3+ day, 20+ hour ago   (367+ words) Palo Alto Networks has disclosed a high-severity buffer overflow vulnerability in PAN-OS that could allow unauthenticated, network-based attackers to execute arbitrary code with root privileges on PA-Series hardware firewalls. Tracked as CVE-2026-0310, the flaw affects XML processing functionality in PAN-OS…...

3+ day, 21+ hour ago   (399+ words) Instead of sending victims to a hosted credential-harvesting page, the attackers generate the phishing page directly inside the victim’s browser using a blob URL. This technique makes detection harder because the phishing page does not exist as a normal internet-accessible…...

4+ day, 1+ hour ago   (229+ words) A rapidly adopted exploit kit, dubbed BlueMoon, chains Chrome and Microsoft Windows zero-days to compromise targets in espionage-focused phishing campaigns. Most observed activity has been linked to China-aligned clusters, although researchers cautioned that the toolkit cannot yet be attributed exclusively…...

6+ day, 2+ hour ago   (398+ words) Mathspace, a mathematics learning platform used by schools in Australia and New Zealand, has disclosed a data breach affecting 1,079,819 students, parents or guardians, teachers, and employees. The incident stemmed from the exploitation of a critical vulnerability in a self-hosted Metabase…...

6+ day, 21+ hour ago   (407+ words) The campaign targeted organizations in South Korea’s automotive and media sectors, using compromised edge servers to steal credentials, monitor victims, inject malicious content into web traffic, and maintain long-term access. At the center of the operation is a modified HAProxy…...

1+ week, 1+ hour ago   (402+ words) A newly disclosed actively exploited zero-day vulnerability in Magento and Adobe Commerce allows unauthenticated attackers to execute code remotely on affected e-commerce stores. The flaw, named StyleSmuggler, was discovered by Sansec’s Forensics Team, which warned that exploitation began on September…...

1+ week, 1+ hour ago   (220+ words) The activity follows PaperCut’s August 27 disclosure of active exploitation. CVE identifiers were assigned the next day, while CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. The observed intrusion chain begins with exploitation of exposed PaperCut servers,…...

1+ week, 2+ hour ago   (425+ words) The attacks primarily target devices with SSH management access exposed to public networks, prompting urgent patching guidance from MikroTik, CERT Polska, and Latvia’s CERT.LV. MikroTik released security updates on September 3, confirming that fixed RouterOS builds are available through supported…...

1+ week, 4+ day ago   (362+ words) A newly analyzed server linked to the ransomware group The Gentlemen contained a previously undocumented command-and-control (C2) framework called TukTuk, tools designed to disable endpoint security products, and data believed to have been stolen from two global companies. Threat intelligence researchers…...

1+ week, 6+ day ago   (445+ words) Attackers hijacked Border Gateway Protocol routing for Softaculous infrastructure last week, diverting traffic to attacker-controlled systems and delivering a malicious Virtualizor update to a small number of hypervisor servers. According to Virtualizor’s incident report, the routing attack ran from approximately…...