News Archive
2287 stories · page 80 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
A critical vulnerability, tracked as CVE-2026-42533, has been reported in NGINX, a widely used web server and reverse proxy. This flaw is said to potentially enable remote attackers to crash worker processes and may, in certain configurations, lead to remote code execution. The vulnerability affects a broad range of NGINX versions, specifically from 0.9.6 up to 1.31.2.
Connecting AI agents to outside services explodes the risk radius
The integration of AI agents with third-party services through "connectors" significantly amplifies the security risks associated with AI models, according to a recent analysis by PromptArmor, an AI security firm. These connectors, which enable AI models like OpenAI's ChatGPT and Anthropic's Claude to interact with services such as Gmail or Slack, introduce a complex web of data flows and…
Scans for Hikvision Intelligent Security API, (Sun, Jul 19th)
Reports indicate a recent surge in internet-wide scanning activity targeting the Hikvision Intelligent Security API. This observed scanning behavior, detected by honeypot networks, suggests attackers are actively probing for vulnerable Hikvision devices exposed to the internet. The activity was specifically noted on Sunday, July 19th.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 106
Ernst & Young (EY) is investigating a potential data breach that reportedly involves third-party support tickets. The company has not yet confirmed the scope or nature of the incident, nor has it publicly identified the third-party vendor involved.
Security Affairs newsletter Round 586 by Pierluigi Paganini – INTERNATIONAL EDITION
SonicWall has issued a warning regarding the active exploitation of two zero-day vulnerabilities affecting its SMA 1000 series products. The company did not immediately disclose specific details about the nature of these vulnerabilities or the extent of the observed exploitation.
Hackers abuse ViPNet software to target Russian govt agencies
An advanced persistent threat (APT) group has been observed exploiting the update mechanism of the ViPNet private networking suite to target Russian government agencies and other organizations. The campaign, dubbed "HelloNet" by researchers, has been active since at least May, deploying a multi-stage malware payload that establishes persistence and acts as a loader for additional malicious…
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware
Russian state-sponsored threat actors, identified as UAC-0145, have reportedly been employing a technique dubbed "ClickFix CAPTCHAs" to compromise devices belonging to Ukrainian targets. This activity has led to the self-infection of machines with data-stealing malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has attributed this campaign to UAC-0145, further linking it to…
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
Reports indicate that a sophisticated threat actor, identified as UTA0533, has been actively exploiting two zero-day vulnerabilities within SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. These exploits were reportedly chained together to achieve arbitrary command execution and subsequently gain root access on affected systems. The exploitation occurred prior to the public…
Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs
Attackers are reportedly bypassing Microsoft Entra ID sign-in logs by spoofing OAuth client IDs during account enumeration against Microsoft cloud tenants. This technique involves manipulating the `client_id` parameter in authentication requests, which Entra ID records as the application ID. The way the system handles unfamiliar identifiers creates a blind spot that threat actors are…
Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits
Public exploits are now available for a pair of critical vulnerabilities in WordPress Core, which, when chained, allow attackers to achieve pre-authentication remote code execution on affected installations. The flaws, collectively dubbed "wp2shell," impact WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
7-Zip has released version 26.02 of its popular archiving utility to address a remote code execution (RCE) vulnerability. The flaw, which could allow attackers to execute malicious code, is triggered when users open specially crafted compressed files.
OpenSSL Vulnerability Allows Memory Exhaustion via 11-Byte Payload
A denial-of-service vulnerability, dubbed "HollowByte," has been discovered in OpenSSL that allows remote, unauthenticated attackers to exhaust server memory and trigger denial-of-service attacks using a specially crafted 11-byte payload. The flaw was disclosed by Okta's Red Team on July 18, 2026.
WordPress Core "wp2shell" RCE flaws get public exploits, patch now
Publicly available exploits have emerged for a pair of critical remote code execution (RCE) vulnerabilities in WordPress Core, collectively dubbed "wp2shell." These flaws, identified as CVE-2026-63030 and CVE-2026-60137, can be chained together to allow pre-authentication RCE on affected WordPress installations. Administrators are strongly advised to update their sites immediately.
