Archive
All articles, newest first. Page 28.
AI Honeypot: Real Attacks on LiteLLM and MCP Servers Reveal Three Patterns
Wiz Threat Research deployed AI/ML honeypots for 90 days and documented sustained, service-specific attacks. Three distinct patterns t…
Next.js: Two Critical RCE Patches Expose the Managed vs. Self-Hosted Protection Gap
Vercel released critical patches for two unauthenticated RCE vulnerabilities in Next.js on August 25, 2026. The disparity in protectio…
PaperCut: Active Zero-Day Exploitation Confirmed Across All NG and MF Versions
PaperCut Software confirmed on August 27, 2026, that an undisclosed vulnerability affecting all versions of PaperCut NG and PaperCut M…
VCS Blind Spot: Wiz CIRT Publishes DFIR Matrix for GitHub and GitLab
The Wiz CIRT DFIR poster maps VCS audit logs to MITRE ATT&CK but exposes critical gaps: 88% of customers use SaaS with 7-day retention…
CISA Adds Six CVEs to KEV: From Citrix RCE to SQL Server with Seven Years of Attacks
On August 26, 2026, CISA added six vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, triggering Binding Operationa…
ATF Confirms Qilin Breach: Isolated System, No Data Theft Confirmed
The ATF confirmed a major cybersecurity incident on August 26, 2026, involving a standalone system containing investigative target inf…
Spark RAT Campaign Targets Cambodia with BYOVD and Localized Lures to Disable EDR
An unattributed threat cluster targeted individuals and organizations in Cambodia from late June through early August 2026 using a mul…
ShinyHunters Inflates Carhartt Breach with Synthetic Data, but Real Count Is 12.9 Million
ShinyHunters published 50 GB of Carhartt data after the company refused a $3.3 million ransom. Troy Hunt's OpenClaw analysis exposed t…
ICS Isn't Safer — Just More Selective. Biometric Sector Remains Top Target
In Q2 2026, the global share of ICS computers with blocked malicious objects fell to 19.15%, the lowest since 2022. Yet the biometric…
Dark Caracal Integrates Ethereum Into Its Kill Chain: C2 Tactics Shift
August 27, 2026 — The Dark Caracal APT group has embedded Ethereum smart contracts into its GoCaracal malware framework as a fallback…
GPUThor Bypasses NVIDIA ECC: Root Escalation in 1.1 Minutes on Workstation GPUs
The new GPUThor Rowhammer attack defeats SECDED ECC protection on NVIDIA Ampere RTX A4000-A6000 workstation cards. No patch is availab…
Chrome 152 Patches 327 Vulnerabilities, Including Sandbox-Escape RCE
Google released Chrome 152.0.7977.64/.65 on August 26, 2026, with a record 327 security fixes — 10 rated critical. CVE-2026-79282, a u…
Hugging Face Kubernetes AI Agent Intrusion
Qualys mapped the stages of an autonomous AI agent's multi-day intrusion against Hugging Face's Kubernetes environment on July 9, 2026…
CareCloud Breach Balloons to 3.7 Million Victims: A Lesson in Regulatory Reporting Gaps
The CareCloud breach has surged from 350,000 to 3.75 million victims in five months, exposing how healthcare regulatory reporting can…
Kaltura Unpatched: RCE and File Read in mwEmbed, No Fix for Five Months
CERT/CC disclosed two critical unpatched vulnerabilities in Kaltura's mwEmbed library enabling remote code execution and arbitrary fil…
Satanic Exposes 1,033 Stripe API Keys: The Vector Isn't an Infostealer
Threat actor Satanic released data from 669 Stripe vendors with live API keys. Analysis rules out infostealer infections and points to…
Mirage2FA: AiTM Phishing Kit Hits 3,500 Organizations, Bypasses MFA on Microsoft 365
The Mirage2FA phishing-as-a-service kit, operated by LinX Coders, has targeted over 3,500 organizations using Adversary-in-the-Middle…
Active Attacks on miniOrange: When Vendor Silence Becomes a Weapon
Threat actors are actively exploiting two vulnerabilities in the miniOrange SAML 2.0 SSO plugin for WordPress to bypass authentication…
Gitea CVE-2026-60004: Real-World Victim Reports CPU Spike and Dropper
A Russian sysadmin documented an attack on their self-hosted Gitea instance via CVE-2026-60004. Hosting provider HOSTKEY flagged susta…
First Car Head Unit Malware Discovered: Vehicles Recruited into Proxy Botnet
Kaspersky has identified the first malware with a dedicated infection chain for Android automotive head units. It exploits the privile…
LiteSpeed cPanel Plugin: CVSS 10.0 Flaw Patched in Three Rounds
CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities catalog on May 26, 2026, giving federal agencies a three-day remediat…
Citrix NetScaler: CVE-2026-19490, Critical Authentication Bypass with CVSS 9.3
Citrix has released patches for CVE-2026-19490, a critical authentication bypass in NetScaler ADC/Gateway carrying a CVSS 9.3 score. T…
NSA and CISA Issue First Alert on AI-Driven Attacks Against Critical Siemens PLCs
Five U.S. federal agencies have released joint advisory AA26-231A confirming threat actors are using AI-generated scripts to target in…
Unisoc VoLTE Exploit Chain Opens Android Kernel via Modem — No Patch, No CVE
A two-stage exploit chain in Unisoc VoLTE modems lets an attacker with a rogue 4G network achieve full Android kernel access when the…