Find what you’re looking for
Browse everything
6,917 results in Threat Reports
Critical Vulnerabilities in Avada Builder Plugin Affect Over One Million WordPress Sites
In May 2026, two critical vulnerabilities were discovered in the Avada Builder WordPress plugin, affecting over one million active installations. The first, CVE-2026-4782, is an arbitrary file read vulnerability exploitable by authenticated users with at least subscriber-level access, allowing them to read sensitive files on the server. The second, CVE-2026-4798, is a time-based blind SQL injection vulnerability that can be exploited without authentication, enabling attackers to extract sensitive information from the database, including password hashes. Both vulnerabilities have been patched in version 3.15.3 of the plugin. This incident underscores the importance of timely software updates and the potential risks associated with widely used plugins. Organizations should prioritize patch management and consider implementing additional security measures to protect against similar vulnerabilities in the future.
Node-ipc npm Package Compromised: A Wake-Up Call for Open-Source Security
In May 2026, malicious versions of the widely used node-ipc npm package were published, introducing credential-stealing malware into applications. The compromised versions—9.1.6, 9.2.3, and 12.0.1—contained obfuscated code that, upon execution, harvested sensitive information such as cloud credentials, SSH keys, and CI/CD secrets. This data was exfiltrated through DNS TXT queries to attacker-controlled infrastructure. The attack was facilitated by the compromise of a maintainer's account, allowing unauthorized publication of these malicious versions. ([stepsecurity.io](https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises, as the reliance on third-party packages continues to grow.
Pwn2Own Berlin 2026: Critical Zero-Day Exploits in Microsoft Exchange and Windows 11
During the second day of Pwn2Own Berlin 2026, security researchers demonstrated 15 unique zero-day vulnerabilities across multiple products, including Microsoft Exchange, Windows 11, and Red Hat Enterprise Linux for Workstations. Notably, Cheng-Da Tsai of the DEVCORE Research Team earned $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. Additionally, Siyeon Wi exploited an integer overflow bug to hack Windows 11, and Ben Koo of Team DDOS escalated privileges to root on Red Hat Enterprise Linux for Workstations, earning $7,500 and $10,000 respectively. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/windows-11-and-microsoft-edge-hacked-on-first-day-of-pwn2own-berlin-2026/?utm_source=openai)) This incident underscores the persistent vulnerabilities in widely used enterprise software and highlights the critical need for organizations to prioritize timely patching and robust security measures to mitigate the risks associated with zero-day exploits.
Critical Vulnerability in Funnel Builder Plugin Leads to Credit Card Theft
In May 2026, a critical vulnerability in the Funnel Builder plugin for WordPress was actively exploited to inject malicious JavaScript into WooCommerce checkout pages. This flaw, present in versions prior to 3.15.0.3, allowed unauthenticated attackers to modify the plugin's global settings via an unprotected checkout endpoint, leading to the execution of malicious code on checkout pages. The injected code facilitated a payment card skimmer that stole sensitive customer information, including credit card numbers, CVVs, billing addresses, and other personal data. FunnelKit addressed the vulnerability by releasing version 3.15.0.3, urging users to update immediately and review their settings for any unauthorized scripts. This incident underscores the persistent threat posed by vulnerabilities in widely-used plugins, emphasizing the need for regular updates and vigilant monitoring of third-party components in web applications. The exploitation of such vulnerabilities can lead to significant data breaches, financial loss, and reputational damage for businesses, highlighting the critical importance of proactive cybersecurity measures.
Turla's Kazuar Backdoor Evolves into Modular P2P Botnet
In May 2026, the Russian state-sponsored hacking group Turla, also known as Secret Blizzard, transformed its custom backdoor, Kazuar, into a modular peer-to-peer (P2P) botnet designed for stealth and persistent access to compromised hosts. This evolution includes three distinct modules: Kernel, Bridge, and Worker, each serving specific roles to enhance flexibility and reduce detection. The Kernel module coordinates tasks and manages communication, the Bridge module acts as a proxy to the command-and-control server, and the Worker module performs data collection and system monitoring. This modular architecture allows Turla to maintain long-term access to targeted systems, primarily within government, diplomatic, and defense sectors in Europe and Central Asia. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/?utm_source=openai)) The significance of this development lies in the increasing sophistication of state-sponsored cyber threats. Turla's adoption of a modular P2P botnet architecture exemplifies a trend towards more resilient and stealthy malware, posing heightened challenges for detection and mitigation. Organizations must enhance their cybersecurity measures to address these evolving threats effectively.
