Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Critical Windows VBS Enclave Vulnerability Exposes New Privilege Escalation Vector
Security researchers at Doyensec discovered a critical privilege escalation vulnerability (CVE-2026-83498) in Windows SmartScreen's VBS enclave that allowed arbitrary code execution within Microsoft's most protected memory space. The flaw, rated Critical with CVSS 7.8, exploited a four-byte write vulnerability and timing bug in the SFAPE.dll component responsible for Enhanced Phishing Protection. By chaining these weaknesses, attackers with local system access could break enclave isolation and execute malicious code in VTL1 (Isolated User Mode), bypassing Windows' strongest security boundaries. Microsoft patched the vulnerability in the September 8, 2026 cumulative update KB5124008. This research highlights the growing sophistication of privilege escalation attacks targeting hardware-backed security features like VBS enclaves, coinciding with increased focus on supply chain security and the critical need for defense-in-depth strategies as attackers evolve beyond traditional kernel-level compromises.
How an AI Agent Exposed Critical Authentication Flaws in Enterprise Systems
In October 2026, Reflectiz's AI pentesting agent autonomously discovered a critical authentication bypass vulnerability on a major insurance company's production website with millions of users. The flaw allowed attackers to manipulate one-time passcode (OTP) delivery by changing the channel from SMS to email and redirecting codes to attacker-controlled addresses, completely bypassing the account verification process. The AI agent successfully exploited the vulnerability during an authorized assessment, demonstrating how authentication controls can be circumvented through parameter manipulation in login requests. This incident highlights the growing sophistication of AI-powered security testing and the persistent weakness in OTP implementations across enterprise applications, as organizations increasingly rely on multi-factor authentication while failing to properly validate delivery mechanisms.
CISA Issues KEV Alert for Microsoft Windows and Ivanti Vulnerabilities Under Active Attack
CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. CVE-2026-96951 affects Microsoft Windows systems through command injection flaws, while CVE-2026-104935 targets Ivanti Connect Secure appliances via authentication bypass through spoofing mechanisms. These vulnerabilities are being actively exploited by threat actors to gain initial access and establish persistence in enterprise environments, posing significant risks to federal and private sector organizations. This incident highlights the ongoing trend of attackers targeting network infrastructure and authentication systems to bypass perimeter defenses. With the rise of sophisticated threat actors exploiting zero-day and recently disclosed vulnerabilities at an accelerated pace, organizations face increasing pressure to implement rapid patch management and zero-trust security models.
Hirudo Android Trojan Escalates Mobile Banking Threats with Patched App Replacement Attack
In October 2026, cybersecurity researchers discovered Hirudo, a sophisticated Android banking trojan that represents a significant escalation in mobile financial fraud. Unlike traditional banking malware that overlays fake interfaces, Hirudo replaces legitimate banking applications with patched versions designed to bypass built-in security checks from within the app itself. The malware targets eight Indonesian banking apps and credentials across Indonesia, China, India, Mexico, Morocco, and Thailand. Distributed through fake shopping, entertainment, and adult video apps via Meta advertisements, Hirudo combines credential theft, device takeover, screen capture, and SMS interception capabilities with a mature backend infrastructure. This incident demonstrates the evolution of Android banking trojans toward more sophisticated application tampering techniques that challenge traditional mobile security assumptions. The shift from external overlays to internal app manipulation represents a new threat vector that requires enhanced server-side verification and integrity checking mechanisms.
AI Revolutionizes Cyber Attacks: Chrome Zero-Day Chain Built in 6 Days
In August 2026, security firm XBOW demonstrated a critical advancement in AI-assisted vulnerability research by using OpenAI's GPT-5.6 Sol model to develop a full-chain Chrome exploit in just six days. The team chained three zero-day vulnerabilities (CVE-2026-85045, CVE-2026-78952, and an animated WebP decoder bug) to achieve remote code execution on Windows systems through Chrome's nested sandbox protections. Google confirmed all vulnerabilities, implemented fixes in Chrome versions 152.0.7977.65 and 152.0.7977.82, and awarded XBOW the maximum $250,000 bounty reward. The exploit required only loading a malicious webpage, affecting an estimated 1 billion Chrome users on Windows before patching. This incident highlights the rapidly evolving threat landscape where AI-powered vulnerability research dramatically reduces the time and resources needed to develop sophisticated exploits from months to days, fundamentally lowering the barrier for advanced cyber attacks.
CISA Issues Emergency Alert for Actively Exploited Ivanti Connect Secure Zero-Day
In October 2026, CISA disclosed active exploitation of CVE-2026-104935, a zero-day authentication bypass vulnerability in Ivanti Connect Secure VPN appliances affecting versions 25.1.1.1 and prior. Cyber threat actors exploited this remote code execution vulnerability to conduct credential theft and data exfiltration operations, executing commands directly in memory to evade detection by Ivanti's Integrity Checker Tool. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected systems, representing a critical threat to organizations relying on these widely-deployed enterprise VPN solutions. This incident highlights the continuing trend of VPN infrastructure targeting by sophisticated threat actors, following similar campaigns against Pulse Secure, Fortinet, and other remote access solutions. With hybrid work models making VPN security critical, organizations face mounting pressure to implement comprehensive monitoring and rapid patch management for internet-facing infrastructure.
