Find what you’re looking for
Browse everything
6,892 results in Threat Reports
Critical Remote Code Execution Vulnerability in iCagenda Joomla Extension (CVE-2026-48939)
In June 2026, a critical vulnerability (CVE-2026-48939) was identified in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files via the file attachment feature. This flaw, present in versions prior to 3.9.15 and 4.0.8, enables remote code execution, potentially compromising the entire web server. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on July 10, 2026, following reports of active exploitation in the wild. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-48939?utm_source=openai)) The exploitation of CVE-2026-48939 underscores a broader trend of attackers targeting vulnerabilities in widely used content management system (CMS) extensions. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their web applications to prevent unauthorized access and potential data breaches.
AI-Generated PowerShell Script Used in Active Directory Attack
In early June 2026, cybersecurity researchers identified an intrusion where an unknown threat actor utilized an AI-generated PowerShell script to enumerate an Active Directory (AD) environment. The attacker gained Remote Desktop Protocol (RDP) access to a domain-joined Windows Server using pre-compromised credentials, then executed a PowerShell script titled "100% Working AD Information Gathering Script - FULLY FIXED." This script aggressively mapped users, computers, and domains, creating an AD_Report.html to summarize the enumeration. Following this, the attacker deployed legitimate tools like s5cmd.exe and SharpShares.exe to identify and exfiltrate accessible data repositories. ([itsecurityguru.org](https://www.itsecurityguru.org/2026/07/08/huntress-uncovers-vibe-coded-malware-used-to-map-active-directory-environments/?utm_source=openai)) This incident underscores the evolving threat landscape where AI-generated tools are lowering the barrier to entry for cybercriminals, enabling rapid development of custom, evasive malware. The use of AI in cyberattacks is accelerating, allowing threat actors to execute damaging campaigns more swiftly than ever before. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/vibe-coded-malware-ai-powershell/?utm_source=openai))
Forg365 PhaaS: A New Threat to Microsoft 365 Security
In July 2026, a new phishing-as-a-service (PhaaS) platform named Forg365 emerged, targeting Microsoft 365 accounts. Forg365 employs a combination of device code phishing, adversary-in-the-middle (AiTM) tactics, AI-assisted lure creation, and post-compromise mailbox operations. Distributed via Telegram, the service costs $400 per month or $3,800 annually. Attackers utilize legitimate email delivery services like Amazon SES and Twilio SendGrid to craft convincing phishing emails, leading victims to Forg365-controlled domains. The platform's operator panel offers features such as AI-generated phishing emails, campaign management, and a browser extension named ForgCookie, which maintains persistent access to compromised accounts by refreshing Microsoft single sign-on cookies. The emergence of Forg365 underscores the increasing sophistication and accessibility of phishing tools, enabling even low-skilled threat actors to execute complex attacks. This trend highlights the urgent need for organizations to enhance their email security measures, implement robust multi-factor authentication, and educate users about evolving phishing tactics to mitigate the risk of account compromise.
MemGhost Attack: A New Threat to AI Assistant Security
In July 2026, cybersecurity researchers identified a novel attack vector named 'MemGhost,' which exploits AI assistants equipped with persistent memory. By sending a single, specially crafted email, attackers can implant false information into the assistant's memory without user detection. This manipulation allows the AI to provide altered responses in future interactions, potentially leading to misinformation or unauthorized actions. The attack leverages the assistant's ability to autonomously process emails and update its knowledge base, making it particularly insidious. The MemGhost attack underscores the emerging vulnerabilities associated with AI systems that maintain long-term user data. As AI assistants become more integrated into daily workflows, the potential for such memory poisoning attacks increases, highlighting the need for robust security measures to protect against unauthorized data manipulation.
Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability in 2026
In early July 2026, the Anubis ransomware group exploited a critical vulnerability known as Citrix Bleed 2 (CVE-2025-5777) in Citrix NetScaler appliances to gain unauthorized access to enterprise networks. This flaw allowed attackers to bypass multi-factor authentication by stealing session tokens, leading to the compromise of 91 organizations across sectors such as healthcare, financial services, manufacturing, and technology. The attackers utilized legitimate remote management tools to maintain persistence and evade detection, culminating in the deployment of ransomware that encrypted critical data and disrupted operations. This incident underscores the persistent threat posed by unpatched vulnerabilities and the sophisticated tactics employed by ransomware groups. The exploitation of Citrix Bleed 2 highlights the importance of timely patch management and the need for comprehensive monitoring of remote access tools to detect and prevent unauthorized activities.
Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials
In July 2026, security researchers identified a widespread scanning campaign targeting Model Context Protocol (MCP) servers and AI assistant credential files. Attackers systematically probed internet-facing systems for exposed MCP endpoints and configuration files associated with AI development tools, aiming to exploit misconfigurations and gain unauthorized access. This reconnaissance activity underscores the critical need for organizations to secure their AI infrastructure against emerging threats. The incident highlights a growing trend of attackers focusing on AI-related assets, exploiting the rapid adoption of AI technologies and potential security oversights. Organizations must proactively implement robust security measures to protect sensitive AI systems and data from evolving cyber threats.
