Cyber CrimeDarkSword Kit Grows a Wallet-Stealing Arm
A new P7 DarkSword variant trims its on-device footprint while adding keychain theft, crypto-wallet extraction, and two-way command control.
> Search
30 results for “exploit”
Cyber Crime
SecurityCISA Sets October 11 Patch Deadline
Five Flax Typhoon–exploited flaws join CISA's KEV catalog as federal agencies face an October 11, 2026, patch-or-discontinue deadline.
Cyber CrimeUnpatched AhsayCBS Bugs Exploited as Zero-Days
Attackers are chaining two unpatched AhsayCBS vulnerabilities to gain remote code execution and deploy webshells, with at least five organizations targeted.
SecurityPwn2Own Ireland Day One Yields 32 Zero-Days
Researchers exploited 32 zero-days at Pwn2Own Ireland 2026, targeting phones, printers, smart home hubs and AI infrastructure for $388,500.
Cyber CrimeClingSTUN Backdoor Turns Linux Hosts Into Proxies
FortiGuard Labs details a Linux backdoor that abuses public STUN servers, exploits two dozen flaws, and self-propagates across routers.
Cyber CrimeRCE flaw in Rejetto HFS now exploited
Attackers are exploiting CVE-2026-61500 in Rejetto HFS to bypass authentication and gain remote code execution, according to VulnCheck.
SecurityNetScaler Zero-Day Poses Patching Puzzle
Citrix rushed out emergency updates for a SAML authentication flaw already exploited in attacks, but administrators may need to patch twice.
SecurityFortra BoKS Patches Fix Critical Auth Bypass
Fortra fixed eight bugs in BoKS, including a 9.9-severity auth bypass and a 9.1 command injection, but reported no known exploitation.
Cyber CrimeWarlock Hits SharePoint, Then Strikes
Symantec says the China-linked group behind Warlock ransomware disabled defenses on dozens of hosts within hours of exploiting SharePoint flaws.
Cyber CrimeFrontline Education breach hits school staff
Edtech vendor Frontline Education says attackers exploited a third-party software flaw to access employee data including Social Security numbers.
Cyber CrimeFortinet Zero-Day Hits FortiMail Gateways
Fortinet reports active exploitation of a critical FortiMail flaw, with patches still pending and CISA ordering federal fixes by October 4th.
Cyber CrimeDIVD breach linked to agentic AI attack
Dutch bug-hunting nonprofit says AI agents exploited Zammad zero-days, stealing researcher emails in seconds.
SecurityZimbra Flaw Exploited Before Disclosure
Microsoft says attackers probed and exploited a Zimbra command injection flaw in the window between patch release and public disclosure.
Cyber CrimeNetScaler Flaw Weaponized for Deep Access
LevelBlue says attackers exploited a critical NetScaler bug to plant web shells, create superuser accounts, and exfiltrate configuration data.
Cyber CrimeZimbra Bug Exploited for Mailbox Theft
Microsoft says attackers chained a patched Zimbra command-injection flaw into web shells, credential theft and cloud exfiltration.
SecurityAI-Discovered Flaws Skew Toward RCE
Google's threat intelligence unit reports AI-found vulnerabilities are far more likely to enable remote code execution than other disclosed flaws.
SecurityTeen's Auth Flaw Opened Titan's Data Vault
A 16-year-old researcher bypassed Microsoft's Titan analytics by exploiting an unverified JWT and was paid a $5,000 bounty.
SecurityGoogle: AI Is Rewriting Bug Economics
GTIG data shows vulnerability disclosures doubled in 2026 while exploitation shifted toward n-days, with AI-discovered flaws carrying a riskier profile.
SecurityF5 zero-day hits BIG-IP APM deployments
F5 patched a critical BIG-IP APM zero-day exploited in remote code execution attacks, as CISA ordered federal agencies to secure networks by Friday.
SecurityCheck Point Zero-Day Hit Management Servers
Attackers exploited a management server flaw in July while a separate VPN bug now draws ongoing attempts against small-business firewalls.
SecurityArista VeloCloud Flaw Exploited, Scores 10.0
Arista says attackers are actively exploiting CVE-2026-93952, a maximum-severity flaw in on-premises VeloCloud Orchestrator setups using certificate authentication.
Cyber CrimeDefender zero-day halts antivirus updates
A researcher's new Windows Defender zero-day prevents signature and platform updates, the latest in a string of exploits tied to a dispute with Microsoft.
SecurityCISA Ends Weekly Vulnerability Bulletin
CISA will stop publishing its weekly known-vulnerabilities bulletin from September 28, citing a new risk-based patching directive.
SecurityAI-Crafted Exploit Chain Hit OpenAI Code
Researchers chained an ImageMagick flaw with an OpenAI sign-in issue to reach internal code, earning a bounty.
SecurityFour Kernel Flaws, Public Exploits, One Fix
A researcher published working local-root exploits for four Linux kernel bugs fixed weeks earlier, flagging a patching race for older systems.
SecurityCisco ISE Zero-Day Under Attack
Cisco has fixed a maximum-severity ISE authentication bypass that attackers are already exploiting, and CISA set a three-day federal patch deadline.
AI & MLSpain logs first AI-agent breach
Spain's data protection agency says an autonomous AI agent chained scans, an exploit, and data tampering in a company breach.
SecurityScreenConnect Flaw Under Attack, Patch Urged
CISA orders federal agencies to fix a critical ConnectWise ScreenConnect flaw exploited in the wild, with over 1,000 instances still exposed.
SecurityWooCommerce Plugin Flaw Fuels Web Shell Attacks
Attackers are exploiting a critical WooCommerce Wholesale Lead Capture vulnerability to upload PHP web shells and achieve remote code execution.
SecurityPixel Zero-Day Patched After Targeted Attacks
Google's September 2026 Pixel update fixes 110 flaws, including a modem zero-day exploited in limited, targeted attacks.