Intelligence Feed

1mo ago · bleeping-computer

Attackers are actively exploiting a critical authentication bypass vulnerability in Citrix NetScaler appliances, tracked as CVE-2026-19490, which allows unprivileged remote actors to bypass authentication when the appliance is configured as an AAA virtual server or Gateway. Exploitation attempts have been observed from multiple IP addresses geolocated to Australia, the United States, and Germany, following the release of a public proof-of-concept. The Centre for Cybersecurity Belgium and vulnerability intelligence firm Previdian have issued warnings urging administrators to patch affected systems immediately.

1mo ago · bleeping-computer

Google has patched a high-severity zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, identified as CVE-2026-85046, which is being actively exploited in the wild. The flaw is a type confusion issue that could allow remote code execution if a user visits a specially crafted webpage containing malicious JavaScript. Google has not disclosed specific exploitation details to allow time for users to update. Chrome users are urged to update to version 152.0.7977.82 or later to mitigate the risk. This is the sixth actively exploited Chrome zero-day fixed by Google in 2026.

1mo ago · bleeping-computer

An anonymous security researcher known as Nightmare Eclipse disclosed a zero-day privilege escalation vulnerability in CrowdStrike Falcon, dubbed 'FalconFlank,' which allows attackers to achieve SYSTEM-level privileges on fully updated Windows 11 25H2 and Windows Server 2025 systems. The exploit abuses the 'File Suspicious Macro Removal' feature in CrowdStrike Falcon Sensor by loading a malicious DLL. CrowdStrike has not yet assigned a CVE ID but advises customers to disable the related Microsoft Office policy setting while investigations continue. The researcher has also released other zero-day exploits targeting Kaspersky, Avast, Nvidia, and multiple Microsoft products.

1mo ago · bleeping-computer

Hewlett Packard Enterprise (HPE) has patched a critical buffer overflow vulnerability in ArubaOS-CX, tracked as CVE-2026-73749, which allows unauthenticated remote attackers to execute arbitrary code with elevated privileges by sending specially crafted packets to an affected daemon. Multiple other vulnerabilities were also addressed, including privilege escalation, command execution, and authentication bypass flaws affecting various versions of ArubaOS-CX. HPE recommends customers upgrade to fixed software versions immediately, although no active exploitation has been observed at the time of disclosure.

1mo ago · bleeping-computer

Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers to distribute malicious Terraform modules. These modules contained credential-stealing code that targeted environment variables, API keys, CI/CD credentials, SSH keys, and other sensitive data from development environments. The malicious activity occurred between 07:35 UTC and 21:45 UTC on August 31, 2026, with stolen data exfiltrated to the domain coder-infra[.]com. Coder recommends rotating secrets, inspecting logs for connections to the suspicious domain, and purging potentially compromised cached modules.

1mo ago · bleeping-computer

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform, to achieve remote code execution. The flaw exists in the /pa HTTP endpoint, which processes XML messages and improperly concatenates user-controlled input into SQL queries. Exploitation has been observed in the wild, with attackers attempting to deploy reverse shells and exfiltrate system information. Horizon3 observed multiple exploit attempts originating from a single IP address, indicating widespread targeting of internet-exposed Switchvox systems.

1mo ago · bleeping-computer

A critical authentication bypass vulnerability, CVE-2026-82329, in JFrog Artifactory is actively being exploited by attackers to forge administrative access tokens. The flaw exists in the default configuration of self-managed instances, allowing unauthenticated attackers with network access to escalate privileges and gain full administrative control. Attackers can abuse this access to enumerate users and groups, read artifacts, modify security settings, and potentially poison trusted software packages distributed to downstream systems. JFrog has patched the vulnerability in several updated versions, but previously issued malicious tokens may remain valid post-upgrade.

1mo ago · bleeping-computer

A high-severity SQL injection vulnerability, tracked as CVE-2026-19949, exists in the All-in-One WP Migration and Backup plugin for WordPress, affecting versions up to 7.109. The flaw allows unauthenticated attackers to inject malicious SQL through trackbacks, which executes when an administrator performs a backup import, enabling remote code execution and full site takeover. The vulnerability stems from improper handling of escaped backslashes and quotes during database restoration. Despite a patch released in version 7.110 on August 20, only 35% of the over five million installations have been updated, leaving millions of sites at risk.