Deepfake Voice Attacks Target Executive Impersonation: Your 2026 Defense Strategy
Deepfake voice cloning attacks have escalated dramatically, with 62% of cybersecurity leaders reporting incidents in 2025 according to Gartner research. Threat actors now leverage AI-generated voice synthesis to impersonate executives, requesting fraudulent wire transfers, MFA resets, and privileged access modifications. These sophisticated social engineering campaigns bypass traditional detection methods, exploiting trust relationships and organizational hierarchies. The FBI warned that cloned voices can sound nearly identical to targets, making detection extremely difficult. Organizations report successful deepfake incidents targeting finance teams, help desks, and identity administrators, with some attacks remaining undetected for months. The surge in deepfake attacks coincides with increasingly accessible AI voice generation tools and growing remote work dependencies on voice communications. Traditional security awareness training proves insufficient against high-fidelity voice synthesis, requiring process-based verification controls rather than relying on human detection capabilities.
Critical Privilege Escalation Flaw Discovered in Inductive Automation Ignition SCADA Software
A critical privilege escalation vulnerability (CVE-2026-92817) was discovered in Inductive Automation's Ignition software, affecting versions 8.1.0-8.1.54 and 8.3.0-8.3.8. The flaw allows authenticated low-level users to exploit improper session validation in the Perspective module to gain Designer-level privileges and execute arbitrary code within the Ignition Gateway process. This vulnerability impacts critical infrastructure sectors including manufacturing and energy systems worldwide, with CVSS scores of 8.8 (v3.1) and 8.7 (v4.0). This incident highlights the growing threat to industrial control systems and the urgent need for robust privilege validation in SCADA environments. As critical infrastructure becomes increasingly connected, vulnerabilities like this demonstrate the potential for devastating operational disruptions and the importance of implementing zero trust architectures in OT environments.
Critical Ivanti VPN Flaw Under Active Attack: What CISOs Need to Know About CVE-2026-104935
In October 2026, CISA issued urgent warnings after threat actors actively exploited CVE-2026-104935, a critical authentication bypass vulnerability in Ivanti Connect Secure VPN appliances. The zero-day flaw allowed remote attackers to execute arbitrary commands without authentication, leading to credential theft and data exfiltration. Security researchers documented over 105 exploitation attempts from coordinated attackers, with the criminal group UTA0576 conducting sophisticated post-exploitation activities including Active Directory metadata theft, Kerberos attacks, and BitLocker recovery key harvesting while evading detection through selective log tampering. This incident highlights the accelerating trend of VPN infrastructure targeting by cybercriminals who are increasingly focusing on legitimate remote access solutions as primary attack vectors, exploiting the expanded attack surface created by hybrid work environments and the critical trust boundaries that VPN appliances represent in modern enterprise networks.
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
A critical use-after-free vulnerability (CVE-2026-92392) in curl versions 8.12.0 through 8.22.0 allows malicious servers to corrupt client memory during HTTP/2 file uploads, potentially leading to remote code execution. The flaw occurs when a malicious server stalls an upload, resets the stream while keeping the connection open, causing curl to mishandle memory references during retry operations. While exploitation requires precise knowledge of the client's build and memory layout, making successful attacks unlikely, the vulnerability affects both the curl command-line tool and libcurl library used by numerous applications. The curl project expedited their release cycle to ship version 8.23.0 with a fix on October 14, 2026. This vulnerability represents a significant escalation in client-side attack vectors, demonstrating how AI-powered vulnerability research is uncovering complex memory corruption flaws in widely-deployed networking libraries. With HTTP/2 becoming the default protocol for most applications, such vulnerabilities pose substantial risks to enterprise software supply chains and require immediate attention from security teams.
Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing
Microsoft uncovered a sophisticated Chinese-language cybercriminal ecosystem centered around YAM Store (Storm-3119), an initial access broker selling fraudulently obtained Microsoft 365 and Google cloud environments to phishing kit operators. The operation, tracked as Storm-2990, includes three major phishing kits (CoGUI, Haozi, and Iron Man System) that have facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations worldwide since January 2026. The threat actors primarily targeted healthcare, financial services, wholesale distribution, and IT sectors across Japan, the United States, Australia, and India, using sophisticated evasion techniques including geofencing, anti-detection configurations, and real-time victim interaction through Telegram bots. This incident highlights the evolving threat landscape where cybercriminal infrastructure has become commoditized through phishing-as-a-service platforms, significantly lowering barriers to entry for less skilled attackers. The discovery comes amid increased regulatory scrutiny on cloud security and the growing sophistication of social engineering attacks targeting multi-factor authentication bypass techniques.
Critical Security Flaws Found in 25 Popular Package Managers
A comprehensive security analysis of 25 popular package managers revealed widespread vulnerabilities in supply chain integrity protection. Trail of Bits researchers discovered that fewer than half use lockfiles that check for tampering by default, and only two package managers verify the integrity of every downloaded package. The study exposed critical weaknesses including unencrypted HTTP connections in cpanminus, insufficient cryptographic hash validation across multiple platforms, and missing signature verification in most systems. These vulnerabilities could allow malicious package repositories to inject compromised code into legitimate software dependencies, potentially affecting millions of applications worldwide. This research highlights the urgent need for stronger package manager security as supply chain attacks continue to evolve and target increasingly sophisticated infrastructure components.