/
ttps_attack:T1574.002 × criticity:critical × limpar

Resultados

2 casos · pág. 1/1

thehackernews.com · · 4 fontes · 5 atualizações critical

Plex2Shell: Plex Media Server exploit chain exploited within a day of PoC to drop XMRig and myawesomeproxy; CISA adds four CVEs to KEV

Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), on October 17, 2026. That was about a day after researcher Zach Main published a write-up and PoC on October 16. The chain gives unauthenticated remote code execution with the privilege…

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 government
thehackernews.com · critical

Compromised ConnectWise Cloud Backup (SkyKick) OAuth app credential used to access 173+ Microsoft 365 tenants

An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…

UNC7017 managed service providers legal