ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
A 296,000-device IoT botnet with AI capabilities routes command traffic through legitimate services (Google Forms, Discord, GitHub), making detection nearly impossible. The attack exploits the gap between what infrastructure appears to be and what it actually is, hiding threats in plain sight. ---
Vercel patched two critical Next.js RCE flaws: one in AVIF image processing, one on Windows. Both allow unauthenticated remote code execution, affecting millions of sites.
PaperCut, used by universities and hospitals globally to manage printers, faces active zero-day exploitation with no patch available yet. This is the second major attack cycle in three years, leaving organizations exposed while the company develops fixes.
Attackers move in 29 minutes; defenders take 75+ minutes per alert. Worse: 40% of organizations disable real security alerts due to staffing shortages, hiding threats instead of tuning false positives.
AI automates every phase of attacks—from vulnerability discovery to lateral movement—collapsing response windows that SOCs were designed around. The critical gap is operational: fragmented detection tools and siloed teams can't assemble unified context fast enough to respond at AI speed.
Threat research gives security teams insight into how attackers operate, while MDR turns that intelligence into faster detection and response. ESET explains how combining threat intelligence, continuous monitoring, and human expertise can help SMBs strengthen their defenses. [...]
Citrix NetScaler faces renewed active exploitation. As the critical edge appliance controlling enterprise authentication and remote access, it remains a repeat target—with 80,000+ instances publicly exposed—and the industry follows the same patch-and-repeat cycle.
Avada theme (900k+ sales) contains a critical zero-click RCE flaw. Unauthenticated attackers can execute remote code via HTTP requests, bypassing all traditional defenses like MFA.
**Summary:** Interpol's Operation Jackal IV targets West African cybercrime infrastructure rather than individuals, recognizing Black Axe as a criminal platform enabling fraud-as-a-service at scale.
NovaCookies is a $320/month phishing-as-a-service proxy that defeats MFA by intercepting Microsoft 365 logins. It captures the authenticated session cookie after victims complete MFA, giving attackers valid tokens to access accounts.
North Korean operatives infiltrate companies as fake remote IT workers, funneling salaries to weapons programs. With improving identities, they serve as both financial and espionage operations.
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, including Citrix NetScaler flaws that have remained unpatched for years despite active exploitation. The update exposes widespread enterprise vulnerability management failures, revealing that organizations routinely ignor
SharePoint Server has a publicly disclosed RCE exploit chain enabling unauthenticated code execution. With PoC code public, organizations face imminent risk as commodity actors weaponize the technique.
Meta pays $18B to settle teen mental health harm claims. The settlement's real significance: it creates a legal record proving Meta knowingly deployed addictive features despite internal warnings.
GPUThor breaks NVIDIA's ECC GPU protection via Rowhammer attacks, enabling root-level privilege escalation. This shatters the security assumptions that protected shared GPU datacenters.
NovaCookies exploits legitimate Docusign emails and Microsoft OAuth proxies to harvest credentials and MFA codes. This phishing kit, costing $320/month, targets hundreds of organizations undetected.
Kaltura's mwEmbed player has two unpatched vulnerabilities enabling unauthenticated file read and code execution via unsafe PHP deserialization, letting attackers access credentials and run commands.
CISA confirmed active Gitea vulnerability exploitation allowing code injection in self-hosted Git servers. This threatens CI/CD pipelines and production systems, creating critical supply-chain risk.
Windows 11 is testing granular permission controls for camera, microphone, and location—a decade after iOS and Android introduced them. This fixes a critical security gap where desktop apps previously had unrestricted hardware access at install time.
Ubiquiti patched three CVSS 10.0 vulnerabilities remotely exploitable without authentication. With millions of devices internet-exposed, they're trivial targets for attackers.
Invisible instructions in emails hijack AI summarizers into false outputs. Exploiting AI obedience rather than hallucination, it threatens Gmail, Outlook, and enterprise platforms.
Gitea CVE-2026-60004 is actively exploited; attackers inject malicious Git hooks via diffpatch API, gaining persistent CI/CD access. Patch to 1.27.1 by August 28—federal deadline, critical for all.
Nigeria's sovereign cloud initiative reduces foreign jurisdiction risks but introduces new security risks—domestic infrastructure may lack the expertise and resources of established hyperscalers, making the push a cybersecurity gamble masquerading as independence.
Gitea RCE (CVE-2026-60004) actively exploited with mining payloads, needing only repo write access. Mining deployment signals opportunistic mass exploitation preceding ransomware attacks.
NemoClaw's local AI models can be poisoned via hidden instructions in malicious webpages, silently altering behavior without user awareness—a serious security gap for enterprise inference.
TRACE is a new Linux Foundation attestation standard for verifying deployed AI models are authentic. It closes a gap in confidential computing: securing environments but not verifying model weights.
A DDoS attack crippled Norway's centralized government platform, disrupting dozens of citizen services. The attacker exploited consolidation's dark side: the efficiency-driven architecture designed to save costs created a single point of catastrophic failure.
Mirage2FA intercepted MFA codes from 4,500+ companies via proxy attacks, stealing authenticated sessions instead of trying to crack passwords. The phishing kit proves MFA alone is insufficient defense.
Marimo notebooks could execute attacker commands on open via MCP metadata injection (CVE-2026-75149) and steal API keys through URL hijacking (CVE-2026-67618). Both flaws bypassed cell-level protections by treating untrusted notebook metadata as trusted configuration.
PowerToys added app-scoped window switching for developers, but the tool runs with system-level access to keyboards and files—a security blind spot most enterprises ignore.