Security Intel Feed
Cyber Hose
Page 15 of 52
Vulnerabilities & CVEs
WPForms Pro Unauthenticated Stored XSS (CVE-2026-18409)
Read digest- CVE-2026-18409 — WPForms Pro through 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting — A CVSS 7.2 unauthenticated stored XSS vulnerability affects WPForms Pro versions through 2.0.0.2.
Active Exploits & Incidents
Critical Microsoft Entra ID RCE flaw exploited in the wild
Read digest- Critical Microsoft Entra ID RCE flaw exploited in the wild — CVE-2026-69836 is a critical remote-code-execution flaw in Microsoft Entra ID that Microsoft says is being exploited in the wild.
Active Exploits & Incidents
SPIP Before 4.4.20 Hit by Unauthenticated RCE CVE-2026-77647
Read digest- SPIP Before 4.4.20 Hit by Unauthenticated RCE CVE-2026-77647 — CVE-2026-77647 allows unauthenticated remote attackers to execute arbitrary code on SPIP installations before version 4.4.20 and was exploited in the wild.
- SynkLoader malware uses fake Windows lock screens to steal passwords — SynkLoader deploys a convincing fake Windows lock screen to harvest user login passwords using in-memory modules across multiple languages.
- CVE-2026-72843 — EverShop Critical Unauthenticated Account Takeover — A CVSS 9.3 vulnerability enables unauthenticated attackers to seize EverShop user accounts without credentials.
Vendor Bulletins & Advisories
Attackers Poisoned Three Rust Crates With Build-Time Malware
Read digest- Attackers Poisoned Three Rust Crates With Build-Time Malware — A supply-chain attack injected build-time malware into three Rust crates, potentially compromising downstream projects that depend on them.
- CVE-2026-71485 — Centrifugo: Client-forgeable headers emulation lets any client spoof headers — A CVSS 9.1 vulnerability in Centrifugo allows any client to spoof headers through client-forgeable header emulation.
- Jake Williams Releases CUSTODY Framework to Constrain AI Agents — The CUSTODY framework aims to constrain enterprise AI agents operating inside networks following attacks involving OpenAI and Hugging Face.
Vendor Bulletins & Advisories
AI-generated scripts target internet-exposed Siemens S7 PLCs
Read digest- AI-generated scripts target internet-exposed Siemens S7 PLCs — Attackers are using AI-generated tools disguised as OT monitoring software to read and write PLC memory across water, energy, and manufacturing sectors.
- Suspected Russian Hackers Abuse Google OAuth and WhatsApp to Hijack Accounts — Threat clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate Google authentication flows and WhatsApp device-linking for cyber espionage.
- CVE-2026-19586 — CVSS 9.3 — Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server — A pre-authentication OS command injection vulnerability in Omada Gateways allows unauthenticated remote attackers to execute commands via the OpenVPN server.
Active Exploits & Incidents
CISA Flags Exploited TrueConf Server Flaws Used in Head Mare Attacks
Read digest- CISA Flags Exploited TrueConf Server Flaws Used in Head Mare Attacks — Head Mare exploits unpatched TrueConf servers to deploy PhantomCore and PhantomGraph backdoors, impacting many organizations.
- TeamPCP LiteLLM attack exposes credentials from nearly 2,500 organizations — A supply-chain attack on LiteLLM leaked credentials from thousands of organizations including major tech companies.
- Researcher registers Linux device to Apple Find My People — A researcher accessed Apple Find My People location shares from a Linux device using advanced authentication techniques.
- N-able Passportal bug exposes password-vault master keys — A bug in N-able Passportal exposed password-vault master keys, affecting managed service providers and small businesses.
Threat Research & Deep Dives
Critical isolated-vm flaw enables sandbox escape and potential host
Read digest- Critical isolated-vm flaw enables sandbox escape and potential host RCE — A type confusion vulnerability in isolated-vm allows attackers to escape sandboxes and hijack host control flow.
- Transparent Tribe Targets Afghan Telecom With PATCHCORD Backdoor — APT36 targets Afghan telecom and South Asian infrastructure using new backdoors and sophisticated C2 techniques.
- Encrypted web-page prompts can exfiltrate Grok users’ chat data — Malicious encrypted prompts can steal Grok chatbot user data including names and locations.
- Phishing toolkit covertly enrolls hidden passkeys on compromised Google accounts — A phishing toolkit secretly registers attacker-controlled passkeys on Google accounts after compromise.
Threat Research & Deep Dives
UAT-10147 deploys SPECTRE cross-platform backdoor with rootkit and
Read digest- UAT-10147 deploys SPECTRE cross-platform backdoor with rootkit and BYOVD — Cisco Talos has identified SPECTRE, a cross-platform backdoor used by UAT-10147.
- Operation CameraSwarm Compromised 14,530 Dahua IP Cameras — Attackers compromised 14,530 Dahua IP cameras in Operation CameraSwarm.
- ClawHavoc Poisoned OpenClaw’s ClawHub With Malicious Agent Skills — ClawHavoc used poisoned OpenClaw skills to deliver information-stealing malware.
- Alation confirms cyberattack involving unauthorized access to its systems — Alation confirmed a cyberattack involving unauthorized activity in one system.
- ClarityCheck exposed 9 million facial images in unsecured cloud storage — ClarityCheck exposed more than nine million facial image files in an unsecured cloud database.
Active Exploits & Incidents
Attackers Exploit Critical MLflow SSRF Flaw to Steal Cloud Credentials
Read digest- Attackers Exploit Critical MLflow SSRF Flaw to Steal Cloud Credentials — CVE-2026-64849 in MLflow versions before 3.15.0 allows unauthenticated SSRF to reach cloud metadata endpoints and steal credentials.
- Critical Zimbra RCE Vulnerability Is Being Actively Exploited — CVE-2026-73570 enables unauthenticated command execution via SNMP notification processing in Zimbra Collaboration Suite before 10.1.20.
- ToxicPanda 2.0 Expands Android Banking Fraud With On-Device Attacks — The trojan targets 349 financial applications across 16 countries using overlays, Accessibility Services, and 167 remote commands.
- CyberPanel Pre-Auth RCE Chain Enables Shell Access on Hosting Servers — CVE-2026-41473 and CVE-2026-41472 in CyberPanel before 2.4.4 allow unauthenticated database writes and stored XSS leading to OS command execution.
Active Exploits & Incidents
Malicious Firefox Extensions Target Crypto Wallets With Secret Theft
Read digest- Malicious Firefox Extensions Target Crypto Wallets With Secret Theft — Forty malicious Firefox extensions impersonating Web3 wallet brands steal recovery phrases, private keys, and credentials from cryptocurrency users.
- Cross-Model Replay Exposes Encrypted Reasoning Traces From Major LLM APIs — Researchers recovered encrypted reasoning blocks from Anthropic, OpenAI, and Google LLM APIs by replaying them into weaker sibling models.
- Expired Visa Contactless Cards Can Be Reanimated for Purchases — UMass researchers demonstrated that expired Visa contactless cards can still authorize payments by rewriting the expiration date during NFC relay.
- CVE-2026-18776 — TrueBooker Appointment Booking before 1.2.7 - Unauthenticated Account Takeover — A CVSS 9.8 unauthenticated account takeover vulnerability affects the TrueBooker Appointment Booking WordPress plugin before version 1.2.7.
Assess Your Exposure
Start with the free Posture Self-Check to see where you stand against the current threat landscape.
Free Posture Self-Check