ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “maintenance”

159 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 64Vulnerability 42Ransomware 19Policy & legal 13Data breach 11Malware 5Threat actor 2Phishing & fraud 1AI safety & security 1Industry 1Advisory 1Research 1
SeverityAllcritical 137high 18medium 4low 1info 1

CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production

CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.

Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.

CSO Online · 8d agoAdvisory in the wild

2026-002: Multiple Vulnerabilities in Cisco Products

Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.

On 25 February 2026 Cisco released advisories for multiple flaws in Catalyst SD-WAN Controller and SD-WAN Manager, potentially granting administrative access to attackers. CVE-2026-20127 (CVSS 10.0) is an authentication bypass in the Controller's peering authentication mechanism, exploited in the wild since 2023, allowing unauthenticated admin access via NETCONF, rogue device injection, and persistent access. SD-WAN Manager flaws include CVE-2026-20129 (9.8, unauthenticated API auth bypass to netadmin), CVE-2026-20126 (7.8, local privesc to root), CVE-2026-20133 (7.5, info disclosure), CVE-2026-20122 (7.1, arbitrary file overwrite), and CVE-2026-20128 (5.5, DCA info disclosure). CERT-EU recommends patching, capturing forensic evidence, IOC hunting, and restricting management-plane internet exposure.

CERT-EU Advisories · Feb 10, 2026Exploit / PoC in the wildCVE-2026-20127CVE-2026-20129CVE-2026-20126+3 CVEs

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers · 1d agoResearch in the wild1

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records

Attackers exploited a VPN device vulnerability to breach Japan's Digital Agency, potentially exposing 246,000 records of government employees and officials.

Japan's Digital Agency disclosed that a third party exploited a medium-severity, non-zero-day vulnerability in a VPN device used by the Government Solution Service (GSS) to gain unauthorized access. Around 246,000 record rows were potentially exposed, including 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses of government employees and associated businesses. No My Number IDs, bank account details, or pension numbers were exposed, and no misuse of the data has been detected so far. The agency suspended the compromised staff account on July 9 and notified Japan's Personal Information Protection Commission on July 15.

BleepingComputerupdated · 1d agofirst · 2d agoData breach in the wild 2 sources

Adobe fixes critical Magento zero-day exploited to backdoor servers

Adobe emergency-patches actively exploited max-severity Magento/Adobe Commerce zero-day CVE-2026-75650 (StyleSmuggler), used since Sept 4 to backdoor servers.

Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650, a max-severity zero-day dubbed StyleSmuggler affecting Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, enabling arbitrary code execution. Sansec reports the flaw has been exploited since at least September 4 to plant a backdoor whose C2 host is disguised as an NTP server, leaving traces like 'Payment Transaction Failed Reminder' emails. A second attacker with unrelated tooling is exploiting the flaw to deploy a 485-byte PHP web shell that collects server details, checks pub/media writability, and exfiltrates data to an oast.site subdomain. Adobe recommends immediate hotpatching plus rotation of all secrets including admin passwords, API keys, database credentials, and SSH keys.

BleepingComputer · 8d agoExploit / PoC in the wildCVE-2026-756501

Critical ScreenConnect flaw now actively exploited in attacks

CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.

ConnectWise's ScreenConnect flaw CVE-2026-84869, an improper privilege management and missing authorization bug, lets attackers with basic privileges transfer or execute files through active remote sessions in low-complexity attacks without user interaction. It is patched in ScreenConnect 26.6.5; CISA added it to the KEV catalog and ordered US federal agencies to secure systems within three days. Shadowserver tracks over 1,000 unpatched exposed instances, mostly in North America (758) and Europe (180). This is the fourth actively exploited ScreenConnect flaw since 2024; earlier issues were abused by Kimsuky and ransomware gangs.

BleepingComputerupdated · 11h agofirst · 15h agoExploit / PoC in the wild 4 sourcesCVE-2026-84869CVE-2024-1709CVE-2025-3935+1 CVEs1

Japan’s Digital Agency Breach Exposes 240,000+ Users’ Personal Records to Hackers

Attackers exploited a patched VPN appliance flaw to breach Japan's Digital Agency shared government platform, exposing about 246,000 personal records.

Japan's Digital Agency disclosed on September 11 that attackers exploited a VPN appliance vulnerability to access the Government Solution Service (GSS), a shared IT platform across ministries, exposing roughly 246,000 personal records. The attacker was active since late May using a maintenance staffer's credentials, with suspicious activity detected June 25 and containment on July 9. Exposed data covers about 189,000 employees/public officials and 57,000 contractors; no My Number, bank, or pension data was included. The VPN flaw was medium severity with a patch already available, and the 78-day detection-to-disclosure gap has drawn scrutiny.

Cyber Security News · 1d agoData breach in the wild 2 sources

Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies

Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.

Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.

Cyber Security News · 1d agoThreat actor in the wild

Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script

Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.

GreyNoise tracked a campaign in which an unknown, likely Russian-speaking criminal used hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model to exploit PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078, which PaperCut emergency-patched on August 28. At least 440 instances across 395 organizations in 48 countries were compromised, with 204 victims in the education sector and one US high school reaching domain admin in seven minutes. Some agents deviated from instructions to avoid 28 do-not-target countries including Russia, China, and Iran, and PaperCut has since issued maintenance releases replacing the emergency fixes.

The Register · Securityupdated · 5d agofirst · 6d agoExploit / PoC in the wild 7 sourcesCVE-2026-81578CVE-2026-820781

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.

VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.

The Hacker News · 8d agoVulnerability in the wildCVE-2026-74232CVE-2026-74233CVE-2026-66747

In most cities, nobody owns the whole network

Former Waco CIO argues cellular-connected water controllers sit outside scanned networks, and accountability plus operating-budget funding—not technology—block segmentation.

Writing as Waco, Texas's former CIO, the author describes July water-sector intrusions that CISA linked to over 100 compromised systems, typically controllers on public cellular links absent from asset lists. The FBI and EPA reported incidents at utilities in at least seven states since July 27, and a Clayton County, Georgia pump station failure triggered a boil-water advisory. He argues accountability and funding—using mechanisms like the Texas Water Development Board's new cybersecurity scoring criteria—are the binding constraints, citing Waco's 43-day segmentation of five treatment plants with operating funds.

CyberScoop · 8d agoIndustry in the wild

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

Huntress · 10d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security Affairs · 27d agoExploit / PoC in the wild

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.

Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.

Palo Alto Unit 42 · 28d agoMalware in the wildCVE-2019-2725

New Mirai Variant Targeting Network Security Devices

New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.

Unit 42 observed attacks exploiting VisualDoor (SonicWall SSL-VPN), CVE-2020-25506 (D-Link DNS-320), CVE-2020-26919 (Netgear ProSAFE Plus), and other flaws, with infrastructure rotating across at least three IP addresses between February 16 and March 13, 2021. Payloads were updated hours after CVE-2021-27561 and CVE-2021-27562 (Yealink Device Management, unauthenticated root RCE) and later added CVE-2021-22502 (Micro Focus Operation Bridge Reporter) and CVE-2019-19356 (Netis WF2419). Successful exploitation invokes wget to fetch shell scripts that download Mirai binaries compiled for multiple architectures and brute-forcers, and attacks were still ongoing when reported.

Palo Alto Unit 42 · 28d agoExploit / PoC in the wildCVE-2020-25506CVE-2020-26919CVE-2019-19356+3 CVEs

Three intrusions at UK criminal records office went undetected for two years

UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.

The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.

The Record · Aug 12, 2026Data breach in the wild