RedHook Android Malware Exploits Wireless ADB for Unauthorized Access
In July 2026, cybersecurity researchers identified a new variant of the RedHook Android malware that exploits the Wireless Android Debug Bridge (ADB) feature to gain shell-level access without a computer connection. By deceiving users into granting Accessibility permissions, RedHook enables Developer Options and activates Wireless Debugging, allowing it to connect to the device's ADB service via the loopback interface. This grants the malware elevated privileges, enabling it to stream screens, intercept keystrokes, automate UI interactions, and steal credentials. The attack does not require device rooting, making it effective across all Android devices where users approve the Accessibility Service request. This incident underscores the evolving sophistication of mobile malware, highlighting the need for heightened vigilance among Android users. The exploitation of legitimate features like Wireless ADB for malicious purposes reflects a broader trend of attackers leveraging built-in functionalities to bypass security measures, emphasizing the importance of cautious permission granting and regular security updates.
Global CMS Exploitation Campaign: Protect Your Website Now
In July 2026, the Australian Cyber Security Centre (ACSC) issued an alert regarding a global exploitation campaign targeting vulnerabilities in content management systems (CMS) and associated plugins. Threat actors are actively scanning websites to deploy webshells, leveraging flaws in platforms such as WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE. This campaign has significantly impacted small to medium-sized Australian businesses, leading to service disruptions, credential theft, malware deployment, and potential lateral movement within networks. The ACSC highlighted that the campaign might be supported by artificial intelligence, enabling threat actors to accelerate attacks and scale the exploitation of emerging vulnerabilities. Website administrators are urged to apply the latest security updates, remove unused components, enable automatic updates where possible, and implement additional security measures to mitigate the risk of compromise.
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Between February 2024 and April 2026, cybersecurity researchers identified sustained cyber espionage activities targeting Pakistani law enforcement agencies, notably the Balochistan Police. These campaigns, attributed to threat actors linked to China and India, involved the compromise of servers hosting sensitive web applications managing police and citizen data. The attackers employed sophisticated techniques, including multi-stage malware deployment and exploitation of unpatched vulnerabilities, to infiltrate and maintain persistent access to these critical systems. The breaches resulted in unauthorized access to confidential information, posing significant risks to national security and public safety. This incident underscores a growing trend of state-sponsored cyber espionage targeting law enforcement and government institutions in South Asia. The convergence of multiple nation-state actors focusing on similar targets highlights the strategic importance of such entities and the escalating cyber threats they face. Organizations must enhance their cybersecurity posture to defend against increasingly sophisticated and persistent adversaries.
jscrambler npm Package Compromise: A Wake-Up Call for Developer Security
On July 11, 2026, the jscrambler npm package version 8.14.0 was compromised, introducing a preinstall hook that deployed a Rust-based infostealer upon installation. This malicious code targeted developer environments across Windows, macOS, and Linux platforms, exfiltrating sensitive data such as cloud credentials, cryptocurrency wallets, password manager vaults, and session tokens for various applications. The attack was identified within minutes of the release, but the exact number of affected systems remains undetermined. This incident underscores the escalating threat of supply chain attacks within the software development ecosystem. The rapid detection highlights the importance of vigilant monitoring and swift response mechanisms. Organizations must prioritize securing their development pipelines and implement robust verification processes to mitigate the risks associated with third-party dependencies.
Ghostcommit: Unveiling the AI Code Review Exploit via Image-Based Prompt Injection
In July 2026, researchers from the University of Missouri-Kansas City's ASSET Research Group unveiled 'Ghostcommit,' a sophisticated supply chain attack that exploits AI code reviewers by embedding prompt injections within image files. The attack involves submitting a pull request containing a PNG image with hidden instructions that, when processed by AI agents, extract sensitive information from the repository's environment files and encode them into the source code as innocuous-looking data. This method effectively bypasses traditional code review processes, as images are typically not scrutinized for malicious content. The 'Ghostcommit' attack underscores a critical vulnerability in AI-assisted development workflows, highlighting the need for enhanced scrutiny of non-textual assets in code reviews. As AI integration in software development continues to grow, understanding and mitigating such novel attack vectors becomes imperative to maintain the integrity and security of development pipelines.
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
On July 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-48939 and CVE-2026-56291. CVE-2026-48939 is a critical remote code execution vulnerability in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files on the server. CVE-2026-56291 pertains to the Balbooa Forms extension, enabling similar unauthorized file uploads leading to potential server compromise. Both vulnerabilities have been actively exploited in the wild, posing significant risks to organizations using these Joomla extensions. The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched software components in widely used content management systems. Organizations are urged to prioritize the remediation of these vulnerabilities to prevent potential data breaches and system compromises.