Find what you’re looking for
Browse everything
6,844 results in Threat Reports
First Autonomous AI Agent Breach: DIVD Zammad Zero-Day Attack Analysis
In September 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) suffered a sophisticated breach through exploitation of two zero-day vulnerabilities in their Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490). An autonomous AI agent executed the attack within seconds, achieving session hijacking, remote code execution, and root privilege escalation without human intervention. The AI agent performed lateral movement and data exfiltration autonomously, leaving detailed logs of its decision-making process that enabled DIVD to reconstruct the attack timeline. This incident represents a critical evolution in cyber threats, demonstrating how AI-powered autonomous attack systems can accelerate breach timelines from hours to seconds. As organizations increasingly adopt AI systems and attackers weaponize artificial intelligence for autonomous operations, traditional detection and response mechanisms face unprecedented challenges in matching machine-speed attacks.
Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft
In July 2026, threat actors exploited CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite, to deploy web shells and harvest authentication secrets from internet-facing email servers. The critical flaw (CVSS 8.9) enabled attackers to execute remote code through specially crafted SMTP requests without authentication when SNMP notifications were enabled. Microsoft observed multi-stage attacks across multiple regions and industries between July 28 and August 7, 2026, where attackers deployed JSP web shells, established persistence mechanisms, escalated privileges, and exfiltrated mailbox data and authentication tokens including zimbraPreAuthKey and zimbraTwoFactorAuthSecret. This incident highlights the accelerating trend of targeting email infrastructure as attackers increasingly focus on business-critical communication systems and identity-related credentials that enable broader enterprise compromise and long-term persistence across hybrid cloud environments.
Dual-RMM Phishing Campaign Exploits MSP360 and ScreenConnect for Persistent Access
In July 2026, Microsoft detected sophisticated phishing campaigns where threat actors distributed legitimate MSP360 Remote Monitoring and Management (RMM) software installers disguised as meeting invitations, PDF readers, and software updates. Once executed, the digitally signed MSP360 installer established remote access and was used to deploy ConnectWise ScreenConnect as a secondary RMM channel, creating redundant access paths for attackers. The dual-RMM approach enabled threat actors to blend malicious activities with legitimate IT operations while maintaining persistent access for information collection and credential theft operations. This incident highlights the growing trend of Living-off-the-Land (LotL) attacks where cybercriminals abuse legitimate remote administration tools to evade detection and establish persistent access, making traditional security controls less effective against these camouflaged threats.
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
In September 2026, Microsoft researchers identified a new malware delivery technique called 'RedFlick' being used by the Russian state-sponsored threat actor Star Blizzard (also known as COLDRIVER). This campaign represents a significant evolution in the group's tactics, streamlining their malware delivery process through automated scheduled tasks that deploy the CosmicPulse backdoor with minimal victim interaction. The attacks begin with phishing emails containing password-protected archives that house VHDX virtual disks with malicious LNK files disguised as PDFs. Microsoft observed at least 13 large-scale campaigns since early 2026, impacting over 100 organizations primarily in the US and UK, with particular focus on Ukrainian institutions and international organizations supporting Ukraine. This incident highlights the ongoing sophistication of state-sponsored cyber operations and the continuous evolution of attack methodologies. As geopolitical tensions remain high, organizations must prepare for increasingly automated and evasive attack chains that bypass traditional security controls through legitimate system utilities and scheduled task abuse.
Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026
Russia's Star Blizzard APT group has evolved its phishing tactics in 2026, abandoning the multi-step ClickFix technique for a streamlined approach called RedFlick. Since January 2026, the FSB-linked threat actor has conducted 13 large-scale phishing campaigns targeting Ukrainian-linked NGOs, think tanks, and journalists worldwide. RedFlick reduces victim interaction to a single click while deploying the CosmicPulse backdoor through scheduled tasks and legitimate Windows utilities, significantly increasing the success rate of initial compromise attempts. This incident highlights the accelerating evolution of state-sponsored phishing operations, where APT groups are prioritizing operational efficiency over surgical precision. As geopolitical tensions persist, organizations supporting Ukraine or conducting Russia-related research face increasingly sophisticated and scalable attack vectors that require enhanced email security and user awareness programs.
Unsloth Studio Flaw Exposes Critical AI Supply Chain Risks
In June 2026, Pillar Security discovered a critical vulnerability in Unsloth Studio, the web UI for the popular open-source AI model fine-tuning library. The flaw allowed malicious AI models hosted on Hugging Face to execute arbitrary Python code during routine model inspection through the trust_remote_code setting. Simply selecting a malicious model triggered code execution before any model weights were loaded, potentially exposing proprietary training data, credentials, and enterprise AI development environments. Unsloth patched the vulnerability in version 2026.6.9 after responsible disclosure. This incident highlights the growing supply chain risks in AI development as organizations increasingly rely on third-party model repositories and automated tooling, making secure AI pipeline governance more critical than ever.
Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps
Apple disclosed CVE-2026-86950, a zero-day vulnerability in its CoreGraphics framework with a CVSS score of 8.8, actively exploited in highly sophisticated targeted attacks against specific individuals. The out-of-bounds write flaw affects a broad range of Apple devices including iPhones from iPhone 11 onward and multiple iPad generations, allowing attackers to execute arbitrary code through memory corruption. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days and conduct forensic triage by October 2, 2026. This incident highlights the growing trend of advanced persistent threat actors investing heavily in Apple device exploitation chains, moving beyond the traditional view of Apple products as inherently secure endpoints in enterprise environments.
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
In September 2026, South Africa's Air Traffic and Navigation Services (ATNS) discovered ransomware-linked malware in operational technology networks supporting weather services for air traffic control systems managing 10% of global airspace. The attack affected facilities at Port Elizabeth Airport and potentially East London Airport, with preliminary investigations revealing data exfiltration to external IP addresses located in China. While internal teams implemented containment measures and malware removal, ATNS issued a request for comprehensive cyber-forensic investigation services to determine the full extent of compromise and remaining risks. This incident highlights the accelerating threat landscape targeting critical aviation infrastructure, with ransomware attacks on the aviation sector surging sixfold in 2025. The targeting of air traffic control systems represents a concerning escalation in attacks against operational technology environments that directly impact public safety and global transportation networks.
CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation
Citrix NetScaler ADC and Gateway devices are under active exploitation through CVE-2026-88772, a critical memory overflow vulnerability in DTLS protocol handling that allows pre-authentication remote code execution. Attackers exploit parsing inconsistencies in the fragment_length field to craft malicious records that appear small but contain oversized data, causing buffer overflows that can be weaponized for arbitrary shellcode execution with root privileges. The vulnerability affects the NetScaler Packet Processing Engine and has been added to CISA's Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. This incident highlights the continued targeting of network infrastructure devices, particularly load balancers and VPN gateways that sit at critical network perimeters. With organizations increasingly dependent on hybrid connectivity and secure remote access, vulnerabilities in these edge devices represent high-value targets for threat actors seeking initial network compromise and lateral movement capabilities.
Critical OpenSSL DTLS Vulnerability Exposes Heap Memory in Encrypted Communications
OpenSSL disclosed CVE-2026-84782, a high-severity vulnerability in DTLS (Datagram Transport Layer Security) that can leak heap memory unencrypted or crash applications. The flaw occurs when DTLS handshake message resends trigger while larger messages are partially transmitted, causing wrong message labels and potential buffer overruns. Fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8, the vulnerability affects all prior versions across multiple branches, with older versions requiring premium support for patches. This vulnerability highlights the ongoing risks in foundational cryptographic libraries that secure internet communications, particularly as organizations increasingly rely on encrypted protocols for WebRTC, VoIP, and real-time communications across hybrid and multi-cloud environments.
Critical Infrastructure Under Siege: Lantronix G520 Gateway Vulnerabilities Expose Global Risk
In September 2026, CISA disclosed critical vulnerabilities (CVE-2026-84409 and CVE-2026-91191) affecting Lantronix G520 Series Cellular Gateways used in critical infrastructure worldwide. CVE-2026-84409 involves cross-site scripting through unencrypted update metadata retrieval, while CVE-2026-91191 stems from improper cryptographic signature verification where the production private key was exposed in the SDK. These vulnerabilities allow attackers to execute arbitrary code with root privileges, compromising devices deployed across transportation, energy, and water systems globally. These vulnerabilities highlight the growing threat to industrial control systems as cellular gateways become prime targets for nation-state actors and ransomware groups seeking to disrupt critical infrastructure operations.
Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation
CISA has added CVE-2026-86950, an Apple Multiple Products Out-of-Bounds Write Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. This critical vulnerability affects multiple Apple products and allows attackers to execute arbitrary code through out-of-bounds memory write operations. The vulnerability poses significant risks to federal enterprises and organizations using Apple devices, as successful exploitation can grant attackers total control of compromised systems. CISA's Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets. This incident highlights the ongoing trend of memory corruption vulnerabilities being actively exploited against Apple ecosystems, emphasizing the critical importance of timely patch management across enterprise device fleets as threat actors increasingly target platform-specific weaknesses.