71 casos · pág. 3/4
AI pen-testing startup Terra Security reports a sharp rise in security fixes later found to be bypassed or incomplete. The share of GitHub security fixes needing a follow-up advisory for a failed patch within 90 days held near 0.2% from 2019 to 2025 but jumped to 2.3% in 2026. Terra links the trend to the 2026 explosion in AI-driven vulne…
GitLab released security patches for CVE-2026-110264, a maximum-severity integer overflow flaw in its Regular Expression Compiler that can let an unauthenticated remote attacker execute arbitrary code on vulnerable servers. The researcher joaxcar reported it through GitLab's HackerOne bug bounty program; theregister.com names the reporter…
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-…
This opinion-led recap of Black Hat USA 2026 reports that AI dominated the conference, both as a source of risk and as a driver of vulnerability discovery. In the opening keynotes, White House National Cyber Director Sean Cairncross argued that AI regulation would stifle innovation and struggle to keep pace. CISA's Acting Director Nick An…
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
A Flare analysis argues that Scattered Spider, LAPSUS$ and ShinyHunters are distinct intrusion clusters within The Com, a decentralized, mostly English-speaking cybercriminal subculture, and not interchangeable names for one group. It describes SP1D3R HUNTERS (also called Scattered LAPSUS$ Hunters, SLH) as a shared brand and coordination …
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
Cloudflare published defensive guidance following the disclosure of actively exploited Citrix NetScaler vulnerabilities. CVE-2026-88771 allows unauthenticated command execution on affected appliances, including in the default configuration. CVE-2026-88772 affects configurations using DTLS. Citrix's September 27, 2026 bulletin reported obs…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), on October 17, 2026. That was about a day after researcher Zach Main published a write-up on October 16, with a PoC following (bleepingcomputer.com dates the PoC to October 19, three da…
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
Microsoft released updates fixing more than 1,400 vulnerabilities in Windows and other software, far above September's record of nearly 1,000 fixes. Only one flaw is a confirmed zero-day exploited in the wild: CVE-2026-96951, a security feature bypass in Windows Shell affecting Windows 10, Windows 11 and some Windows Server versions. At l…
Sen. Ron Wyden sent a letter to CISA and the Office of Management and Budget (OMB) urging federal adoption of Encrypted Client Hello (ECH). ECH hides the name of the website a user visits from anyone monitoring network traffic. His office identified at least 350 federal sites that do not use ECH. Wyden warned that hackers and foreign adve…
F5 released NGINX 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026 to fix five vulnerabilities. Three are memory-corruption bugs that F5 scores 9.2 (Critical) on CVSS v4.0, and they can crash a worker process or, in some conditions, allow code execution. The others are a TLS session-ticket flaw that can bypass client-certificate …
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
The NSA, CISA, FBI, DOE and EPA issued a joint advisory (AA26-231A) warning of an active threat to Siemens S7 Series PLCs in U.S. critical infrastructure. Unattributed threat actors are conducting reconnaissance and capability development against U.S.-based installations using AI-generated exploitation scripts disguised as legitimate OT m…
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
Unknown attackers compromised thousands of internet-exposed refrigeration controllers late on Sunday, raising temperatures to as high as 122°F (50°C), spoiling food and causing fires at nearly 700 French supermarkets. France's ANSSI warned of widespread compromises of Danfoss controllers and a day later added Copeland and its Dixell brand…
