129 casos · pág. 1/7
CERT-FR advisory CERTFR-2026-AVI-1311 reports multiple vulnerabilities in Ivanti products, covering Connect Secure (ICS), Neurons for UEM and Xtraction. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality and integrity. Ivanti states that CVE-2026-104935 is bein…
A Chinese-speaking threat actor used AI agents coordinated through the open-source Cairn platform to attempt intrusions against more than 1,200 websites, reportedly compromising sites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the activity while monitoring internet-exposed…
Check Point researchers disclosed two high-risk vulnerabilities in LiteLLM, an open-source LLM gateway with almost 100,000 downloads a month. The gateway connects enterprise AI applications to providers such as OpenAI, Google and Anthropic. The flaws, CVE-2026-35029 and CVE-2026-59823, could let any user with an account on a vulnerable de…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
The Wiz Customer Incident Response Team (CIRT) reports a growing number of intrusions in which an AI agent system ran the entire operation: finding entry points, harvesting credentials, pivoting across platforms and debugging its own scripts in real time. In one investigated case, the agent compromised a large multi-cloud organization (GC…
Volexity published Part 3 of its "Mind the (Patch) Gap" series. It shows how Volexity Volcano and Surge Collect Pro were used to analyze a VM compromised with the zero-day exploit chain and payloads used by UTA0560 (Chrome and Windows zero-days, described in Part 1). The post is mainly product and workflow documentation rather than new in…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
Researchers at Horizon3.ai have published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM that lets an unauthenticated attacker achieve remote code execution through specially crafted packets. Fortinet patched the flaw last week. The public PoC lowers the barrier to exploitat…
Yokai Research (Hakai Security) published an analysis and a public proof-of-concept for GHSA-f9x3-7vq9-cph6, a critical authentication bypass (CVSS v4 9.2) in the Laravel framework's built-in TokenGuard, which backs auth:api. The flaw was discovered by KIKOmanasijev and reported via the GitHub Security Advisory program. When the user tabl…
Moody's Ratings published an analysis on October 19 warning that AI-driven cyberattacks could raise financial risk for organisations with weak security, because AI tools make attacks faster, more automated and more persistent. Earlier Moody's research from March, using Bitsight data on more than 9,000 Moody's-rated organisations, found th…
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into cat…
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…
Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that allows unauthenticated, zero-click compromise of internet-facing email servers. Attackers deployed webshells, escalated privileges, harvested authentication secrets and staged mailbox data across organiz…
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …
GreyNoise reports that on 14 May 2026 its Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure. Compared against eleven widely used OSINT and commercial feeds, average coverage was 2.0%, and no single feed exceeded 5%. Even the largest list (Avastel, about 500,000 IPs) caught under 2%, and ve…
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These device…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, w…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
