Ransomware Crews Exploit Windows Task Host Flaw for SYSTEM Access
CISA now ties CVE-2025-60710 to ransomware. The local Windows flaw needs an existing foothold, then lets an attacker elevate to SYSTEM.
Reader edition
The Feed
CISA Flags Exploited Ray Flaw That Runs Code Through Firefox and Safari
A hostile page can rebind its hostname to a Ray dashboard, change Firefox or Safari's User-Agent header, and submit a shell command to the Jobs API.
45 Million wp2shell Attempts Hit WordPress in One Week
Pantheon counted 45 million wp2shell attempts in one week. Defenders should verify current WordPress builds and review exposed sites for persistent access.
Poisoned Rust Crates Ran Malware During Developer Builds
A compromised crates.io account poisoned three Rust packages. Builds ran a downloader; 2,285 arrayref downloads now require cache, lockfile, and host checks.
Windows 11 RAM Attack Lets Admins Disable Defender and VBS
USENIX researchers turned writable DIMM configuration into arbitrary physical-memory access. April's Windows update blocks their current chain under Secure Boot.
Chrome 151 Fixes Five High-Severity Memory Flaws Across the Browser
Chrome 151 fixes five high-severity use-after-free bugs; endpoint inventories must show the fixed build or a later superseding release.
Ransomware Campaigns Exploit SharePoint Flaw to Run Server Code
CISA now links CVE-2026-45659 to ransomware. Check exact SharePoint builds, then investigate whether low-privilege access reached the farm before patching.
Windows Plug and Play Gives Crafted Devices SYSTEM Access
Researchers chain signed Windows device installers into SYSTEM execution through emulated USB hardware or an ordinary RDP session.
Fake Web3 Interview Steals Wallet Keys Through Signed Windows App
A signed ClickOnce app delivered two stealers and an hVNC RAT after a fake Web3 interview. Hunt per-user ClickOnce records, then rotate every secret reachable from affected hosts.
Attackers Exploit Windows Driver to Gain SYSTEM Privileges
Microsoft's August updates fix an AFD.sys race used in attacks; defenders must verify fixed builds and investigate pre-patch privilege escalation.
Stolen AI API Key Leaves One Company With Nearly $1 Million Bill
Unit 42 says stolen AI API keys can reach gray-market proxy services within minutes, turning one exposed credential into catastrophic usage charges.
NetScaler SAML Flaw Lets Remote Attackers Run Code as Root
Public research turns a patched NetScaler memory overflow into a root-code-execution risk for SAML deployments, making build verification urgent.
RingCentral Breach Exposes 1.6 Million Account Records
Customer contact data is public after a social-engineering breach; defenders should harden support and identity checks against targeted impersonation.