2mo ago · bleeping-computer

SonicWall has warned of an actively exploited zero-day vulnerability chain affecting its SMA1000 appliances, involving two critical command injection flaws. The first vulnerability (CVE-2026-83548) is a server-side request forgery (SSRF) in the WorkPlace interface, while the second (CVE-2026-83549) allows command injection in the Management Console by authenticated administrators. These vulnerabilities enable remote code execution, and attackers are actively exploiting them in the wild. Customers are urged to apply hotfixes immediately, though specific IOCs have not been released by SonicWall.

2mo ago · bleeping-computer

The Sality botnet, active for over two decades and responsible for infecting more than 15,000 devices, has been disrupted in a joint global takedown operation led by international law enforcement and private sector partners including Europol, FBI, and CrowdStrike. The botnet, attributed to the threat actor group SALTY SPIDER believed to be operating from Russia's Republic of Bashkortostan, used a peer-to-peer (P2P) architecture to distribute malware payloads, primarily EggJagger in recent years. EggJagger is a clipjacking tool that monitors and replaces cryptocurrency wallet addresses in the clipboard with attacker-controlled ones. The disruption was achieved by sinkholing the botnet’s super peer infrastructure, effectively severing communication between infected machines and preventing further propagation of malicious payloads.

2mo ago · bleeping-computer

A Russian national, Searzhudin Tamirlanovich Aktulaev, has been indicted for conducting a phishing campaign between June 2016 and November 2017 that infected approximately 80,000 freelancers with TVRAT and DarkVNC malware. The attacker used 255 fake accounts on a freelance platform to send malicious Excel attachments containing macros, which downloaded malware enabling remote access via TeamViewer and VNC Viewer. The malware exfiltrated stolen data, including e-commerce credentials and personally identifiable information, to command-and-control servers paid for with virtual currency, with thousands of infected systems in the U.S., particularly in the Northern District of California.

2mo ago · bleeping-computer

Hackers are exploiting the legitimate Faronics Deploy endpoint management tool to gain remote administrative access to victim systems by tricking users into installing a maliciously repurposed, signed installer disguised as an Adobe-related executable. The installer enrolls the victim's machine into an attacker-controlled Faronics deployment, enabling the execution of PowerShell scripts that deploy additional payloads, including ConnectWise ScreenConnect, a remote access tool used for persistent and interactive control. The attack uses phishing emails with business-themed lures, such as fake invoices, and includes anti-analysis techniques to evade detection in sandboxed environments. Activity declined after Faronics implemented anti-abuse measures in response to disclosure by Huntress.

2mo ago · bleeping-computer

Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability, CVE-2026-0768, in Langflow, an open-source AI application framework, to steal sensitive credentials including OpenAI and AWS API keys. The flaw exists in the code validator of Langflow's custom component editor, allowing arbitrary Python code execution with root privileges. Attack activity has been observed on honeypots, primarily originating from Russia, with over 360 exploitation attempts detected. Attackers query environment variables and sensitive files to harvest credentials and maintain persistence.

2mo ago · bleeping-computer

A high-severity authentication bypass vulnerability, CVE-2026-62911, affects unpatched Microsoft Exchange Server 2016, 2019, and Subscription Edition systems, allowing attackers with basic privileges to hijack all user mailboxes. Exploit code for this flaw is now publicly available, according to the Netherlands NCSC-NL. Despite Microsoft's patch release in August 2026, nearly 22,000 Exchange servers remain exposed online and unpatched, with the majority located in the United States and Germany. German authorities report approximately 85% of on-premises Exchange servers in Germany are still vulnerable.

2mo ago · bleeping-computer

Novocure, a healthtech company specializing in cancer treatment, suffered a cyberattack in mid-August that led to unauthorized access to its information systems. The breach exposed data of over 1,400 U.S. cancer patients, including patient ID numbers, and for fewer than 50 patients, identifying and healthcare provider contact information. Employee contact details and job titles were also accessed, though no medical devices were compromised and systems remain operational. The company is assessing regulatory obligations and has not disclosed the breach vector or whether ransom demands were made.

