Archive
All articles, newest first. Page 26.
With $500 and Claude, Researchers Cloned a PLC Exploit From One Model to Another
Forescout Vedere Labs researchers used Anthropic Claude to port an RCE exploit from one WAGO PLC model to another in the same family,…
CVE-2026-0768: Active Exploitation of Langflow, 360+ Attacks in Hours
The Langflow AI platform is under massive exploitation: over 360 attempts detected in hours leveraging critical vulnerability CVE-2026…
Honeypot Confirms Active Exploitation of Sangoma Switchvox RCE
CVE-2026-9586 affects roughly 4,000 internet-exposed Switchvox systems. Defused Cyber honeypots recorded in-the-wild exploitation with…
JFrog Artifactory Authentication Bug Exposes Supply Chain, Zeroes Defenses
CVE-2026-82329 hits JFrog Artifactory with a CVSS 9.8: an authentication bypass granting admin privileges.
Cronos Restarts With Rollback: $74M DeFi Exploit, $6M Unrecoverable on Ethereum
The Cronos blockchain erased two hours of history via an emergency rollback after a price-manipulation attack on the Tectonic protocol…
HardBreacher Breaches the Kaspersky Perimeter: When the Protector Becomes the Gatekeeper
Nightmare Eclipse releases HardBreacher, a proof-of-concept exploit that turns the Kaspersky UI process into a privilege escalation ve…
Check Point Unveils Pipeline That Reads JSCeal Without Executing It
Check Point Research has released an open-source toolkit for statically deobfuscating JSCeal payloads on V8 bytecode. The pipeline suc…
ValleyRAT Backdoor Hides in Signed Adware, Bypasses AV via DLL Sideloading
The Silver Fox group is distributing the ValleyRAT backdoor — also known as Winos 4.0 — packaged inside QN Wallpaper, a legitimate, di…
From 8.7 Million Emails to 86 GB of Data: The Weekend FulcrumSec Rewrote the Manchester Airports Breach
On August 27, 2026, Manchester Airports Group (MAG) disclosed a breach affecting roughly 8.7 million customers, stating the vast major…
Spring Ring: The Teams Vishing Campaign That Jumps From Chat to Domain in Minutes
From January to April 2026, the Spring Ring campaign impersonated IT help desk staff on Microsoft Teams to trick employees into runnin…
Russian Hackers of UAC-0099 Weaponize AI Guardrails as Evasion Tactic
On August 31, 2026, ESET disclosed an evasion technique: UAC-0099 hackers, a Russian group affiliated with the GRU, embed nuclear weap…
Infostealer on Attacker Workstation Exposes Blind Eagle Campaign
An information stealer infection on a suspected threat actor's workstation has laid bare the full infrastructure of a phishing campaig…
KEV Beats CVSS: The Framework CISOs Use When Scores Lie
On August 31, 2026, vulnerability prioritization gained an official decision framework: CISA BOD 26-04 mandates four scoring variables…
Attacker's Own Infostealer Infection Exposes Full Arsenal of Colombian Blind Eagle Campaign
A consumer infostealer accidentally infected a threat actor's workstation, leaking browser history, local folders, credentials, and a…
AI AppSec: Scanners Agree on Just 5%, Triage Costs $128,000
Contrast Security's AppSec Overflow 2026 report reveals three AI scanners testing the same codebase agree on only 5% of findings, whil…
CSN ICT 2026 Report: Mediterranean Commercial Fleets Operating Under Digital Siege
The CSN ICT 2026 report finds Cyprus and Greece commercial fleets under sustained digital assault. Maritime cyber incidents doubled in…
PaperCut Issues Back-to-Back Emergency Patches for Actively Exploited Zero-Days
PaperCut released two emergency patches within 24 hours for CVE-2026-81578 and CVE-2026-82078. The first patch was bypassed, leaving t…
Beacon CRM Breached, Robert Burns Trust Warns Donors: The Risk
A cyberattack on Beacon CRM, a SaaS provider for the non-profit sector, exposed contact data for over 1,000 organizations. The Robert…
DOJ Corrects Record: NASA and Senate Were QTFY Targets, Not Victims
The U.S. Department of Justice revised its August 26 statement on August 29, 2026, clarifying that NASA, the U.S. Senate, and the Fede…
TheHatman and the 3.6 Million Azure Records: The Gap Between Claim and Confirmation
Threat actor TheHatman listed roughly 3.6 million records from the Azure directories of nine corporations for sale. Three companies de…
CareCloud Breach Exposes 3.75 Million Patient Records: The B2B Model Hides the Victims
CareCloud confirmed in March that an unauthorized actor accessed an AWS environment for six days, compromising 3,756,469 individuals.…
Rhysida Hits Berlin Government: Data Auction Launched, Ransom Refused
The Rhysida ransomware group claimed responsibility for a cyberattack on the Berlin state government on August 28, 2026, auctioning 5.…
ATF Confirms 'Major Incident' Without Confirming Who Caused It
The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed the breach of a standalone system but stopped short of attributing i…
TA4922 Launches PackClient Campaigns in Asia: Modular RAT Bought on Telegram
Chinese threat group TA4922 deployed the PackClient RAT framework across China and India via tax-themed phishing between May and July…