Critical Nginx UI Vulnerability (CVE-2026-33032) Exposes Servers to Full Takeover
In March 2026, a critical vulnerability (CVE-2026-33032) was discovered in Nginx UI, a web-based management interface for Nginx servers. This flaw, present in versions up to 2.3.5, allows unauthenticated remote attackers to gain full control over the Nginx service by exploiting the /mcp_message endpoint, which lacks proper authentication and has an empty default IP whitelist. Attackers can restart the server, modify configurations, and trigger automatic reloads, leading to complete service takeover. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-33032?utm_source=openai)) The urgency to address this vulnerability is heightened by active exploitation in the wild, with numerous exposed instances globally. Organizations using affected versions are strongly advised to update to the latest release or implement recommended mitigations to prevent potential breaches and service disruptions. ([network-security-magazine.com](https://www.network-security-magazine.com/network-security/network-security-news/nginx-ui-cve-2026-33032-actively-exploited/?utm_source=openai))
Instructure's Canvas Platform Breached Twice by ShinyHunters in May 2026
In early May 2026, Instructure's Canvas learning management system suffered two significant cyberattacks by the ShinyHunters group. The initial breach on April 29 exposed sensitive data of approximately 275 million users across nearly 9,000 educational institutions, including names, email addresses, student ID numbers, and private messages. Despite Instructure's efforts to secure the system, ShinyHunters re-compromised Canvas on May 7, defacing login pages and issuing ransom demands. The attacks disrupted operations during critical exam periods, leading to delays and cancellations of final exams at numerous colleges and universities. In response, Instructure reached an agreement with the attackers, reportedly paying a ransom to secure the return and destruction of the stolen data, though the exact terms were not disclosed. This incident underscores the escalating threat of cyberattacks targeting educational institutions and the challenges in safeguarding sensitive student and staff information. ([techradar.com](https://www.techradar.com/pro/security/us-congress-calls-instructure-ceo-as-it-investigates-canvas-breach?utm_source=openai))
Instructure Canvas Breach: A Wake-Up Call for Educational Cybersecurity
In May 2026, Instructure, the company behind the Canvas learning management system, suffered a significant data breach orchestrated by the hacking group ShinyHunters. The attackers exploited vulnerabilities to access and exfiltrate approximately 3.65 terabytes of data, affecting nearly 275 million individuals across 8,809 educational institutions worldwide. The compromised information included names, email addresses, student ID numbers, and private messages between students and staff. Following the initial breach, ShinyHunters escalated their attack by defacing Canvas login portals, disrupting access during critical academic periods and demanding a ransom to prevent the public release of the stolen data. This incident underscores the escalating threat posed by cybercriminal groups targeting educational institutions, highlighting the critical need for robust cybersecurity measures and incident response strategies. The breach also raises concerns about the effectiveness of paying ransoms, as Instructure's decision to negotiate with the attackers has sparked debate over best practices in handling such extortion attempts.
Taiwan High Speed Rail Radio Hack: A Wake-Up Call for Critical Infrastructure Security
In April 2026, a 23-year-old university student in Taiwan exploited vulnerabilities in the Taiwan High Speed Rail's (THSR) radio communication system, using software-defined radio equipment to transmit a false 'General Alarm' signal. This unauthorized transmission caused four high-speed trains to halt for 48 minutes, disrupting operations and highlighting significant security flaws in critical infrastructure. The student was arrested and released on bail, facing charges related to endangering public transportation safety. ([taipeitimes.com](https://www.taipeitimes.com/News/taiwan/archives/2026/05/05/2003856781?utm_source=openai)) This incident underscores the pressing need for robust cybersecurity measures in transportation systems, especially as similar vulnerabilities have been exploited in other countries. It serves as a wake-up call for infrastructure operators worldwide to reassess and fortify their communication protocols against potential cyber threats.
CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits
In May 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2026-20182, affecting Cisco Catalyst SD-WAN Controllers and Managers, to its Known Exploited Vulnerabilities (KEV) catalog. This authentication bypass flaw allows unauthenticated remote attackers to gain administrative privileges on affected systems. Exploitation has been linked to the threat actor cluster UAT-8616, which has previously targeted similar vulnerabilities to gain unauthorized access to SD-WAN systems. The attackers have been observed adding SSH keys, modifying NETCONF configurations, and escalating privileges to root. ([thehackernews.com](https://thehackernews.com/2026/05/cisa-adds-cisco-sd-wan-cve-2026-20182.html?utm_source=openai)) The inclusion of CVE-2026-20182 in the KEV catalog underscores the ongoing threat posed by sophisticated actors targeting critical infrastructure. Organizations utilizing Cisco SD-WAN solutions must prioritize patching and implementing recommended mitigations to prevent potential breaches and maintain network security.
Critical XSS Vulnerability CVE-2026-42897 Exploited in Microsoft Exchange Server
In May 2026, Microsoft disclosed a critical cross-site scripting (XSS) vulnerability, CVE-2026-42897, affecting on-premises versions of Exchange Server 2016, 2019, and Subscription Edition. This flaw allows unauthorized attackers to perform spoofing attacks over a network by sending specially crafted emails. When such an email is opened in Outlook Web Access (OWA) under certain conditions, arbitrary JavaScript can be executed in the user's browser context. Microsoft confirmed active exploitation of this vulnerability in the wild, prompting immediate mitigation measures. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/15/exchange-server-cve-2026-42897-exploited/?utm_source=openai)) The urgency of addressing CVE-2026-42897 is heightened by its active exploitation and the widespread use of affected Exchange Server versions. Organizations relying on on-premises email infrastructure are at significant risk, necessitating prompt application of Microsoft's recommended mitigations to prevent potential data breaches and maintain operational integrity. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498/replies/4519822?utm_source=openai))
OpenAI's Response to the TanStack npm Supply Chain Attack
In May 2026, OpenAI disclosed that two employee devices were compromised due to a supply chain attack involving the TanStack npm library, part of the broader 'Mini Shai-Hulud' campaign. The attackers published 84 malicious versions across 42 TanStack packages, leading to unauthorized access and credential-focused exfiltration activities. OpenAI's investigation confirmed that only limited credential material was exfiltrated, with no evidence of user data, production systems, or intellectual property being compromised. ([openai.com](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely used open-source libraries, emphasizing the need for robust security measures in software development and deployment processes. Organizations are urged to enhance their monitoring and validation of third-party components to mitigate such risks.