News archive Page 14
918 articles · sorted newest first · page 14 of 39
Looking for a specific story? Search and filter the full archive.
Elementor Pro Flaw Exploited to Backdoor WordPress Sites
Attackers are exploiting CVE-2026-32475, a critical file upload flaw in Elementor Pro, to deliver webshells to WordPress sites running version 4.2.1 or earlier.
Cisco Patches Critical RCE in Nexus 9000 Switches
Cisco patched CVE-2026-20212 in ten Silicon One Nexus 9000 models and published an interim access-control-list mitigation for TCP ports 43210 and 43211.
OpenAI's Astra Crosses Critical Cybersecurity Threshold
OpenAI's Astra is the first AI model formally designated as capable of autonomously finding and exploiting zero-days across well-defended systems.
FalconFlank PoC: Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse released a public PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon. No CVE assigned. No patch confirmed as of September 3.
CISA Adds Seven Exploited Flaws to KEV Catalog
CISA added seven actively exploited vulnerabilities to KEV on September 3, including a critical Sangoma Switchvox SQL injection. Federal agencies face BOD 26-04 remediation deadlines.
Elasticsearch Patches RCE in Machine Learning Module
Elastic patches CVE-2026-72649, a CVSS 8.8 deserialization flaw in the ML component that lets privileged users achieve RCE via crafted model artifacts.
Forescout Uses Claude to Port RCE Across WAGO PLCs
Vedere Labs used Claude to port a pre-auth RCE exploit between WAGO PLC models, showing AI tools can lower barriers to ICS exploitation.
Switchvox Flaw Exploited for Unauthenticated RCE
Attackers are exploiting a critical vulnerability in Sangoma Switchvox enterprise VoIP to deploy reverse shells without credentials. No CVE identifier publicly disclosed yet.
Sality Botnet Takedown: DOJ Seizes P2P Network
DOJ and international partners dismantled the Sality botnet by turning its own P2P relay infrastructure against itself. Infected Windows endpoints remain in the wild.
Ransomware Gang Claims Nutex Health Patient Data
Ransomware group breached Nutex Health, taking patient, employee, provider, and financial data. The Houston-based operator disclosed the incident to the SEC.
SonicWall SMA1000 Zero-Days Exploited in Attacks
SonicWall confirms active exploitation of two SMA1000 zero-days: CVE-2026-83548 (pre-auth SSRF) and CVE-2026-83549 (OS command injection). Chained, they enable unauthenticated RCE.
Attackers Exploit Langflow to Steal OpenAI, AWS Keys
CVE-2026-0768, a critical unauthenticated RCE in Langflow, is being actively exploited to drain AI API keys and cloud credentials from exposed instances.
JFrog Artifactory CVE-2026-82329 Now Exploited
Active exploitation of the critical Artifactory authentication bypass has started, just days after public disclosure. If your instance is unpatched, that ends now.
FulcrumSec Claims 80GB Manchester Airports Hack
FulcrumSec claims 80 GB of Manchester Airports Group data and threatens public release. No extortion group had claimed the breach when MAG disclosed it on August 28.
McKesson Breach: Leaked Dataset Lists 6.4M Email Addresses
ShinyHunters' 284 million record claim was not verified by McKesson. Have I Been Pwned lists 6.4 million unique email addresses in a dataset attributed to the breach.
Aurora Ransomware Uses AI Coding Tools in Attacks
CloudSEK and Gambit Security find Aurora operators used Cursor AI to plan Russian-language attacks on 20-plus organizations in nine countries.
PaperCut Active Intrusions: CISA Adds Flaws to KEV
CISA added CVE-2026-81578 and CVE-2026-82078 to KEV on Aug 31. Active intrusions now confirmed. Federal deadline: Sep 14. Emergency Patch Release 2 required.
Chinese Fire Ant Buries Spy Tunnels in Cisco IOS XR
State-linked Fire Ant planted covert GRE tunnel interfaces on Cisco IOS XR routers absent from running configs. Here's what to check on your own gear.
ToolJet Patches Seven Auth Flaws, Worst CVSS 9.9
ToolJet patches seven authorization bypass flaws, the worst rated CVSS 9.9. Any authenticated Builder can read or modify data across other organizations' ToolJet DB instances.
ash_phoenix Patches Four Auth-Bypass Flaws
The Elixir Ash framework's Phoenix integration disclosed four CVEs covering tenant isolation bypass, authorization bypass via user-controlled keys, and sensitive parameter exposure in logs.
Profile Builder Plugin Flaw Allows Unauth File Upload
Cozmoslabs Profile Builder for WordPress up to 3.16.1 lets unauthenticated attackers upload files via the avatar AJAX endpoint. Patch or mitigate now.
13 CVEs in AshAdmin and AshAI Include Critical RCE
ERLEF CNA disclosed 13 vulnerabilities in the ash-project Elixir framework today, topped by an unauthenticated remote code execution flaw in AshAI. Elixir developers should audit their deployments immediately.
oidcc Auth Bypass Lets Attackers Impersonate Users
CVE-2026-75759 in the Elixir oidcc library lets an unauthenticated attacker impersonate any user by supplying an encrypted OIDC token with an attacker-controlled algorithm. Update oidcc now.
TerminalFix: New ClickFix Drops Reverse-Tunnel Backdoor
Microsoft has detailed TerminalFix, a ClickFix variant that lures users into running commands in Windows Terminal or PowerShell and then plants a persistent reverse-tunnel backdoor.