2mo ago · bleeping-computer

Hackers conducted a BGP hijacking attack against Hetzner-hosted IP addresses used by Softaculous to redirect traffic from its software update systems and client portal. During the incident window from August 28 to August 30, 2026, a malicious Virtualizor update was delivered to a small number of installations. The attack allowed threat actors to intercept update requests and potentially compromise affected servers. Softaculous has since restored routing, revoked the fraudulent certificate, and released a new secure version of Virtualizor with improved security tooling.

2mo ago · bleeping-computer

Two recently patched zero-day vulnerabilities in PaperCut NG and MF print management software, tracked as CVE-2026-81578 and CVE-2026-82078, are being actively exploited in data theft attacks. Attackers are chaining the flaws to bypass authentication and access backend databases via PaperCut's external user-lookup functionality, using the vulnerabilities to dump database tables through Derby without executing remote code. Threat intelligence firm Defused observed the exploit activity in honeypots starting August 29, 2026, indicating ongoing abuse by unidentified actors.

2mo ago · bleeping-computer

Five Venezuelan nationals have pleaded guilty to conducting ATM jackpotting attacks in the United States, attempting to install malware on ATMs to force them to dispense cash. The attacks occurred in Wamego and Manhattan, Kansas, but were unsuccessful due to alarm triggers and surveillance detection. The individuals were part of a larger wave of ATM jackpotting incidents linked to the Tren de Aragua criminal organization, which has been associated with the use of Ploutus malware in a broader campaign targeting financial institutions across the U.S.

2mo ago · bleeping-computer

The city administration of Berlin has confirmed a ransomware attack by the Rhysida group, which claims to have exfiltrated 5.79 TB of data from its administrative network. The stolen data includes sensitive government records, personal information, credentials, and critical infrastructure assessments, with attackers threatening to publish the data unless a ransom is paid. The incident was discovered in mid-August 2026, and investigations are ongoing, involving the State Criminal Police Office, public prosecutor, and federal security agencies. No evidence was found that election data was compromised, and the affected departments were disconnected from the state network on August 14.

2mo ago · bleeping-computer

The Chinese state-sponsored threat actor Fire Ant has shifted tactics to compromise Cisco IOS XR routers, TACACS servers, and Linux management systems, turning routers into surveillance platforms via concealed GRE tunnels. The group deployed a custom backdoor named 'BridgeAgent', disguised as a Zabbix agent, enabling reverse shells and execution of additional payloads. Fire Ant uses stealthy persistence mechanisms, suppresses syslog messages, and exfiltrates network traffic PCAPs to FTP servers, aiming to map and access high-value networks through a 'target behind the target' strategy. The group's activity overlaps with UNC3886 but shows distinct implementation differences.

2mo ago · bleeping-computer

Microsoft has identified a new variant of ClickFix attacks dubbed TerminalFix, which uses fake Cloudflare CAPTCHA prompts on compromised websites to trick users into executing malicious PowerShell commands in Windows Terminal. The attack chain involves downloading a ZIP containing a signed executable and a malicious DLL, followed by steganographic retrieval of additional payloads from PNG images. A custom Python-based reverse-tunnel module establishes an encrypted WebSocket connection to gitnow[.]dev:443, enabling attackers to pivot into internal networks via SOCKS5-style proxying and perform reconnaissance on domain controllers, databases, and other critical systems.

2mo ago · bleeping-computer

The Cronos blockchain was exploited via a price-manipulation attack on the Tectonic DeFi lending platform, resulting in the attacker borrowing $74 million worth of assets by artificially inflating the value of the TONIC token by 100x within 20 minutes. The attacker successfully withdrew approximately $6 million in Ethereum, while the remainder of the funds were frozen due to the blockchain's emergency response. Cronos halted operations, rolled back the chain state to before the exploit occurred, and has since resumed normal operations. A post-mortem analysis is expected to follow.

2mo ago · bleeping-computer

Pokémon Center disclosed a data breach affecting customers in the United Kingdom and Germany due to a cyberattack on its third-party logistics provider, CEVA Logistics, which was compromised between July 29 and August 1, 2026. The breach exposed customer personal information including full names, mailing addresses, phone numbers, email addresses, and order details. Although payment card data was not accessed, the incident led to order cancellations and shipping delays. CEVA Logistics, a subsidiary of CMA CGM Group, confirmed the breach impacted multiple European retailers, including Valve, which also reported stolen customer data.

