistent with ClickFix social engineering, with curl retrieving and Base64/gunzip decoding the payload, followed by collection of Keychain data, browser credentials, SSH keys, AWS credentials, Kubernetes configs, and Apple Notes. Data is zipped to /tmp/osalogging.zip, chunked, uploaded via HTTP PUT, and artifacts are deleted afterward; the analysis builds on RST Cloud's May 8 findings and overlaps with Microsoft's earlier 250+ domain ClickFix campaign distributing MacSync and Atomic Stealer (AMOS).

The Hacker NewsAug 19, 06:01 UTC · 28d agoMalware in the wild

Attackers turn to AI for help identifying files worth stealing

Gambit Security documents three threat actors using AI: a ransomware operator with Claude Code, credential harvester Zerofot, and the AI-built RAGE cryptomining framework.

Gambit Security examined three unrelated threat actors using AI across different stages of intrusions. A suspected operator tied to The Gentlemen ransomware-as-a-service used Claude Code running Claude Sonnet 4.6 in late June 2026 at six organizations, including an Australian energy utility, where it ran reconnaissance, ranked valuable databases, staged SQL Server dumps for exfiltration, and modified firewall configurations, accidentally taking one utility firewall offline. The Zerofot credential-harvesting operation, built with OpenAI Codex and Claude Code, collected 2,975 validated credentials from 1,742 hosts between April 5 and May 23, 2026, including SSH private keys and AWS access keys. The AI-generated RAGE Python framework exploits exposed Redis, Elasticsearch, Docker, Tomcat, and other services to harvest credentials and deploy cryptominers, guided at runtime by a DeepSeek-backed AI Orchestrator.

Help Net SecurityAug 18, 00:00 UTC · Aug 18, 2026Threat actor in the wild1

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker NewsAug 17, 17:57 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2026-59310 CVE-2026-65400 CVE-2026-688201

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Malware in the wildCVE-2024-36401

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.

CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).

The Hacker NewsAug 12, 13:46 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-45659 CVE-2025-113711

Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks

CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.

CISA, the FBI, and South Korean agencies warned of Gunra ransomware attacks targeting healthcare, financial services, government, and professional services worldwide. The Conti-derived operation exploits internet-facing Fortinet FortiOS and FortiProxy flaws CVE-2024-55591 and CVE-2025-24472 for initial access, then deploys double extortion with Salsa20/ChaCha20 encryption and publishes non-payers on a leak site within five to seven days. Ransomware.Live lists 51 victims since April 2025, mostly in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group uses Impacket tools for SMB lateral movement and NTDS credential dumping, tampers with VDI authentication to accept a designated OTP value to bypass MFA, and launched a RaaS affiliate program in January 2026 under the new alias Golden Community.

The Hacker NewsAug 12, 08:42 UTC · Aug 12, 2026Ransomware in the wildCVE-2024-55591 CVE-2025-24472

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security AffairsAug 12, 08:27 UTC · Aug 12, 2026Malware in the wild

Kimwolf botnet rebuilt to survive takedowns, researchers say

Palo Alto Unit 42 reports the Kimwolf/Aisuru botnet now uses HTTP/2 Chrome-impersonation floods and Ethereum blockchain-based command resolution to survive takedowns.

Palo Alto Networks' Unit 42 says a new Kimwolf/Aisuru botnet version active since February conducts DDoS floods over HTTP/2 with full Chrome browser fingerprints, making attack traffic hard to distinguish from real users. The malware resolves command servers via the Ethereum Name Service using five shuffled Ethereum endpoints, with a Tor hidden service fallback, so authorities cannot seize a domain or serve a takedown order. The botnet, powered mostly by hijacked Android TV boxes and IoT devices, previously had servers seized and an alleged operator arrested; new C2 infrastructure traces to a single network in Saint Petersburg, Russia. It is unclear whether the same developers built the new version.

CyberScoopAug 12, 00:13 UTC · Aug 12, 2026Malware in the wild1