Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
Stories per day · 30 days
236 RSS
8,123 stories, newest first · one card per story
Stories tagged #exploit
Blog argues php2shell is unlikely to be mass-exploited
A public PoC needs four hits on one PHP worker plus the exact build, which the author says is slow to brute-force.
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Attackers exploited critical Atlassian flaw CVE-2026-21589 within hours, alongside arrests, malware updates, and certificate hijacks.
16
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
Attackers are exploiting CVE-2026-85097, a CVSS 10 file-upload flaw in the Bricksforge WordPress plugin.
12
CVE-2026-88779: Citrix NetScaler Zero-Day
Citrix patched CVE-2026-88779, a high-severity NetScaler memory overflow exploited as a zero-day.
32 Unique 0-Days Exploited in Samsung S26, Pixel 10, OpenAI Codex and Other Devices in Pwn2Own 2026
Pwn2Own Ireland 2026 day one produced 32 unique zero-days against Samsung S26, OpenAI Codex, LiteLLM, and smart devices, paying $388,500.
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Attackers are exploiting Rejetto HFS CVE-2026-61500 to forge admin sessions and gain remote code execution.
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Actively exploited Citrix NetScaler CVE-2026-88772 is a critical DTLS overflow enabling pre-auth root code execution.
New PlayStation 5 Console Jailbreak Released
A new PlayStation 5 jailbreak exploit, 'Relapse', was released publicly on GitHub and shared on Hacker News.
Attackers Drain Payy Network After Exploiting Ethereum Bridge Contract
Attackers exploited Payy Network's Ethereum bridge and drained its full balance, forcing a service suspension.
Hackers Exploited Ethereum Bridge Contract to Drain Full Balance from Payy Network
Attackers exploited Payy’s Ethereum bridge and drained its full balance, pausing the network.
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
3
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Nightmare Eclipse released a new Windows Defender PoC exploit called BigDiskBuster to prevent Defender from completing platform and signature updates.
2
Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands
A critical vulnerability in the MaxKB AI knowledge-base platform lets attackers execute OS commands via prompt injection, using the sandbox shell backend and elevated privileges; it can lead to remote code execution.…
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
Chinese-speaking threat actor exploited a vulnerability in unpatched ZyXEL switches (CVE-2026-7273) affecting 996 devices across multiple countries; the exploit was contained in June 2026 and is now part of a broader…
10
Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords
Chinese-speaking actor exploited WordPress flaws affecting 49 orgs, stealing 18,566 government records including plaintext passwords.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
A crafted comment (Comment2Shell) allowed an attacker to run code on the server via a line break in an HTML attribute. Another flaw, Click2Shell, enabled theme installation and further code execution. WordPress has had…
1
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.
4
Jun Kim, oMLX creator and maintainer, joins Hugging Face to support the MLX community
An anonymous comment can run code if an admin opens the page, using a crafted link to install a theme and execute commands with admin access. These are stack-based buffer overflow vulnerabilities in CGI of Zyxel…
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
Researcher Asim Manizada published working exploits for four patched Linux kernel flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) enabling local root access.
Add GitLab WorkHorse File Read Auxiliary Module (CVE-2026-85706)
Metasploit adds a new module to exploit CVE-2026-85706, a file read vulnerability in GitLab WorkHorse.
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
4
_Andriy_Popov_Alamy.png%3Fwidth%3D720%26quality%3D80%26disable%3Dupscale&w=828&q=75)
Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit
A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
1