ls ./category/security --page 6
Breaches, vulnerabilities, malware and the patches that matter.
CVE-2026-45659 was patched in May, flagged as exploited on 1 July with a three-day federal deadline, and marked as used in ransomware on 11 August. Of 8,500 SharePoint servers exposed online, 200-plus remain vulnerable.
The annotation feature opens a direct channel between viewers and the person sharing. A Security's 'Zoomsday' chain starts with a missing bound check in the text annotator and ends in remote code execution.
Flight 591 out of Las Vegas carried 199 passengers and a network called 'Delta WiFi Fast' that served a page harvesting Google logins. Crew killed the Wi-Fi for 30 minutes; federal officers boarded on landing.
QUIRSO traced exploitation of CVE-2026-59310 across 47 countries, with victims first contacting attacker infrastructure on 3 August. The persistence mechanism is a cron job running an open-source reverse SSH tool.
Microsoft's analysis describes two Polygon wallet addresses holding proxy URLs and leak-blog posts, with negotiation over Session. There is no hosting provider to serve, because there is no hosting.
Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.
Microsoft attributes StormEncryptor, a new C++ locker, to the China-linked group. Initial access was likely CVE-2026-18577 in N-able N-central, which is itself a bypass of the earlier fix. CISA has both flagged as exploited.
Attackers took credentials for a DigitalOcean Spaces bucket that BdThemes' promotional banner fetches JSON from. The plugin source stayed clean. Every admin page load ran the attacker's JavaScript anyway.
51 victims since April 2025, mostly outside North America, exploiting a 2024 Schneider Electric flaw and a 2025 Fortinet one. The advisory is worth reading for what it says about which patches actually matter.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.
CERT Polska's report on a December 2025 intrusion at a Polish CHP plant describes what it calls the first real-world use of a private APN as an attack path. The controller they landed on still had its default admin password.
A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.
Silent Push counts roughly three million dangling DNS records worldwide. In one exercise across 12,500 apex domains they isolated 16,000 dangling subdomains and automated the takeover of 4,000 of them. The worst outcome isn't defacement — it's session cookies.
Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026. Attackers used external Teams accounts and IT-themed personas to talk their way into remote access, then deployed a modular backdoor and, in at least three cases, Chaos ransomware.
Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
Volexity says a threat actor it tracks as UTA0533 is harvesting credentials from compromised SonicWall appliances, and researchers note INC Ransomware has picked up its pace since the start of August.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.
CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.