8 casos · pág. 1/1
The FBI, CISA, NSA, EPA, DOE, CNMF and Treasury warn of ongoing exploitation of internet-exposed PLCs by an Iranian-affiliated APT group, with activity observed since at least March 2026. Targets are Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens PLCs in the Government Services and Facilities, Water and Wastewater Syste…
F5 Labs, using Efflux sensor telemetry, analyzed December 2025 exploitation of React2Shell (CVE-2025-55182), a CVSS 10.0 unsafe deserialization RCE in React Server Components. It was disclosed on 3 December 2025 and rose to second place among the most exploited CVEs, behind only CVE-2017-9841. Within days of disclosure, actors moved from …
Cloudflare published defensive guidance following the disclosure of actively exploited Citrix NetScaler vulnerabilities. CVE-2026-88771 allows unauthenticated command execution on affected appliances, including in the default configuration. CVE-2026-88772 affects configurations using DTLS. Citrix's September 27, 2026 bulletin reported obs…
On October 21, attackers published a malicious LiteLLM version 1.107.0 to PyPI and Docker Hub. LiteLLM is a widely used open source proxy for routing requests across LLM providers. The packages were live for about three hours and were downloaded an estimated 49,000+ times before being removed or repointed to clean artifacts. They install …
On September 23, 2026, an attacker published malicious versions of @memtensor/memos-cloud-openclaw-plugin (npm, versions 0.1.21, 0.1.23 and 0.1.25 per the article) and the MemoryOS Python library (PyPI, 2.0.34). Both carry the same Go implant, sckit, which harvests credentials from the home directory, exfiltrates them to servers under sky…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
The LiteLLM release 1.107.0 (a widely used open source LLM proxy and AI gateway developed by BerriAI, about 23 million weekly downloads per theregister.com and gbhackers.com, or about 92 million monthly PyPI downloads per bleepingcomputer.com) was trojanized on PyPI on 21 October 2026 and carries a credential stealer (privcollect) plus a …
