4 casos · pág. 1/1
Sansec warns that a maximum-severity flaw, CVE-2026-103849 (dubbed BlockStrap), in Magento Open Source and Adobe Commerce could allow attackers to execute arbitrary PHP code on store servers. No in-the-wild exploitation has been observed yet, but Sansec identified four potential attack paths in under 24 hours and expects mass exploitation…
Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the lar…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
