ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “engineering”

214 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 865Vulnerability 567Ransomware 265Malware 188Data breach 138Threat actor 129Phishing & fraud 77Policy & legal 50AI safety & security 30Advisory 17Industry 7Research 5Model release 2Tools 1
SeverityAllcritical 1955high 241medium 125low 4info 16

CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production

CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.

Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.

CSO Online · 8d agoAdvisory in the wild

Cisco Identity Services Engine Hardening Release: September 2026

Cisco ISE hardening release fixes multiple internally discovered vulnerabilities, including an authentication bypass known to be actively exploited.

Cisco released September 2026 hardening updates for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) following a comprehensive internal security review that uncovered multiple vulnerabilities. One of the flaws, an ISE authentication bypass, is known to be actively exploited. Cisco grouped the issues by underlying vulnerability to help customers prioritize patching and streamline disclosure.

Cisco Security Advisories · 11h agoAdvisory in the wild 15 sources

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.

Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.

Microsoft Security Blog · 7d agoThreat actor in the wild2

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker News · 19d agoThreat actor in the wildCVE-2026-194781

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker News · 28d agoThreat actor in the wildCVE-2026-12569

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UK · 1d agoThreat actor in the wild2

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42 · 7d agoMalware in the wild1

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog · 14d agoThreat actor in the wild

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.

GBHackers · 7d agoThreat actor in the wild1

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft details two campaigns: million-email CEO impersonation ACH fraud and passkey-themed vishing that hijacks Microsoft cloud accounts for data theft and extortion.

Microsoft disclosed a campaign that sent over one million CEO-impersonation scam emails between August 3-5, 2026, targeting U.S. accounts payable departments with fake ServiceNow subscription invoices to induce ACH transfers, using generative AI to tailor templates. A second campaign detected since May 2026 uses passkey/MFA-themed voice phishing posing as the IT help desk, redirecting victims via SMS to counterfeit Microsoft sign-in pages and adversary-in-the-middle or device-code flows to hijack accounts. Post-compromise activity includes adding attacker-controlled authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection via REST APIs. Microsoft attributes initial access to Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (UNC6671, a BlackFile splinter operating the Helix extortion brand).

The Hacker News · 3d agoPhishing & fraud in the wild2

Google fixes the seventh actively exploited Chrome zero-day of 2026

Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.

Google released Chrome 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac, fixing 230 security vulnerabilities. CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine (CVSS 8.8), is being exploited in the wild through specially crafted HTML pages to execute arbitrary code inside Chrome's sandbox. Google says it is the seventh actively exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Researcher Jihyeon Jeong of Seoul National University reported it on 2026-08-06 and received a $2,500 bounty; Google disclosed no technical details or attribution.

Security Affairs · 7d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-2441CVE-2026-3909+4 CVEs

Apollo discloses data breach from ongoing wave of attacks hitting financial sector

Apollo Global Management confirmed a breach of cloud platforms by BlackFile-linked social engineering attackers, exposing personal data including Social Security numbers.

Apollo Global Management disclosed that attackers accessed some of its cloud platforms between July 6 and July 10, 2026. The company determined on August 12 that compromised data included names, dates of birth, contact information, home addresses, and Social Security numbers. Google attributed the broader campaign against financial sector organizations to BlackFile, a threat group affiliated with The Com that operates extortion brands Redact, Pink, Helix, and Falcon. Apollo, which manages $1.05 trillion in assets, is the first victim to formally confirm sensitive personal data was compromised in this wave, with Blackstone and Bain Capital also reportedly targeted.

CyberScoop · 26d agoData breach in the wild

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.

US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.

BleepingComputer · 6h agoThreat actor in the wild 6 sources

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added actively exploited CVE-2026-76460 (Cisco Identity Services Engine) and CVE-2026-87886 (Acronis Backup) to its KEV catalog.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that grant total control post-exploitation, and check whether systems were compromised before patching.

CISA Advisories · 15h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-87886

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputerupdated · 12h agofirst · 5d agoPhishing & fraud in the wild 9 sources2

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 9d agoPhishing & fraud in the wild1

U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Chrome V8 type-confusion flaw CVE-2026-85046 (CVSS 8.8) to its KEV catalog; Google patched it in Chrome 152.

CISA added CVE-2026-85046 (CVSS 8.8), a V8 type confusion flaw, to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to patch by September 18, 2026. Google fixed it in Chrome Stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, alongside 11 other vulnerabilities. The bug lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page and is the sixth actively exploited Chrome zero-day of 2026. Researcher Salvatore Gulizia (Serotav) reported it on August 4, 2026.

