Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Urgent: Patch Critical Vulnerability in Progress Kemp LoadMaster Now
In June 2026, a critical vulnerability (CVE-2026-8037) was identified in Progress Kemp LoadMaster appliances, allowing unauthenticated attackers to execute arbitrary commands remotely. This command injection flaw, present in the 'escape_quotes()' function, enables attackers to gain root access without valid credentials. ([hackerposts.org](https://www.hackerposts.org/en/blog/progress-kemp-loadmaster-cve-2026-8037-preauth-rce?utm_source=openai)) Exploitation attempts began on June 29, 2026, following the public release of a proof-of-concept exploit. ([esentire.com](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037?utm_source=openai)) The inclusion of this vulnerability in CISA's Known Exploited Vulnerabilities catalog underscores the urgency for organizations to apply the necessary patches promptly to mitigate potential threats. ([aha.org](https://www.aha.org/h-isac-white-reports/2026-07-01-h-isac-tlp-white-threat-bulletin-observed-exploitation-attempts-targeting-critical-progress?utm_source=openai))
Citrix NetScaler CVE-2025-7775: Critical Vulnerability Exploited in the Wild
On August 26, 2025, Citrix disclosed a critical vulnerability (CVE-2025-7775) in NetScaler ADC and NetScaler Gateway products, which was actively exploited in the wild. This memory overflow flaw allows unauthenticated remote code execution and denial of service attacks on unpatched devices. The vulnerability affects versions 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241-FIPS/NDcPP, and 12.1-FIPS/NDcPP up to 12.1-55.330-FIPS/NDcPP. Citrix released security updates to address this issue and urged immediate patching due to the lack of available mitigations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/citrix-fixes-critical-netscaler-rce-flaw-exploited-in-zero-day-attacks/amp/?utm_source=openai)) The active exploitation of CVE-2025-7775 underscores the persistent targeting of critical infrastructure by threat actors. Organizations relying on NetScaler products must prioritize patching to mitigate potential risks. This incident highlights the importance of timely vulnerability management and the need for robust security practices to defend against evolving cyber threats.
Critical N-able N-central Vulnerability Exploited: Immediate Action Required
In August 2026, N-able's N-central platform, widely used by Managed Service Providers (MSPs) for remote IT management, was found to have a critical vulnerability (CVE-2026-18577) that allowed unauthenticated attackers to gain full administrative access. Exploiting this flaw, attackers could run scripts, deploy tools, and open remote sessions across all managed endpoints. The vulnerability stemmed from an incomplete fix of a previous issue (CVE-2026-18556). N-able released Hotfix 2 to address this, urging all on-premise users to apply the patch immediately. Hosted instances received automatic updates. Organizations were also advised to monitor their environments closely for signs of compromise. ([itpro.com](https://www.itpro.com/security/cyber-attacks/msps-urged-to-patch-immediately-after-n-able-issues-hotfix-for-n-central-god-mode-flaw?utm_source=openai)) This incident underscores the critical importance of timely patch management and vigilant monitoring in IT environments. The rapid exploitation of such vulnerabilities highlights the evolving tactics of threat actors and the necessity for organizations to stay ahead with proactive security measures.
CISA Highlights Critical Vulnerability in Progress LoadMaster: CVE-2026-8037
In August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation of this critical command injection vulnerability in Progress Software's LoadMaster appliance. This flaw allows unauthenticated attackers to execute arbitrary commands via unsanitized input in multiple API endpoints, potentially leading to full system compromise. Organizations utilizing affected versions are urged to apply patches immediately to mitigate the risk of unauthorized access and data breaches. The inclusion of CVE-2026-8037 in the KEV Catalog underscores the persistent threat posed by command injection vulnerabilities, which remain a favored attack vector for cyber adversaries. This incident serves as a critical reminder for organizations to prioritize timely remediation of known vulnerabilities and to implement robust input validation mechanisms to prevent similar exploits.
Atlassian Rovo Vulnerability: A Wake-Up Call for AI Security
In August 2026, security researchers identified vulnerabilities in Atlassian's Rovo AI assistant that could be exploited to exfiltrate data from Jira and Confluence. PromptArmor discovered that embedding malicious instructions within content processed by Rovo allowed unauthorized data collection and transmission to external servers. Separately, Varonis Threat Labs found that manipulating the 'rovoChatPrompt' URL parameter enabled attackers to execute commands with a user's privileges, leading to data exfiltration. Atlassian addressed the URL parameter issue on July 8, 2026, but the content-based vulnerability remained unpatched as of August 5, 2026. This incident underscores the growing security challenges associated with integrating AI assistants into enterprise environments. It highlights the necessity for organizations to implement stringent access controls, continuously monitor AI interactions, and promptly address vulnerabilities to prevent unauthorized data access and exfiltration.
The Rise of Identity-Based Cyber Attacks in 2026
In 2026, the cybersecurity landscape witnessed a significant shift towards identity-based attacks, with nearly 90% of incidents involving compromised identities. Attackers increasingly utilized techniques such as credential theft, multifactor authentication (MFA) manipulation, session hijacking, and social engineering to gain unauthorized access. Once inside, they established persistence, escalated privileges, and moved laterally across environments, often mimicking legitimate administrative behavior, making detection challenging. This trend underscores the critical need for organizations to enhance identity security measures and adopt a zero-trust approach to mitigate such threats. The rise in identity-driven attacks highlights the evolving tactics of threat actors who exploit human factors and identity weaknesses rather than traditional technical vulnerabilities. This shift necessitates a reevaluation of security strategies, emphasizing robust identity and access management, continuous monitoring, and user education to prevent unauthorized access and potential data breaches.
