134 casos · pág. 2/7
Sansec warns that a maximum-severity flaw, CVE-2026-103849 (dubbed BlockStrap), in Magento Open Source and Adobe Commerce could allow attackers to execute arbitrary PHP code on store servers. No in-the-wild exploitation has been observed yet, but Sansec identified four potential attack paths in under 24 hours and expects mass exploitation…
Check Point Research reports active exploitation of two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Details leaked ahead of planned disclosure, and screenshots of a PHP2Shell attack tool are circulating. Since the leak, 10% of organizations worldwide have been "impacted", meanin…
Cisco disclosed a critical vulnerability, CVE-2026-76466 (CVSS v3.1 9.8), in the database service of Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated remote attacker with network access and the relevant cookies could execute arbitrary operating system commands as root. The flaw stems from the use of persistent c…
Patchstack reports a critical remote code execution vulnerability in PHP that is already being actively exploited after details leaked on October 20. Because the flaw sits in the language runtime, any PHP-based application on a vulnerable version is exposed, including WordPress, Drupal, Magento, Joomla and Laravel sites. Patchstack confir…
Yokai Research (Hakai Security) published an analysis and a public proof-of-concept for GHSA-f9x3-7vq9-cph6, a critical authentication bypass (CVSS v4 9.2) in the Laravel framework's built-in TokenGuard, which backs auth:api. The flaw was discovered by KIKOmanasijev and reported via the GitHub Security Advisory program. When the user tabl…
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These device…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
GreyNoise observed an increase in scanning and exploitation attempts against Digital Video Recorders (DVRs) in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products. GreyNoise…
CISA issued an alert on exploitation of critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, noting confirmed malicious activity involving at least some of them. The alert references Citrix bulletins for CVE-2026-107406, CVE-2026-88779 and CVE-2026-88771 through CVE-2026-88778. Because NetScaler updates can be …
Hacktron AI disclosed CVE-2026-1731, a critical (CVSS 9.9) pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). An unauthenticated remote attacker could run operating system commands in the context of the site user. Hacktron found the flaw through A…
On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensit…
Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
F5 Labs, using Efflux sensor telemetry, found that HTTP requests hitting its sensors rose from 5,125,557 in 2023 to 8,727,820 in 2024 (about 71%, or nearly 95% once normalized for sensor count). Most of the increase came from the BotPoke scanner, which looks for filenames associated with malware distribution sites. It was active mainly in…
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-…
F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2…
F5 Labs' January 2026 AI security roundup covers two attack developments: the Persona Bullying jailbreak and a critical LangChain serialization injection vulnerability (CVE-2025-68664) reachable through prompt injection. Persona Bullying applies human social-engineering tactics such as gaslighting, ridicule and social pressure to LLMs con…
CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…
