13 casos · pág. 1/1
Gcore is offering its WAAP Enterprise plan free to government bodies and public agencies until December 31, 2026. The offer follows the php2shell vulnerabilities, which forced public websites offline across Europe this week. Government portals in the Netherlands, Finland, Denmark and France, along with hospitals, schools and commercial si…
GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for GitLab CE/EE on October 21, 2026. The release fixes CVE-2026-110264, an integer overflow in the regular expression compiler that could allow an unauthenticated user to execute arbitrary code on the GitLab server (CVSS 10.0). It affects…
Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (fieldui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not…
Cisco disclosed a critical vulnerability, CVE-2026-76466 (CVSS v3.1 9.8), in the database service of Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated remote attacker with network access and the relevant cookies could execute arbitrary operating system commands as root. The flaw stems from the use of persistent c…
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…
Horizon3.ai has released a public proof-of-concept exploit for CVE-2026-106173, a critical flaw in Fortinet FortiSIEM that lets unauthenticated attackers turn an arbitrary file write into remote code execution. Researcher Zach Hanley published the technical analysis on October 20, following Fortinet's advisory FG-IR-26-180 of October 13. …
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
Sekoia observed an attacker interacting with an exposed Flowise AI orchestration honeypot (emulating version 2.2.8) in late August 2026. The operator enumerated chatflows and stored credentials, tried to create a rogue workflow, and used prompt injection to turn the agent into an offensive analysis assistant. Sekoia assesses the activity …
A Chinese-speaking threat operator combined the agentic penetration-testing framework ARTEX with Claude Code, Codex and configurations requesting DeepSeek, GLM and Grok models to coordinate attacks on organizations worldwide. Recovered prompts dated August 4 to October 4, 2026 referenced targets in financial services, cryptocurrency, reta…
Group-IB research describes a widespread campaign by an operator tracked as k0t that targets FortiGate, FortiWeb and Palo Alto GlobalProtect appliances to steal credentials, persist and exfiltrate corporate data. More than 70,000 exposed credentials were identified across network-device records, LDAP dumps and other artifacts. Many FortiG…
Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that allows unauthenticated, zero-click compromise of internet-facing email servers. Attackers deployed webshells, escalated privileges, harvested authentication secrets and staged mailbox data across organiz…
SOCRadar's Threat Research Unit (STRU) found open directories on 45.227.254.43 in late September 2026. They led to six more adversary servers tied to INC Ransom and The Gentlemen affiliates. The servers held 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor build…
Symantec reports that the Russia-linked APT28 (aka Swallowtail, Fancy Bear, Forest Blizzard, BlueDelta), which the U.S. government links to the GRU, targeted organizations in two NATO member states. Victims were a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency (thehackernews.com, cyberscoop.com…
