Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Cisco Zero-Day Exploited: Critical Remote Code Execution in Unified Communications (2026)
In January 2026, Cisco disclosed and patched CVE-2026-20045, a critical zero-day vulnerability affecting Unified Communications Manager, Unity Connection, and Webex Calling Dedicated Instance platforms. The flaw, arising from improper validation of user-supplied input via HTTP requests, allowed unauthenticated attackers to execute arbitrary code and escalate privileges to root on impacted servers. Cisco’s Product Security Incident Response Team (PSIRT) confirmed in-the-wild exploitation prior to patch release and issued urgent guidance for customers to update, as no workarounds exist. The U.S. CISA swiftly added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating timely remediation for federal agencies. This incident highlights a broader trend of sophisticated zero-day attacks targeting enterprise communications infrastructure. As attackers increasingly focus on supply chain and collaboration platforms, organizations must maintain rapid patching practices and improve segmentation and detection mechanisms against privilege escalation and remote code execution threats.
Credential Stuffing Attempt at PcComponentes: 2024 Incident Overview
In June 2024, Spanish online retailer PcComponentes confirmed that its systems were targeted by a large-scale credential stuffing attack. While the company denied reports of a data breach affecting 16 million customers, it acknowledged that threat actors attempted to use previously leaked credentials to gain unauthorized access to customer accounts. No evidence of infrastructure compromise or mass data exfiltration was found, and PcComponentes’ internal investigation revealed that protective measures limited the attack’s impact. This incident highlights the ongoing challenges facing retailers from credential-based attacks, emphasizing the importance of stronger identity and access controls. The surge in credential stuffing campaigns reflects broader trends in attacker automation and customer credential reuse across online services.
Phishing Campaign Impersonates LastPass, Targets Master Passwords in 2026
In January 2026, LastPass alerted its users to an active and sophisticated phishing campaign impersonating the company, which sought to trick users into revealing their master passwords. Attackers sent urgent emails—claiming to be scheduled maintenance reminders—directing recipients to phishing sites designed to harvest their credentials. The emails originated from deceptive domains and included subject lines urging immediate backup of password vaults. LastPass emphasized to its users that it does not request master passwords and worked swiftly with partners to dismantle the malicious infrastructure, mitigating immediate risk. This incident highlights the persistent evolution of phishing tactics, particularly those exploiting brand trust and sense of urgency. As password manager adoption grows, attackers increasingly target such platforms, intensifying the need for user vigilance and robust email security controls.
VoidLink: The First AI-Generated Linux Malware Framework Exposes New Cybersecurity Risks
In late 2025, cybersecurity researchers uncovered VoidLink, a sophisticated Linux malware framework reportedly developed primarily by a single actor leveraging artificial intelligence. Analyses by Check Point Research and Sysdig identified operational artifacts and systematic code features—like consistent formatting, template-based responses, and AI-generated debug logs—suggesting heavy use of large language models in the malware’s rapid development. The threat actor, operating in a Chinese-language environment, utilized AI tools such as TRAE SOLO to expedite Spec Driven Development, producing 88,000 lines of attack-ready code in less than a week. While no real-world infections have been reported to date, VoidLink’s capabilities are significant, aiming at stealthy, long-term access to Linux-based cloud infrastructure. The emergence of AI-generated attack frameworks like VoidLink signals a pivotal change in cybercrime. Advanced threat creation, once limited to state actors or skilled teams, can now be accomplished rapidly by individuals utilizing off-the-shelf AI tools. This trend increases the urgency for organizations to adapt AI-enhanced defenses and revisit zero trust, segmentation, and cloud security controls.
Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026
In January 2026, Zoom and GitLab simultaneously released critical security updates to mitigate multiple high-severity vulnerabilities uncovered in their respective platforms. Zoom's most impactful flaw, CVE-2026-22844 (CVSS 9.9), affected its Node Multimedia Routers (MMRs), potentially enabling a meeting participant to perform remote code execution via a command injection. GitLab, meanwhile, addressed several vulnerabilities including two denial-of-service (DoS) issues and a two-factor authentication (2FA) bypass flaw (CVE-2026-0723), which could let malicious actors disrupt services or compromise user accounts if they knew credential IDs. While no active exploitation was reported, organizations using Zoom’s Node MMR module and GitLab’s CE/EE deployments were urged to patch immediately to avoid significant business disruption or data compromise. The disclosure of these vulnerabilities highlights the increasing sophistication and severity of threats targeting software supply chains and critical collaboration platforms. With attackers frequently seeking novel vectors for RCE, DoS, and authentication bypass, timely patching and robust segmentation remain crucial.
Chainlit AI Framework Flaws Expose Sensitive Data: What Organizations Need to Know
In January 2026, serious security flaws were disclosed in the popular open-source Chainlit artificial intelligence (AI) framework, exposing organizations to substantial data theft and privilege escalation risks. The vulnerabilities—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery/SSRF)—allowed authenticated attackers to steal sensitive files, such as API keys and credentials, and leverage SSRF to access internal or cloud network services. Exploiting these flaws, attackers could combine vectors for lateral movement across environments, potentially leading to broader compromise of AI-powered systems and cloud infrastructures. Both issues were patched in version 2.9.4 following responsible disclosure. This breach is highly relevant as adoption of AI frameworks accelerates and attackers increasingly target embedded infrastructure weaknesses, combining known vulnerabilities with emerging AI application risks. The incident underscores why organizations must adapt security controls and continuously monitor new technology stacks for widely exploitable flaws.
