15 casos · pág. 1/1
Rank Math reported a security incident in which its premium Rank Math PRO WordPress plugin, version 3.0.123, was distributed with malware. Sites are at risk if administrators activated the compromised version. The affected download window ran from October 15, 2023 20:02 UTC to October 16, 2023 07:12 UTC (dates as stated in the article), a…
OVHcloud disclosed a supply-chain attack on its command-line interface (CLI) repository on GitHub. An attacker used a compromised developer's GitHub account to insert a malicious binary designed to retrieve secrets from users' disks. CEO Octave Klaba confirmed the incident on 19 October 2026 after a customer report. The compromised releas…
GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on comprom…
A threat actor calling itself Siriusim allegedly leaked customer information and documents tied to the State Bank of India (SBI), according to a CyberPulse post dated October 16, 2026. The claimed dataset has 375,000 CSV rows and 2,722 PDF documents. Its authenticity, origin and scope are unverified, and the row count does not equal the n…
OpenCode disclosed on X on October 17 a security breach affecting 1.4% of its Console users, which it attributes to a "large-scale distillation attack". The affected accounts belong to users who had connected external providers. The company emailed affected users the following morning and says anyone who did not receive a notice was not i…
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
Microsoft awarded researcher Sam Chen (Samchen) US$4,000 for reporting CVE-2026-81376, a critical (CVSS 3.1 score 9.6) Workspace Trust security feature bypass in Visual Studio Code versions before 1.136.2. A specially prepared workspace could connect to an attacker-controlled service and bypass Restricted Mode, potentially exposing local …
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…
Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications …
Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that allows unauthenticated, zero-click compromise of internet-facing email servers. Attackers deployed webshells, escalated privileges, harvested authentication secrets and staged mailbox data across organiz…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
Federal investigators examining ShinyHunters have uncovered potential links between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. An executive at an unnamed U.S. consulting firm (reportedly 1,000+ employees) allegedly helped operate the group's extort…
Researcher Quentin Kaiser (QTNKSR) disclosed a memory corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It allows an unauthenticated attacker within wireless range to disclose memory and execute code, including as root, on vulnerable routers. The attacker does not need the Wi-Fi password, network membership or a co…
