Turla’s Cereal toolset found on government Exchange servers
ESET found the passive backdoor in Kazakhstan and Romania, with the victim Exchange server acting as the control point.
1
Stories per day · 30 days
1 RSS
Relatedmicrosoft13patch-tuesday12outlook8windows7ntlm5cereal4espionage4turla4active-directory3office3kazakhstan2ldap2romania2azure1cve-2026-969511dhcp1email-collection1endpoint-mapper1
28 stories, newest first · one card per story
Stories tagged #exchange
Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
November Patch Tuesday fixes exploited Outlook NTLM hash-theft flaw
Attackers already use CVE-2026-124194, CVSS 6.5, which leaks an NTLMv2 hash after a user opens a malicious Office file.
2
Microsoft November 2026 patches fix 1095 flaws, one exploited
Only CVE-2026-124194, an Outlook spoofing bug scored 6.5, is exploited; 48 of 64 critical issues are remote code execution.
2
Microsoft November patches fix 1,094 bugs, one exploited
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
Microsoft November patches include exploited Outlook flaw CVE-2026-124194
The release covers 1,093 flaws, 63 rated critical, plus Exchange, SharePoint, Windows Search, and LDAP bugs.
Microsoft November patches list 1,094 CVEs; one Outlook flaw exploited
CISA added the exploited Outlook spoofing bug to KEV; a Windows Search flaw is called zero-click code execution.
ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
1
October Windows Server updates break Exchange sign-in and mail flow
A new 512-call Endpoint Mapper limit can stall OWA and delivery; Microsoft offers a registry workaround, not an uninstall.
2
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.
9
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.
4
The October 2026 Security Update Review
ZDI's October 2026 review lists dozens of critical Microsoft Office, Azure, Exchange, and Windows flaws.
14
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft's October 2026 Patch Tuesday patches 1,417 flaws, including an already exploited Windows Shell bypass.
7
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive Data
FBI and partners warn China-linked Integrity Technology Group uses scanning, botnets, and hands-on access to steal data.
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft patched CVE-2026-96940, an Exchange flaw that lets authenticated attackers read other users' mailboxes.
Bitget Confirms $351.6 Million Hot Wallet Hack, Suspends Withdrawals
Bitget confirmed unauthorized hot-wallet transfers totaling about $351.6 million and suspended withdrawals.
1
Bitget Hot Wallet Hacked – Attackers Stole $351.6 Million From Hot Wallets
Bitget confirmed a $351.6 million theft from hot and warm wallets while cold storage stayed secure.
3
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
3
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, and Microsoft Dev Tunnels abuse.
3
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
September 2026 Patch Tuesday forecast: All we need is more time
September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.