2mo ago · bleeping-computer

A threat actor using the alias 'TheHatman' is selling alleged employee databases stolen from the Microsoft Azure environments of multiple Fortune 500 companies, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl. The actor claims to have obtained the data using compromised credentials, potentially via password spray and MFA fatigue attacks. The datasets reportedly include employee names, email addresses, job titles, phone numbers, addresses, service accounts, and tenant-specific Azure structures. While some companies like Tata and Gap have stated there is no evidence of a breach and that the data may be outdated, cybersecurity firm Hudson Rock has analyzed samples and confirmed the data contains authentic corporate directory attributes and could be used for social engineering or spearphishing.

2mo ago · bleeping-computer

Certighost, tracked as CVE-2026-54121, is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to coerce an Enterprise Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller. This is achieved by exploiting a 'chase' functionality flaw where the CA follows attacker-supplied routing information without validating the target endpoint, enabling the attacker to forge identity data and obtain a certificate impersonating a Domain Controller. The attacker can then use PKINIT to obtain a Ticket Granting Ticket, perform DCSync to extract credentials including the krbtgt hash, and achieve full domain compromise. The vulnerability was patched by Microsoft on July 14, 2026, but the underlying risk stems from standing privileges like default MachineAccountQuota settings that allow unprivileged users to create machine accounts.

2mo ago · bleeping-computer

The Clop ransomware gang is conducting data theft attacks against organizations using PTC Windchill and PTC FlexPLM platforms, exploiting a critical vulnerability, CVE-2026-12569, that allows improper input validation. Companies including Philips, General Electric (GE), and Shell have confirmed they are investigating or have confirmed breaches. The attackers deploy JSP webshells to exfiltrate sensitive data such as project plans, blueprints, and internal backups. The U.S. CISA and Germany's BSI have issued urgent warnings, mandating immediate patching due to active exploitation in the wild.

2mo ago · bleeping-computer

Microsoft is actively working on a security patch for a newly disclosed zero-day vulnerability in Microsoft Defender named 'ShieldBreak', tracked as CVE-2026-69414. The vulnerability, disclosed by security researcher Nightmare Eclipse, allows local attackers with limited privileges to escalate to SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit acts as a bypass for the previously patched RoguePlanet vulnerability (CVE-2026-50656), indicating an incomplete fix. Microsoft has acknowledged the issue but has not yet released a patch, while the researcher has publicly released a proof-of-concept exploit due to an ongoing dispute over disclosure practices.

2mo ago · bleeping-computer

The French Ministry of the Economy and Finance disclosed a data breach affecting 678,000 individuals after a threat actor using the handle 'ZeroBytes' claimed responsibility and listed a stolen database for sale on the PwnForums hacking forum on August 12, 2026. The attacker accessed the General Directorate of Public Finances (DGFiP) systems, extracting sensitive tax and cadastral data, including reference tax income, family quotient, withholding tax rate, company names, SIREN numbers, and property records. Access to sensitive systems was shut down, and the incident is under investigation with support from ANSSI, though user credentials were not compromised.

2mo ago · bleeping-computer

Cryptocurrency hardware wallet provider SafePal suffered a data breach affecting approximately 39,798 customers due to an authorization flaw in an order-tracking plugin, which allowed unauthorized access to customer order information. The exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details, but not wallet seed phrases, private keys, or payment information. A threat actor is now claiming to sell the stolen data on a cybercrime forum, and customers have reported receiving phishing emails and phone calls impersonating SafePal, warning of a firmware vulnerability in the X1 device to trick users into compromising their wallets.

2mo ago · bleeping-computer

Threema, a secure messaging service, was disrupted by large-scale distributed denial-of-service (DDoS) attacks that targeted both its infrastructure and its colocation partner, Nine. The attacks caused intermittent outages and service degradation for users in Switzerland, India, and China, despite internal status pages showing normal operations. The threat actor continuously changed attack patterns, making mitigation difficult, and an unrelated technical issue prevented timely status updates. Threema has since implemented specialized upstream DDoS protection to reduce future impact.