New CSS Attacks Expose Webmail Vulnerabilities: Protect Your Accounts
In August 2026, PortSwigger researcher Gareth Heyes unveiled a series of CSS-based attacks capable of breaching webmail defenses across platforms like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These techniques exploit vulnerabilities in HTML and CSS handling within webmail interfaces, allowing attackers to capture passwords, hijack third-party accounts, leak tokens, and manipulate AI tools that process emails. The research, presented at Black Hat USA 2026, demonstrated proof-of-concept attacks without evidence of malicious exploitation. Some providers have since addressed specific vulnerabilities, but others remain unpatched. This incident underscores the evolving nature of web-based threats, highlighting the need for continuous vigilance and proactive security measures. As attackers develop more sophisticated methods to exploit webmail platforms, organizations must prioritize regular security assessments and updates to protect sensitive user information.
Cyberattack Disrupts North Carolina Ports Operations in August 2026
In early August 2026, the North Carolina Ports Authority experienced a cyberattack that disrupted IT systems across the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The incident, detected on August 4, led to a system-wide outage, causing operational delays and affecting cargo handling. The authority activated its cybersecurity contingency plan, initiating recovery efforts on August 5. While operations began returning to normal by August 7, residual delays persisted as system restoration continued. The specific nature of the attack, the threat actor involved, and whether sensitive data was compromised remain undisclosed. This incident underscores the escalating cyber threats targeting critical infrastructure, particularly in the maritime sector. Ports are increasingly becoming focal points for cyberattacks, highlighting the need for robust cybersecurity measures and contingency planning to mitigate operational disruptions and safeguard sensitive data.
Real Emails, Hijacked Payments: Analyzing Two H1 2026 Attack Chains
In the first half of 2026, cybercriminals executed sophisticated campaigns exploiting trusted systems to deliver malware. One campaign involved compromised corporate email accounts sending legitimate-looking business emails with malicious attachments, leading to banking malware that manipulated proxy settings and browser extensions to intercept financial transactions. Another campaign utilized a Rust-based clipboard hijacker that monitored and replaced cryptocurrency wallet addresses copied to the clipboard, redirecting funds to attacker-controlled wallets. These incidents highlight a shift towards attacks that exploit existing trust mechanisms, making detection and prevention more challenging. Organizations must enhance their security measures to monitor for unusual activities within trusted workflows and educate users on verifying transaction details to mitigate such threats.
Levi Strauss 2026 Cyberattack: A Social Engineering Case Study
In August 2026, Levi Strauss & Co. disclosed a cybersecurity incident where attackers employed social engineering tactics to compromise three employees' computers, leading to the exfiltration of corporate data. The company acted swiftly to contain the breach, ensuring that consumer data remained unaffected and business operations continued without disruption. While no specific threat actor has claimed responsibility, some reports suggest a potential link to UNC6671, known for sophisticated voice phishing campaigns targeting corporate environments. This incident underscores the evolving threat landscape where social engineering attacks are becoming increasingly prevalent. Organizations must bolster their defenses against such tactics, emphasizing employee training and robust security protocols to mitigate risks associated with human-centric attack vectors.
Unlimited Technology Systems Data Breach: A Wake-Up Call for Healthcare Cybersecurity
In October 2025, Unlimited Technology Systems, a healthcare software provider, detected unauthorized access within its commercial data center. Between October 5 and October 10, 2025, an unauthorized actor accessed files containing sensitive personal and health information of approximately 3.8 million individuals. The compromised data included names, Social Security numbers, dates of birth, contact details, government IDs, insurance information, and medical records. The breach was discovered on October 19, 2025, and the company initiated an investigation with a cybersecurity forensic firm. Notifications to affected individuals began on July 1, 2026, with offers of identity monitoring services through Kroll. No ransomware or data-extortion groups have publicly claimed responsibility, and the perpetrators remain unidentified. This incident underscores the critical importance of robust cybersecurity measures for third-party vendors handling sensitive healthcare data. The breach highlights the potential risks associated with vendor vulnerabilities and the cascading impact on healthcare providers and patients. Organizations must prioritize comprehensive security protocols and timely breach disclosures to mitigate such risks.
New macOS Malware Campaign Drains Cryptocurrency Wallets via 'ClickFix' Attacks
In August 2026, a sophisticated macOS malware campaign was identified, leveraging 'ClickFix' social engineering techniques to distribute a Go-based infostealer. This malware targets sensitive user data, including browser-stored passwords, Apple iCloud Keychain data, and cryptocurrency wallets. The attack initiates when users are deceived into executing a command in the Terminal, leading to the download of a shell script that profiles the system and fetches a Mach-O payload compatible with the device's architecture. The payload then exfiltrates the harvested data to a remote server controlled by the attackers. Notably, the malware includes a 'DRAIN' function capable of siphoning funds from various cryptocurrency wallets, such as Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP, by transferring a portion or the entirety of the funds to attacker-controlled accounts. The infrastructure supporting these malicious activities has been traced back to Aeza Group, a Russian bulletproof hosting provider previously sanctioned by the U.S., U.K., and Australia for facilitating cybercriminal operations. This incident underscores the evolving threat landscape targeting macOS users, highlighting the need for heightened vigilance against social engineering tactics and the importance of robust security measures to protect sensitive information and digital assets.