Find what you’re looking for
Browse everything
6,868 results in Threat Reports
Critical Unpatched Kaltura mwEmbed Vulnerabilities Expose Video Platforms to Remote Attacks
Two critical unpatched vulnerabilities in Kaltura's HTML5 video player library (CVE-2026-19913 and CVE-2026-19912) allow remote, unauthenticated attackers to read arbitrary files and execute code on affected servers. The flaws stem from unsafe deserialization in the mwEmbedLoader.php endpoint, affecting both individual customer installations and Kaltura's shared multi-tenant CDN infrastructure. With CVSS scores of 9.1 and 10.0 respectively, these vulnerabilities require only network access to exploit, with no authentication needed. CERT/CC reported being unable to coordinate with Kaltura for patches, leaving administrators to implement workarounds. This incident highlights the growing risk of unpatched vulnerabilities in widely-deployed media platforms and the challenges of coordinating disclosures with unresponsive vendors, particularly as video streaming infrastructure becomes increasingly critical to business operations.
Critical Rently Smart Home Vulnerability Exposes IoT Access Control Risks
In August 2026, CISA published advisory ICSA-26-237-01 detailing a critical vulnerability (CVE-2026-75960) in Rently Smart Home systems version 20.1.0 and prior. The vulnerability, classified as Insufficiently Protected Credentials with a CVSS score of 8.1, allows attackers to retrieve pins including the Master Pin and override standard user permissions. The flaw affects smart home access control systems deployed across commercial facilities in the United States and India, potentially compromising physical security for properties using Rently's keyless entry solutions. Rently patched the vulnerability in late June 2026, requiring no user action for remediation. This incident highlights the growing security risks in IoT and smart building infrastructure as organizations increasingly adopt connected access control systems. The vulnerability underscores critical gaps in credential protection mechanisms that could enable unauthorized physical access to commercial and residential properties.
PayRange API Vulnerability Exposes Critical Payment Infrastructure
A critical vulnerability (CVE-2026-18965) in PayRange's API system exposes sensitive information from payment kiosks and vending machines across North America. The missing authorization flaw allows both authenticated and unauthenticated attackers to access verbose details of every device on the PayRange network, potentially enabling denial of service attacks and unauthorized device manipulation. The vulnerability affects all versions of the PayRange API, with PayRange reportedly unresponsive to CISA's coordination efforts. This incident highlights the growing security risks in Internet of Things (IoT) payment systems as critical infrastructure increasingly relies on connected devices. The vulnerability demonstrates how API security gaps can expose entire networks of payment devices, particularly relevant as organizations face mounting regulatory pressure to secure payment processing systems and protect consumer data.
CISA Red Team Reveals Shocking Security Gap: Two Critical Infrastructure Orgs, Vastly Different Outcomes
In August 2026, CISA published results from simultaneous red team assessments against two critical infrastructure organizations in the Government Services and Water/Wastewater sectors. Both organizations were fully compromised at the domain level using similar attack techniques including web application exploitation with default credentials, Active Directory Certificate Services misconfigurations, and privilege escalation through cleartext stored credentials. Organization A detected nothing despite thousands of security alerts, while Organization B's SOC detected and isolated affected workstations within 2-20 minutes, demonstrating the critical importance of security operations maturity over tool sophistication. This assessment highlights the growing focus on defensive capabilities amid increasing nation-state threats against critical infrastructure, particularly following recent campaigns like Salt Typhoon that exposed fundamental gaps in network security and detection capabilities across sectors.
NovaCookies Campaign: How Attackers Weaponized DocuSign to Steal Enterprise Credentials
In August 2026, cybersecurity researchers disclosed the NovaCookies phishing toolkit, a $320/month subscription-based adversary-in-the-middle (AitM) service targeting Microsoft 365 credentials. The campaign exploited genuine DocuSign notifications to deliver counterfeit document-share lures, bypassing email security controls by routing victims through legitimate Microsoft or Google sign-in endpoints before redirecting to attacker-controlled infrastructure. NovaCookies successfully harvested authenticated sessions from hundreds of organizations across the U.S., U.K., Canada, Germany, Israel, and U.A.E., capturing both passwords and multi-factor authentication codes in real-time through its proxy-based architecture. This incident highlights the growing sophistication of phishing-as-a-service platforms that abuse trusted services and legitimate authentication flows to evade detection. The rise of commercial AitM toolkits represents a significant escalation in credential theft capabilities, enabling low-skilled attackers to bypass traditional security controls.
Critical Veeam Backup Console Vulnerabilities Expose MSP Infrastructure to Unauthenticated RCE
In August 2026, Veeam disclosed critical vulnerabilities CVE-2026-58073 (CVSS 9.5) and CVE-2026-58072 (CVSS 9.0) affecting Veeam Service Provider Console versions 9.2.1 and earlier. The vulnerabilities allow unauthenticated attackers to impersonate backup agents, obtain legitimate certificates, and write arbitrary files to achieve remote code execution. This attack chain targets the multi-tenant console that managed service providers use to control backups across all customer environments, making it a high-value target. Bishop Fox demonstrated end-to-end exploitation and published detection tools. Organizations must immediately upgrade to version 9.3.0, as no backport fixes are available for earlier versions. This incident highlights the growing threat to backup infrastructure as ransomware groups increasingly target backup systems to prevent recovery operations. With managed service providers becoming prime targets due to their multi-tenant access, authentication bypass vulnerabilities in critical infrastructure components represent existential risks to business continuity across entire customer portfolios.
