Ransomware Campaigns Exploit SharePoint Flaw to Run Server Code
CISA now links CVE-2026-45659 to ransomware. Check exact SharePoint builds, then investigate whether low-privilege access reached the farm before patching.
Read article →Page 12 of 16
Latest Articles
Windows Plug and Play Gives Crafted Devices SYSTEM Access
Researchers chain signed Windows device installers into SYSTEM execution through emulated USB hardware or an ordinary RDP session.
Read article →
Fake Web3 Interview Steals Wallet Keys Through Signed Windows App
A signed ClickOnce app delivered two stealers and an hVNC RAT after a fake Web3 interview. Hunt per-user ClickOnce records, then rotate every secret reachable from affected hosts.
Read article →
Attackers Exploit Windows Driver to Gain SYSTEM Privileges
Microsoft's August updates fix an AFD.sys race used in attacks; defenders must verify fixed builds and investigate pre-patch privilege escalation.
Read article →
Stolen AI API Key Leaves One Company With Nearly $1 Million Bill
Unit 42 says stolen AI API keys can reach gray-market proxy services within minutes, turning one exposed credential into catastrophic usage charges.
Read article →
NetScaler SAML Flaw Lets Remote Attackers Run Code as Root
Public research turns a patched NetScaler memory overflow into a root-code-execution risk for SAML deployments, making build verification urgent.
Read article →
RingCentral Breach Exposes 1.6 Million Account Records
Customer contact data is public after a social-engineering breach; defenders should harden support and identity checks against targeted impersonation.
Read article →
WordPress Image Upload Flaw Lets Authors Run Server Code
CVE-2026-65640 reaches Ghostscript on sites using Imagick; WordPress 7.0.4 and exact backports move content checks ahead of image processing.
Read article →
Microsoft Fixes LegacyHive Flaw That Gives Local Attackers Admin Rights
August Windows updates fix a public registry-hive privilege escalation; defenders can hunt its staging files, virtual paths, and unusual DLL loads.
Read article →
Attackers Exploit Cisco VPN Requests to Reload Firewalls
Exposed ASA and FTD remote-access services need release-specific hot fixes; Cisco offers no workaround for the exploited denial-of-service flaw.
Read article →
Two SharePoint Flaws Chain Into Unauthenticated Server Code Execution
Rapid7 joined a SharePoint identity bypass to unsafe .NET type creation. August's cumulative updates complete Microsoft's two-cycle fix.
Read article →
Gunra Steals Cloud Data and Deletes Backups Before Encryption
Government agencies traced Gunra from exploited edge devices through credential theft, cloud exfiltration, backup deletion, and cross-platform ransomware.
Read article →
CISA Confirms Exploitation of LoadMaster Command Injection
CISA confirms exploitation of a pre-authentication LoadMaster command-injection flaw. API-enabled appliances need a fixed release and an exposure review.
Read article →
Public Open vSwitch Exploit Gives Local Linux Users Root Access
OVSwrap exploits a 16-bit nested-action limit in the Linux kernel, leaving defenders to verify both the running fix and the earlier exposure window.
Read article →
Microsoft Defender Isolated a QNET Workstation in 128 Seconds
A Microsoft case study traces mshta execution to one isolated QNET host and shows which workstations qualify for the preview action.
Read article →
SCTPhantom Exposes Linux SCTP to Remote Attack and Local Root
A remote SCTP peer can trigger the kernel flaw, while Tencent separately demonstrated local privilege escalation and container escape. Defenders need both reachability and running-kernel checks.
Read article →Showing 174–189 of 246