Two High-Severity WordPress Vulnerabilities Require Immediate Patching
WordPress has released emergency security updates to address two high-severity vulnerabilities, including a critical SQL injection flaw that could lead to remote code execution. Users are urged to patch their installations immediately.
Microsoft Warns of Increased ACR Stealer Malware Attacks
Microsoft has issued a warning regarding a significant increase in attacks leveraging the ACR Stealer malware, which targets enterprise customers to pilfer browser-stored passwords, authentication tokens, and sensitive documents. The observed surge in activity occurred between late April and mid-June, with threat actors employing social engineering tactics, WebDAV servers, and the MSHTA…
China-Linked Daxin Malware Active on Manufacturer's Network Since 2013
Researchers have identified the China-linked Daxin rootkit and a previously unknown backdoor, dubbed Stupig, active on the network of a Taiwan-based subsidiary of a multinational high-tech manufacturer. The discovery suggests a highly stealthy intrusion that may have persisted undetected for 13 years, with compilation timestamps on both malware artifacts dating back to early 2013.
CISA Adds Fortinet and Microsoft Flaws to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to address them by July 19, 2026. The newly listed flaws include one affecting Microsoft SharePoint and two impacting Fortinet FortiSandbox products.
Your Period Tracker Is (Probably) Spying on You
A recent audit by the Mozilla Foundation, conducted in partnership with Harvard's Berkman Klein Center, has revealed significant privacy concerns with several popular period tracking applications, with one app, Stardust, scoring particularly low. The audit examined six widely used trackers, finding that most engaged in data sharing practices that could compromise user privacy.
Prompt Injection Attacks Disrupt AI Hacking Agents
Researchers at Tracebit have developed a new defensive technique, dubbed "context bombing," that utilizes prompt injection attacks to disrupt malicious AI hacking agents. This method involves embedding specific, forbidden commands alongside sensitive data within a target environment, causing attacking large language models (LLMs) to shut down before they can inflict harm.
North Korean hackers use fake coding interviews to steal developer credentials
North Korean state-sponsored hackers are employing a sophisticated new tactic, dubbed "Contagious Interview," to compromise developers by embedding malware within seemingly benign coding challenges. The campaign, tracked as REF9403, leverages steganography to hide multi-stage payloads within SVG image files, which have gone undetected by all major antivirus vendors.
Gemini AI Flaw Lets Strangers Message From Locked Android Phones
A newly identified vulnerability in Google's Gemini AI assistant allows unauthorized individuals with physical access to a locked Android 16 smartphone to send messages via SMS and WhatsApp without needing to enter the device's security PIN. Google has confirmed awareness of the issue and stated that a fix is scheduled for release this week.
Critical RCE Vulnerability in WordPress Core Affects Millions of Sites
A critical unauthenticated remote code execution vulnerability, identified as CVE-2026-63030, has been discovered in WordPress Core, affecting millions of websites globally. The vulnerability allows an attacker to execute arbitrary code without authentication through the WordPress REST API batch endpoint, potentially leading to a complete compromise of the affected website and its data.
Ernst & Young Data Breach Linked to Compromised Third-Party Support System
Ernst & Young (EY), one of the "Big Four" professional services firms, has disclosed a data breach stemming from the compromise of a third-party IT support system. The incident, which EY detected on April 23, 2026, involved unauthorized access to a platform used by its IT teams to manage support requests for tax-related work.
Cloudflare WAF Shields WordPress From Critical RCE and SQL Injection Flaws
Cloudflare has confirmed that its Web Application Firewall (WAF) successfully mitigated attacks targeting two critical vulnerabilities in WordPress and its plugins. The vulnerabilities, identified as CVE-2023-50387 and CVE-2024-21724, could lead to remote code execution (RCE) and SQL injection, respectively.