North Korean PurpleBravo Fakes Job Interviews to Breach Global Firms: 2026 Incident Analysis
In January 2026, the North Korean-aligned PurpleBravo threat group orchestrated a sophisticated social engineering campaign targeting more than 3,000 unique IP addresses. The attackers posed as recruiters from leading firms to lure victims, primarily within AI, cryptocurrency, financial services, IT, marketing, and software development, into fake job interviews. Exploiting trust through convincing communications, PurpleBravo gained access to targeted organizations across Europe, South Asia, the Middle East, and Central America, compromising data and exposing confidential operational environments. This campaign underscores the evolution of nation-state social engineering methods, leveraging supply chain trust and exploiting interest in career mobility. As geopolitical tensions rise and attackers continually refine techniques, organizations must double down on identity-centric security and awareness to mitigate evolving social engineering risks.
PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025
Between August 2024 and September 2025, North Korean state-backed group PurpleBravo orchestrated a software supply-chain campaign targeting IT services and software development firms worldwide. Posing as recruiters or fictitious brands, the attackers lured victims—often developers and job seekers—into executing malicious code on corporate endpoints. Through malware like BeaverTail, PyLangGhost, and GolangGhost, PurpleBravo exfiltrated browser credentials and cryptocurrency wallet data while leveraging GitHub, fake websites, and VPN-based command-and-control infrastructure. Over 3,100 IP addresses and 20 organizations in South Asia, Europe, the Middle East, and Central America were exposed as probable victims, amplifying downstream risk to clients of affected IT service providers. This incident underscores a growing trend of sophisticated, targeted software supply-chain attacks exploiting developer trust and recruitment platforms. The campaign’s overlap with other North Korean IT worker operations and its focus on outsourcing regions highlight urgent risks to organizations relying on distributed and third-party development partners.
CVE-2026-20045: Active Code Injection Exploit Strikes Cisco Unified Communications
In January 2026, CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities Catalog following reports of active exploitation targeting Cisco Unified Communications products. Attackers exploited a code injection vulnerability that allowed remote, unauthenticated threat actors to execute arbitrary code on affected devices, potentially compromising sensitive communications and opening access for further malicious activity within targeted federal civilian executive branch (FCEB) networks. This rapid addition of CVE-2026-20045 prompted urgent federal action to remediate impacted systems and reduce the risk of lateral movement and data exfiltration. The incident highlights a persistent threat vector facing organizations reliant on unified communications infrastructure. With attackers increasingly exploiting unpatched vulnerabilities and leveraging code injection to bypass security controls, the importance of timely patch management and network segmentation continues to grow amid tightening regulatory standards and intensifying audit scrutiny.
CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024
In early 2024, security researchers identified a sophisticated malware campaign dubbed the 'CrashFix' scam, which leveraged malicious browser extensions—specifically the NexShield extension—to crash users' browsers via social engineering popups and prompt them to install phony fixes. Victims, lured into installing the extension and then a Python-based remote access trojan (RAT), unknowingly granted attackers deep access to their systems. Once compromised, the RAT enabled persistent monitoring, exfiltration of sensitive data, and possible lateral movement within corporate environments, posing a significant risk to both individuals and organizations. The campaign demonstrated a streamlined chain from initial compromise via engineered browser crashes, through privilege escalation and persistent command-and-control using a multi-stage malware deployment. This incident underscores the growing sophistication of social engineering in malware delivery, the risks of malicious browser extensions, and evolving techniques in drive-by compromise and post-infection control. Increased reliance on browsers for daily business functions and the persistence of endpoint threats make such campaigns highly relevant amid surging attacks targeting remote access and user trust.
How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024
In early 2024, cybersecurity researchers discovered that widely used 'Damn Vulnerable' training applications, deployed by several prominent security vendors, had been left exposed due to cloud misconfigurations. Hackers exploited over-permissioned cloud environments and insufficient network segmentation to access sensitive IT infrastructure, including internal management consoles and production environments. The attack vector primarily leveraged misconfigured network access and default credentials, enabling lateral movement and potential data exfiltration. The impact included unauthorized access to vendor systems, reputational damage, and concerns over customer data exposure. This incident is particularly relevant today as organizations increasingly adopt cloud-based apps and training environments without adequate security controls. Similar misconfiguration-driven breaches are on the rise, highlighting the urgent need for robust cloud security posture management and Zero Trust strategies to minimize risk.
VoidLink: AI-Generated Linux Malware Breaks New Ground in 2024 Hybrid Cloud Attack
In early 2024, security researchers uncovered VoidLink, a sophisticated Linux malware framework developed almost entirely by autonomous AI agents. The attack chain involved highly original code and TTPs that bypassed standard detection, enabling attackers to move laterally within targeted cloud and hybrid environments. Exploiting gaps in east-west segmentation and encrypted data exfiltration, VoidLink established resilient command-and-control channels and evaded traditional intrusion prevention measures, exposing sensitive internal traffic and critical workloads to theft and disruption. Operational impacts included potential data loss, regulatory exposure, and interruptions to secure network functions across multiple organizations. The emergence of AI-generated malware like VoidLink signals a paradigm shift in cyber threats, where autonomous code can outpace conventional defenses and rapidly adapt to security controls. This incident underlines the urgent need for organizations to evolve their security posture with advanced segmentation, visibility, and automation to counter the accelerating threat of agentic and AI-enabled attacks.