Security Affairs · 12d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-2441CVE-2026-3909+3 CVEs1

Google fixes the sixth actively exploited Chrome zero

Google patched 12 Chrome flaws including actively exploited V8 type confusion zero-day CVE-2026-85046 (CVSS 8.8), enabling sandboxed remote code execution via crafted webpages.

Google released Chrome Stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, fixing 12 vulnerabilities including CVE-2026-85046, a type confusion in V8 with a CVSS score of 8.8. Google says an exploit exists in the wild, making this the sixth actively exploited Chrome zero-day of 2026. The bug affects the JavaScript and WebAssembly engine and allows arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026 and received a $1,000 bounty.

Security Affairs · 12d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-2441CVE-2026-3909+3 CVEs1

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

Huntress · 13d agoExploit / PoC in the wild1

Two critical Chrome flaws put users at risk on malicious websites

Google patched 26 Chrome flaws, including two critical use-after-frees and an actively exploited V8 sandbox escape (CVE-2026-85046); update to 152.0.7977.82/.83.

Chrome's desktop update fixes 26 security issues, including critical use-after-free flaws CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, both allowing code execution outside the browser sandbox via crafted HTML pages. Google subsequently patched CVE-2026-85046, a high-severity V8 JavaScript engine flaw with exploits already in the wild that enables arbitrary code execution inside the Chrome sandbox; HKCERT rates the overall risk as extremely high. Fixed versions are 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux.

Malwarebytes Labs · 14d agoExploit / PoC in the wildCVE-2026-84352CVE-2026-84353CVE-2026-850461

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.

Security Affairs · 18d agoThreat actor in the wildCVE-2023-49103CVE-2024-28000

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

A Chinese-speaking actor exploited ownCloud CVE-2023-49105 to steal 176 nuclear research files from Philippine organizations, prompting CISA to add the flaw to KEV.

CISA added CVE-2023-49105 (CVSS 9.8), an ownCloud WebDAV API authentication bypass fixed in version 10.13.1, to the KEV catalog after Hunt.io found an open directory hosting custom Python exploit scripts and tools including Sliver, Metasploit, and Mettle. The actor downloaded 176 files (~372 MB) from a Philippine nuclear research body, including nuclear-material account records, 2023-2028 strategic plans, BitLocker keys, and a KeePass database; a second intrusion exploited LiteSpeed Cache CVE-2024-28000 at a shipbuilding firm serving the Philippine Navy, with XML-RPC brute-force and an EtherHiding/ClickFix component. FCEB agencies must patch by August 30, 2026. CISA also added Linux Kernel CVE-2026-53362 and Artifactory CVE-2026-66384 after OpenAI said its AI agents exploited them against internal infrastructure.

The Hacker News · 19d agoExploit / PoC in the wildCVE-2023-49105CVE-2024-28000CVE-2026-53362+1 CVEs1

Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics

Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.

Google's Threat Intelligence Group documented three suspected Russia-linked clusters, UNC6293, UNC7005, and UNC5976, abusing legitimate authentication flows. UNC6293, a likely APT29/ICE RELIC sub-cluster, impersonates US State Department officials in app password and OAuth phishing targeting fewer than five victims at a time. UNC7005, tracked by Microsoft as STORM-2945, spoofs the GLOBSEC conference, runs device code phishing against Microsoft and WhatsApp accounts, and deploys VIDAR and AtomicStealer infostealers. Targets include researchers, academics, diplomats, think-tank analysts, and defense personnel in Europe and the United States.

Security Affairs · 26d agoThreat actor in the wild1

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.

Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.

The Hacker News · Aug 15, 2026Threat actor in the wildCVE-2026-68820CVE-2025-491132

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.

Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.

The Hacker News · Aug 15, 2026Threat actor in the wild

Inside the Metabase SQLi: Exploited in the Wild

Wiz reverse engineers Metabase SQLi CVE-2026-72898, exploited in the wild, using AI to speed defenses.

Wiz published an analysis of Metabase CVE-2026-72898, a SQL injection vulnerability that is being exploited in the wild. The write-up reverse engineers the flaw and applies AI to accelerate defensive guidance for responders. Organizations running Metabase should treat the flaw as actively targeted.

Wiz Blog · Aug 10, 2026Exploit / PoC in the wildCVE-2026-72898