SecurityZimbra Flaw Exploited Before Disclosure
Microsoft says attackers probed and exploited a Zimbra command injection flaw in the window between patch release and public disclosure.
> Search
30 results for “code”
Security
SecurityAI-Discovered Flaws Skew Toward RCE
Google's threat intelligence unit reports AI-found vulnerabilities are far more likely to enable remote code execution than other disclosed flaws.
SecurityWatchGuard Patches 15 Fireware OS Flaws
WatchGuard fixed a critical Fireware OS code injection flaw and 13 high-severity bugs, plus three Access Point vulnerabilities disclosed a day earlier.
SecurityF5 zero-day hits BIG-IP APM deployments
F5 patched a critical BIG-IP APM zero-day exploited in remote code execution attacks, as CISA ordered federal agencies to secure networks by Friday.
SecurityWordPress 7.1.2 Patches Critical LFI-to-RCE Flaw
WordPress fixed a critical flaw in versions 4.7.0 through 7.1.1 that can lead to code execution on servers lacking a page-prefixed theme folder and register_argc_argv off.
Cyber CrimeMicrosoft Cuts Off AI Phishing Platform
Microsoft and partners disrupted EvilTokens, an AI-assisted phishing service that compromised 12,000 accounts, seizing domains and prompting arrests.
Cyber CrimeEvilTokens Takedown Nets Two Arrests in UK
Microsoft-led coalition seizes 50 phishing sites and disables 150 domains tied to an AI-enabled service that compromised 12,000 inboxes.
Cyber CrimeCopycat ClickFix Kit Built on Rival's Code
Sekoia says the Exvicy framework reuses ErrTraffic's code and has been spotted delivering malware via compromised WordPress sites.
Cyber CrimeCrowdSec Ties Code Theft to TanStack Flaw
CrowdSec says about 300 repositories were hit and links the theft to a May 2026 TanStack supply chain attack.
SecurityAI-Crafted Exploit Chain Hit OpenAI Code
Researchers chained an ImageMagick flaw with an OpenAI sign-in issue to reach internal code, earning a bounty.
SecurityClick2Shell Turns Admin Clicks Into Theme Installs
A new WordPress core flaw lets a crafted link silently install a theme, and researchers chained it to full code execution.
Cyber CrimePlugin4Shell Exposes AI Coding Agents to RCE
A zero-click remote code execution flaw in popular AI coding agents could let attackers run malicious code without developer interaction, researchers warn.
Cyber CrimeGhostCode Phishing Kit Bypasses MFA
A new phishing kit abuses Microsoft's device-code flow to bypass MFA and establish persistent access to Microsoft 365 environments.
SecurityDocker Fixes macOS Sandbox Escape Flaws
Two Docker Sandboxes vulnerabilities let malicious guest code read or modify macOS host files, with fixes shipped in version 0.42.0.
Cyber CrimeBrevo Breach Turns CDN Edge Into Attack Path
A hardcoded Cloudflare key let attackers rewrite Brevo's sites and customer scripts for hours, pushing ClickFix malware at scale.
SecurityUnbound DNSSEC Flaw Opens RCE Path
A heap overflow in Unbound's DNSSEC validator lets attackers who control a malicious DNS zone trigger remote code execution on vulnerable resolvers.
SecurityWooCommerce Plugin Flaw Fuels Web Shell Attacks
Attackers are exploiting a critical WooCommerce Wholesale Lead Capture vulnerability to upload PHP web shells and achieve remote code execution.
Cyber CrimeSwiss Court Jails Ransomware Coder 12 Years
A Zurich court found the 52-year-old Ukrainian developer built LockerGoga, MegaCortex, and Nefilim, though not as the operations' mastermind.
Cyber CrimeCisco Email Gateway Flaw Under Attack
Cisco warns CVE-2026-76461, a CVSS 9.8 flaw in Secure Email Gateway, is being exploited to run commands as root, with a federal patch deadline of September 17.
AI & MLMicrosoft Drafts AI Rules for Cyber Defense
A new draft code of conduct would block its MAI models from generating working exploit code while opening a review track for defensive security work.
SecurityMarimo RCE Hit by Human at Machine Speed
Sysdig says a hand-built toolkit let a human operator exploit a Marimo flaw in eight seconds, without any sign of LLM use.
SecurityA £3 Wi-Fi Extender Hides Secret Admin Access
Security researcher finds a hardcoded admin account in a Temu-bought Wi-Fi extender, giving remote attackers full control.
Cyber CrimePasskey phishing opens M365 data theft playbook
Microsoft ties passkey-themed social engineering to extortion gangs that blend into Microsoft 365 traffic to steal files and email.
SecurityCheck Point's Patch Gap Leaves VPN Flaws Exposed
Two 9.8-rated certificate flaws in Check Point gateways carry fixes that some customers say they cannot access.
SecurityAndroid's Patch Flood Returns After Quiet Summer
Google's September 2026 Android updates fix 180 vulnerabilities, including 26 critical flaws, after two consecutive bulletins with no security fixes.
SecurityIvanti's Patch Cascade: Critical RCE Flaws Resolved
Ivanti addresses critical and high-severity vulnerabilities across Neurons for ITSM, Sentry, and EPMM, urging immediate updates.
Cyber CrimePhishing expands ASCII smuggling beyond AI
Microsoft finds invisible Unicode tags used to hide financial-lure words in a massive email phishing campaign.
SecurityVMware patches critical host-code execution flaw
Broadcom patched one critical and one high-severity VMware Workstation and Fusion vulnerability, both enabling host code execution.
Cyber CrimeUnicode Trick Fuels Million-Email Phishing Surge
A campaign hides 'funding' lure words with invisible Unicode tags, splitting keywords to slip past filters.
SecurityPostgreSQL backup accounts open 12-year backdoor
A 12-year-old PostgreSQL flaw lets low-privilege replication accounts gain superuser access and remote code execution across platforms.