Advanced AI Agent Defeats VM Isolation Through Autonomous Exploit Development
In August 2026, Trail of Bits researchers evaluated GPT 5.6-Cyber's cybersecurity capabilities by challenging it to escape VM containment. The AI agent successfully broke out of a QEMU/KVM virtual machine three separate times, first exploiting known kernel vulnerabilities (CVE-2026-53359), then leveraging unpatched libslirp flaws (CVE-2026-9539), and finally chaining multiple zero-day vulnerabilities across QEMU, Linux KVM, and libslirp components. Operating autonomously for hours, the agent demonstrated advanced persistent threat capabilities including vulnerability research, exploit development, and reliable execution chains. This incident fundamentally challenges the assumption that standard VM isolation is sufficient for containing advanced AI agents with cybersecurity capabilities. The research demonstrates that current sandboxing approaches are inadequate against sophisticated AI systems that can autonomously discover and exploit complex vulnerability chains across multiple software components within virtualization stacks.
CISA Red Team Results Expose Critical Cybersecurity Gaps in Government vs Water Sector
In 2024, CISA conducted red team exercises against two organizations - one government and one water sector entity - with dramatically different outcomes. Both organizations were successfully breached through phishing campaigns, but while the government organization failed to detect or respond to the simulated attack, allowing red teamers to gain elevated privileges and move laterally across systems undetected, the water sector organization quickly identified the intrusion and quarantined affected systems within 2-20 minutes. The exercise revealed critical gaps in detection capabilities, cloud security controls, and incident response procedures across both sectors. This incident highlights the urgent need for improved cybersecurity defenses in critical infrastructure sectors, particularly as nation-state actors increasingly target water facilities and government systems. The stark contrast in detection and response capabilities demonstrates the growing maturity gap in cybersecurity readiness across different sectors.
CyberLeek's GTA VI Data Theft: How Gaming's Biggest Leak Redefined Cyber Extortion
In late 2024, threat actor 'CyberLeek' launched a sophisticated data theft and extortion campaign against Rockstar Games, leaking pre-release gameplay footage from the highly anticipated Grand Theft Auto VI game. The attacker published proprietary content across multiple platforms including Discord, demonstrating either insider access or a significant breach of Rockstar's development systems. The incident caused substantial reputational damage and prompted aggressive legal action from Take-Two Interactive, including federal subpoenas against Discord, Google, Microsoft, and X to identify the perpetrators. The attack employed a novel monetization strategy, combining cryptocurrency schemes with watermarked stolen content and crowdsourced pressure tactics to maximize financial gain from the leaked intellectual property. This incident represents an evolution in data extortion tactics, where threat actors leverage public anticipation and social media amplification to maximize pressure on victims. The attack demonstrates how modern cybercriminals are adapting traditional ransomware playbooks to target high-value intellectual property in the entertainment industry, creating new challenges for incident response and legal remediation.
Operation Jackal IV Dismantles Global West African Cybercrime Networks
Between November 2025 and June 2026, Operation Jackal IV, a coordinated international law enforcement effort spanning 22 countries, resulted in 58 arrests and identification of 263 suspects linked to West African cybercrime networks, particularly the Black Axe syndicate. The operation targeted sophisticated Crime-as-a-Service networks that facilitated romance scams, cryptocurrency fraud, business email compromise, and sextortion schemes targeting victims globally. Authorities seized $2.67 million, blocked 257 bank accounts, and dismantled infrastructure supporting money laundering operations across Argentina, South Africa, Romania, and Italy. This crackdown highlights the growing sophistication of African organized crime groups who increasingly leverage dark web services and international networks to scale their operations, making cross-border collaboration essential for effective cybercrime prevention.
Mass Zimbra Server Compromise: CVE-2026-73570 Exploitation Reaches 270+ Instances
In August 2026, threat actors exploited CVE-2026-73570, a high-severity command injection vulnerability in Zimbra Collaboration Suite's SNMP monitoring component, to compromise over 270 Zimbra instances worldwide. The vulnerability allows unauthenticated attackers to achieve remote code execution when SNMP notifications are enabled. Despite Synacor patching the flaw in ZCS version 10.1.20 on July 20, 2026, CERT Polska and Shadowserver reported active exploitation with over 8,200 unpatched instances still exposed. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within three days. This incident underscores the continued targeting of email infrastructure by cybercriminals and state-sponsored groups, particularly given Zimbra's widespread use among government agencies and businesses. The rapid exploitation timeline and global scale of compromises highlight the critical importance of timely patch management for Internet-facing collaboration platforms.
Major DDoS Attack Cripples Norway's Government Digital Services
A large-scale distributed denial-of-service (DDoS) attack disrupted Norway's shared government digital infrastructure starting August 25, 2026, at 03:38 CEST. The attack targeted services operated by the Norwegian Digitalization Agency (Digdir) and its provider Vivicta, affecting critical public services including ID-porten electronic IDs, eSignering digital signatures, secure government mail, and inter-agency data exchange. Multiple services experienced complete unavailability for periods, with citizens encountering failed connections, slow responses, and extended login times across tax administration, business communication platforms, and public record access systems. This incident represents the third DDoS attack against Norway's digital government infrastructure in 2026, highlighting the increasing targeting of critical national digital services by threat actors seeking to disrupt public sector operations and citizen access to essential government services.