ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Attackers are exploiting Node.js as a malware delivery vector because security tools trust it. Node.js's built-in capabilities—file system access, networking, process spawning—enable sophisticated attacks (credential theft, C2 communication, lateral movement) while evading EDR detection, since Node
Microsoft's KB5120998 update resets desktop settings on affected machines. For enterprises, this breaks Group Policy enforcement of compliance banners, risking security policy violations.
Microsoft's August patch broke Teams and Outlook on ARM-based Windows. Organizations must choose between security and functioning apps—a first-party regression on Microsoft's own hardware.
CISA flagged seven actively exploited flaws, led by a perfect-10 SSRF in SonicWall. Attackers chain SSRF access with reverse shells and crypto miners to monetize unpatched edge appliances at scale.
A researcher exploited CrowdStrike Falcon's macro remediation feature—which runs with SYSTEM privileges—to escalate privileges, turning Falcon's own defense mechanism into an attack vector. By triggering the remediation path with crafted input, an attacker with local access can abuse the elevated pr
Sangoma Switchvox suffers active CVE-2026-9586 attack—unauthenticated SQL injection enabling RCE. Unpatched PBX systems serve as network chokepoints and ideal attacker footholds.
JFrog Artifactory flaw enables attackers to forge admin tokens, letting them inject backdoors into packages, steal source code, and compromise CI/CD pipelines. Active exploitation confirmed.
AI coding agents have critical flaws: malicious `.git/config` files execute arbitrary commands without approval when agents interact with untrusted repos, exposing developer credentials and SSH keys. Four of eight discovered vulnerabilities remain unpatched.
A malware campaign disguised as legitimate software targets multinational companies in China, disabling Windows security to establish persistent access in environments with limited security oversight. The scheme exploits gaps between corporate IT teams abroad and endpoints operating under Chinese ne
A critical SQL injection in All-in-One WP Migration (5M+ sites) allows unauthenticated attackers full site takeover. The vulnerability chains to remote code execution through database and filesystem access.
Attackers exploited a Lenovo email verification flaw to hijack email addresses, then reset Dropbox accounts using those addresses. The breach demonstrates how inter-vendor trust relationships create security vulnerabilities neither company fully controls.
Researchers demonstrated that Claude can adapt ICS exploits across different PLC models, dramatically lowering the technical barrier for weaponizing pre-authentication RCE attacks. This threatens critical infrastructure like power grids and water treatment plants that lack protection against widespr
SonicWall confirmed active zero-day exploitation of SMA1000 VPN appliances targeting enterprises. Attackers in the wild now control perimeter access for affected organizations.
An unauthenticated SQL injection in Sangoma Switchvox (CVE-2026-9586, CVSS 9.3) enables remote code execution and is actively exploited in the wild. SMB deployments with exposed interfaces risk complete host compromise and lateral movement into corporate networks.
Sality, a 23-year-old P2P botnet, was taken down by coordinated law enforcement. Its decentralized design made it resilient to past attempts, but it's unclear if this takedown is permanent.
Attackers manipulated BGP routing to intercept Virtualizor VPS management software updates, redirecting traffic to malicious servers and delivering malware as legitimate patches. This routing-layer attack bypassed traditional security boundaries, requiring no repository compromise or vendor infiltra
JFrog Artifactory's critical authentication bypass (CVE-2026-82329) allows unauthenticated attackers to mint admin tokens and inject malicious packages into software repositories. Actively exploited in the wild, the flaw poses severe supply chain compromise risks across enterprises relying on self-h
Attackers exploit legitimate residential proxies to bypass security filters that trust home ISP addresses. The malice is behavioral, not infrastructural—IP-based edge security can't detect this threat.
CVE-2026-0768, a critical unauthenticated RCE flaw in Langflow, is being actively exploited to steal API credentials like OpenAI keys and AWS tokens from exposed developer instances.
Nearly 22,000 unpatched Exchange servers remain vulnerable to a known authentication bypass giving attackers full mailbox access without credentials. This reflects persistent patch fatigue and enterprise security failures to apply available updates.
Two critical flaws enable attackers to compromise Langflow instances and probe downstream credentials, revealing a sophisticated long-term persistence strategy rather than immediate data theft.
Microsoft Exchange Online crashed for hours, disrupting email, Teams, and authentication globally. The dual-layer infrastructure failure cascaded broadly, creating helpdesk chaos that persisted beyond recovery.
North Korea's fake employee operation has expanded from tech roles into sales, marketing, and healthcare positions, generating hundreds of millions for Pyongyang through weaker vetting standards in non-technical jobs.
An attacker drained $74M from Tectonic via oracle price manipulation, inflating collateral values to borrow excessively. This four-year-old attack pattern continues unabated in DeFi lending protocols.
PaperCut NG/MF zero-day flaws were weaponized for data theft before patches were available, leaving organizations minimal time to defend. This repeats 2023's critical vulnerability that was similarly exploited by ransomware gangs and mass attackers.
TerminalFix impersonates Cloudflare CAPTCHAs to trick users into pasting malicious code into Windows Terminal, establishing backdoor access. This ClickFix evolution preys on user trust in ubiquitous verification screens and the perceived legitimacy of developer tools.
Windows 11's KB5120998 patch silently resets mouse settings. Accessibility users are especially harmed. This exemplifies a troubling Microsoft pattern of updates with unintended consequences.
Two Nigerians face US charges for sextortion schemes linked to teen deaths. Networks lure minors into sharing explicit photos, then blackmail them for money, exploiting adolescent vulnerability to shame.
PaperCut's second emergency patch indicates attackers bypassed the first fix. The print management software is a favored entry point into hospitals, universities, and government networks for lateral movement.
Anthropic cut Claude Code limits 17% with minimal notice. For security teams integrating AI into their CI/CD pipelines, the surprise throttle disrupts SLAs and exposes vendor lock-in risks.