News archive Page 20
918 articles · sorted newest first · page 20 of 39
Looking for a specific story? Search and filter the full archive.
City-Forum Campaign Targets Salesforce, ServiceNow
A data-theft operation running since March 2025 harvests records exposed through anonymous-access endpoints in Salesforce Experience Cloud and ServiceNow portals — no CVE required.
Colombia Justice Ministry Hit With Ransomware
Ransomware disrupted Colombia's Ministry of Justice days before the presidential transition, part of a documented pattern of attacks on Latin American government institutions.
Attackers Exploiting Critical Adobe Commerce Flaw
Active exploitation of CVE-2026-71362 targets Adobe Commerce and Magento storefronts. CVSS 9.1 critical flaw enables account hijacking without user interaction.
737 Fake Chrome VPN Extensions Route Traffic via Proxies
737 Chrome extensions impersonated VPN services while routing users' traffic through a single SOCKS5 proxy. Over 75,000 installs affected across the Store.
Lazarus Targeted Defense Firms via Windows Zero-Day
Lazarus exploited a Windows zero-day in afd.sys targeting defense firms via Operation Dream Job. CISA issued a two-week federal patch mandate.
ShieldBreak: Defender Patch Bypass PoC Published
ShieldBreak PoC, released hours after Patch Tuesday, claims to bypass the CVE-2026-50656 Defender fix and achieve SYSTEM access on patched systems.
vCenter Auth Bypass CVE-2026-59310 Now Exploited
CVE-2026-59310 exploitation confirmed in VMware vCenter Server. CVSS 9.8. Patches out since July 29 — unpatched instances need isolation now.
LiteLLM Supply Chain Attack Hit 2,500+ Orgs
Two backdoored LiteLLM PyPI releases sat live for 40 minutes in March, harvesting cloud keys, SSH keys, and Kubernetes tokens. CloudSEK maps exposure to 2,500+ organizations.
SAP Commerce Cloud CVSS 10 RCE — Patch Released
SAP patches CVE-2026-58231, a CVSS 10.0 unauthenticated RCE in Commerce Cloud's Data Hub Adapter. Apply the fix now or take the component offline.
SonicWall GMS Patched for Critical Unauth RCE Flaws
Critical unauthenticated RCE and data-read flaws patched in SonicWall GMS, which is end-of-life. If your GMS is internet-reachable, patch or isolate it now.
Ransomware Gang Seizes Hospital's Facebook Page
Ransomware attackers hijacked a hospital system's Facebook page during an active breach, claiming 6TB including mental health, abortion, and sexual assault records.
DeadLock Moves Extortion Infra to Polygon Blockchain
DeadLock ransomware has shifted victim comms and data-leak ops to Polygon smart contracts and Session messaging to resist law enforcement seizures.
Sandworm Targets IT Pros With Trojanized WireGuard Client
CERT-UA links UAC-0145 to fake recruiting ops targeting sysadmins since May. The lure delivers a trojanized WireGuard client with remote command execution.
Cisco ASA/FTD VPN Flaw Exploited, CISA Sets Aug 14 Deadline
CVE-2026-20349 added to CISA KEV today. Unauthenticated attackers can crash Cisco ASA and FTD devices over VPN — CISA's due date is August 14.
Zero-Click RCE in Zoom Annotation — Patch Now
A flaw in Zoom's annotation tool let any meeting participant execute code on another attendee's machine — zero clicks required. Update Zoom clients now.
Microsoft Patches 400 Flaws, Lazarus Exploited One First
Microsoft's August Patch Tuesday hits 400+ flaws. One is actively exploited by Lazarus via afd.sys. Two more are publicly disclosed. Here's your triage stack.
Adobe Patches Critical Flaws in ColdFusion, Campaign Classic
Adobe patches critical RCE and DoS flaws in ColdFusion and Campaign Classic. Arbitrary code execution risk confirmed. Adobe explicitly urges immediate patching — act now.
Rogue SIM Cards Execute Attacker Code on Industrial Modems
SIM Toolkit commands give rogue SIMs code execution on cellular modules in EV chargers, industrial routers, and car telematics units, University of Birmingham and Fuzzware researchers confirm.
SharePoint CVE-2026-45659 Ransomware Attacks Confirmed
CISA confirms ransomware gangs are exploiting CVE-2026-45659, the SharePoint deserialization RCE on KEV since July. Patch the May update now.
Storm-1175 Drops Medusa, Deploys Custom StormEncryptor
Microsoft's threat intel team links China-backed Storm-1175 to StormEncryptor, a new C++ ransomware. MSPs on unpatched N-central are in the likely blast radius.
Polish Heat Plant Breached via Private Cellular OT Network
Attackers breached a Polish heat plant via private cellular APN, shutting down a steam turbine. The OT intrusion went undisclosed for months.
Gunra Ransomware Exploits Fortinet Flaws, FBI Warns
FBI, CISA, and South Korea warn Gunra ransomware is exploiting two KEV-listed Fortinet firewall flaws to hit healthcare, finance, and critical infrastructure.
Iran Suspected in Multistate Water System PLC Attacks
Internet-exposed PLCs at water utilities across 12+ U.S. states are under active attack, with Iran-linked actors suspected. Default credentials and unencrypted protocols remain the core exposure.
BdThemes Supply Chain Creates Rogue WordPress Admins
A supply-chain attack against BdThemes poisoned a remote JSON feed to install rogue admin accounts on WordPress sites running their plugins. Audit your admin users now.