News archive Page 13
918 articles · sorted newest first · page 13 of 39
Looking for a specific story? Search and filter the full archive.
Adobe Patches StyleSmuggler, CVSS 10 Magento Zero-Day
Adobe's September 8 emergency update patches CVE-2026-75650, a CVSS 10.0 template-injection zero-day exploited to plant Rust backdoors in Commerce and Magento stores. CISA deadline: September 11.
Fake IT Calls Drive M365 Exec Data Theft Campaign
Threat hunters have disclosed an active data theft and extortion cluster targeting Microsoft 365 executives via vishing: fake IT help desk calls that harvest credentials and SaaS access.
220M Passport Records Exposed in Vietnam APIS Leak
An exposed Vietnam-linked APIS database held 220 million traveler records: names, passport numbers, birth dates, nationalities, and flight routes.
Nightmare Eclipse: Zero-Days Hit CrowdStrike, Nvidia, Avast
Nightmare Eclipse published PoC privilege-escalation exploits for CrowdStrike Falcon, Nvidia drivers, and Avast antivirus. No CVE IDs or vendor patches yet.
Advantech WISE-6610 Firmware Hit by CVSS 9.9 RCE
A command injection in the WISE-6610 LoRaWAN gateway's Basic Station handler allows remote code execution. Exploit is public. Patch: firmware 1.2.4_20260821.
Telerik UI RCE Chain: PoC Published, Patch Is Out
TantoSec's public exploit chains seven Telerik UI CVEs into unauthenticated RCE. Non-default configs only. Patch to 2026 Q2 SP1 now.
Patch N-central Again: Hotfix 4 Is Out
N-able's fourth N-central hotfix in five weeks renders Hotfix 3 obsolete. Update to 2026.3.1.14 now: CVE-2026-86218 is actively exploited.
JSCeal Malware Bypasses Google Auth with Stolen Cookies
JSCeal is compiled V8 JavaScript malware with credential harvesting and traffic interception. It bypasses Google Authentication using stolen session cookies.
N-central Under Active Attack: Patch CVE-2026-86218 Now
BleepingComputer reports N-central servers under active attack one day after N-able's CVSS 10.0 pre-auth RCE disclosure. Update to version 2026.3.1.14 immediately.
Frontend Admin Plugin Flaw Allows WordPress Account Takeover
CVE-2026-75816, scored CVSS 9.8, is an authentication bypass in the Frontend Admin by DynamiApps plugin that allows unauthenticated takeover of any WordPress account on affected sites.
MikroTik Patches Exploited SSH Auth Bypass
CERT Polska confirmed active attacks hijacking MikroTik routers via SSH without credentials. Patch RouterOS to 6.49.21, 7.23.4, or 7.24.2 immediately.
AutoAgent Critical Flaw: Root RCE via Unauthenticated TCP
AutoAgent's TCP server binds to all interfaces and runs commands without authentication, giving remote attackers root access on any exposed installation.
Broadcom Patches Critical RCE in VMware Workstation, Fusion
Broadcom patched two vulnerabilities in VMware Workstation and Fusion, including a critical flaw that lets a VM administrator execute code on the host system.
N-able Patches CVSS 10 Pre-Auth RCE in N-central
N-able's N-central RMM platform has a pre-authentication remote code execution flaw, CVSS 4.0: 10.0, affecting all versions before 2026.3.1.14. Patch immediately.
JetBrains Cadence Breached via Unpatched TeamCity RCE
AWS keys, source code, and a server backup stolen from JetBrains Cadence after its TeamCity server went unpatched for weeks against CVE-2026-63077.
Magento Zero-Day Exploited to Backdoor Online Stores
Attackers exploit an unpatched unauthenticated RCE in Magento Open Source and Adobe Commerce to install backdoors in online stores. No patch available.
PaperCut Attackers Steal Credentials From Schools
Arctic Wolf finds PaperCut exploitation now targeting US and European schools with credential theft as the post-exploitation objective.
IDScan Sued Over Breach of 153M Driver Licenses
Multiple lawsuits target identity verification firm IDScan after hackers allegedly accessed and offered to sell more than 153 million driver records.
PostgreSQL Patches 12-Year-Old Logical Decoding RCE
PostgreSQL patches a 12-year-old flaw in its logical decoding subsystem. Accounts with the REPLICATION attribute could execute code on the underlying host.
Microsoft Patches Entra ID CVSS 9.1 Auth Bypass
A CVSS 9.1 auth bypass in Microsoft Entra ID lets unauthenticated attackers escalate privileges. Second critical Entra flaw in three weeks; patch available.
Citrix NetScaler Auth Bypass Now Exploited in Wild
Attackers are actively targeting CVE-2026-19490, a critical auth bypass in Citrix NetScaler ADC and Gateway. Patches have been available since August 19.
HPE Patches CVSS 9.8 RCE in ArubaOS-CX Switches
HPE's advisory for ArubaOS-CX covers 24 flaws, led by CVE-2026-73749 — an unauthenticated buffer overflow rated 9.8 that allows remote code execution on data center switches.
Chrome Patches Exploited V8 Zero-Day: Update Now
CVE-2026-85046 is a type confusion bug in Chrome's V8 engine, CVSS 8.8, actively exploited in the wild. Update to Chrome 152.0.7977.82 or later immediately.
All-in-One WP Migration Flaw Hits 3M WordPress Sites
Unauthenticated SQL injection in All-in-One WP Migration and Backup plugin (versions through 7.109) enables data theft and conditional RCE. Update immediately.