Attackers Exploit Gitea Flaw to Run Code on Self-Hosted Servers
Gitea’s patch API can turn repository content into server code execution. Upgrade to 1.27.2 or later and check server activity for signs of compromise.
Read article →threats
Threat actors, malware campaigns, phishing, exploitation, and incident activity.
CareCloud AWS Breach Affects 3.7 Million Patients
CareCloud says forensic review confirmed patient data exfiltration. HHS reports 3.76 million affected people, while public records do not map specific fields to each person.
Read article →
Attackers Exploit Oracle WebLogic Proxy Flaw to Reach Critical Data
CISA confirmed exploitation of a CVSS 10 Oracle WebLogic proxy flaw. Patch affected Apache and IIS plug-ins, then review requests for unauthorized data access.
Read article →
SynkLoader Uses Teams Lures for Password Phishing and Network Access
A new Windows loader arrives through a fake Teams help desk; modules sent to Expel’s emulator phish passwords and tunnel into internal services.
Read article →
ToxicPanda Steals Banking PINs and Takes Shell Control of Android Phones
An updated Android banking trojan blocks Google Play traffic, automates wireless ADB pairing, and targets 349 financial apps across 16 countries.
Read article →
Fake GTA 6 Demo Steals Passwords and Active Browser Sessions
A 1.1 MB fake installer delivers Vidar, launches installed browsers headlessly, and copies credentials and sessions that can remain useful after cleanup.
Read article →
Attackers Exploit miniOrange SAML Flaws for WordPress Admin Access
Two exploited miniOrange SAML flaws can mint WordPress admin sessions. Seven independently versioned editions make ordinary update and vulnerability checks unreliable.
Read article →
Attackers Use Android Car Updaters to Install Proxy Botnet Malware
Kaspersky traced malware on DoFun-powered car displays from a trusted updater to ad fraud and a residential proxy. DoFun says it fixed the issue but published no fixed build.
Read article →
C2Looper Backdoor Uses GitHub to Control Infected Windows PCs
C2Looper shifted from one-second HTTP beacons to GitHub C2. Hunt its OneDrive DLL, JSON control files, debug marker, commands, hashes, and two IPs.
Read article →
Suspected Ransomware Operator Used Claude Code to Steal Data and Map Backups
Gambit observed Claude Code inside six intrusions. Hunt the test VPN account, rogue LDAP listeners, backup discovery, SQL staging, and firewall restores.
Read article →
Attackers Exploit Zimbra Mail Flaw to Run Server Commands
Attackers are exploiting a Zimbra SNMP flaw through crafted SMTP requests. Version 10.1.20 fixes it; exposed servers need log and file review.
Read article →
Elementor Pro Upload Flaw Lets Attackers Run Code on WordPress Sites
A blank file entry bypasses Elementor Pro upload checks on exposed forms. Version 4.2.2 fixes the flaw, but patched sites still need to hunt for PHP left behind.
Read article →
Ransomware Crews Exploit Windows Task Host Flaw for SYSTEM Access
CISA now ties CVE-2025-60710 to ransomware. The local Windows flaw needs an existing foothold, then lets an attacker elevate to SYSTEM.
Read article →Showing 92–104 of 156