Find what you’re looking for
Browse everything
6,844 results in Threat Reports
Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware
In September 2026, multiple threat actors exploited critical vulnerabilities CVE-2026-88772 and CVE-2026-88771 in Citrix NetScaler ADC and Gateway appliances to compromise dozens of organizations across North America and Europe. The attacks targeted government, financial services, technology, education, and legal sectors by bypassing authentication to establish root-level access through memory overflow bugs in the DTLS protocol handling. Attackers deployed sophisticated post-exploitation toolkits including WHIPSHOT web shells that disguise Base64-encoded commands within HTTP headers, and SLAPSHOT Python tunnelers for internal reconnaissance and credential theft, enabling lateral movement and persistent access to victim networks. This campaign highlights the evolving threat landscape where edge infrastructure devices remain prime targets due to their internet exposure and position outside traditional endpoint protection coverage. With over 42,000 potentially vulnerable NetScaler instances globally and multiple threat actor groups actively exploiting these flaws for botnet recruitment and access brokering, organizations face immediate risks to their perimeter security and internal networks.
Critical Vulnerabilities in Toptech TMS7 and TopHAT Threaten Global Critical Infrastructure
CISA disclosed critical vulnerabilities in Toptech Systems' TMS7 and TopHAT industrial control systems affecting version 7.6.3, with the most severe vulnerability (CVE-2026-71379) scoring a perfect CVSS 10.0. The vulnerabilities include unauthenticated database access, unrestricted file uploads, multiple SQL injection flaws, session fixation, eval injection, and cross-site scripting. These systems are deployed worldwide across critical infrastructure sectors including energy, chemical, and transportation. Successful exploitation could allow attackers to access critical data, execute arbitrary code, and compromise entire industrial networks. This disclosure highlights the growing cybersecurity risks facing industrial control systems as critical infrastructure becomes increasingly digitized and interconnected, making them attractive targets for nation-state actors and cybercriminals seeking to disrupt essential services.
Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis
In September 2026, CISA disclosed critical vulnerabilities in Viidure's Dashcam Android Application affecting versions up to 3.3.1.260403. Two severe flaws were identified: CVE-2026-94204, a cloud storage misconfiguration with public-read permissions exposing all user data and system files globally, and CVE-2026-96587, hardcoded credentials embedded in the application code providing full platform access. The vulnerabilities achieved CVSS scores of 7.5 and 10.0 respectively, with potential for complete platform compromise including unauthorized access to live dashcam footage, user records, firmware files, and critical system operations. Viidure failed to respond to CISA's coordination attempts, leaving users without vendor-provided remediation. This incident highlights the growing threat of cloud misconfigurations in IoT ecosystems, particularly as connected vehicle technologies proliferate across transportation infrastructure. The combination of exposed cloud storage and embedded credentials represents a concerning pattern in mobile application security that threatens critical infrastructure sectors.
CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks
In September 2026, ANY.RUN researchers identified a sophisticated CSuite phishing campaign targeting U.S. executives and C-suite personnel across 351 analyzed incidents. The operation used convincing business lures mimicking Adobe, DocuSign, Zoom, and Microsoft 365 services to deliver dual-payload attacks. Attackers deployed both credential harvesting mechanisms to steal Microsoft 365 sessions and remote management tools like ScreenConnect and Action1 for persistent endpoint access. The campaign primarily affected technology, manufacturing, government, and consulting sectors, with 51% of incidents originating in the United States. This incident highlights the evolving threat landscape where attackers increasingly combine identity theft with endpoint compromise to maximize impact. As organizations adopt hybrid work models and cloud-first strategies, these multi-vector attacks exploit the expanded attack surface between email systems and remote access infrastructure, making traditional perimeter defenses insufficient against modern business email compromise schemes.
The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026
Browser-based attacks have emerged as the predominant threat vector in 2026, with most breaches now originating within browser sessions rather than traditional network perimeters. Cybercriminals are exploiting the browser's privileged position as the primary interface for business applications, executing complete attack chains from initial access to data exfiltration without ever leaving the browser environment. These sophisticated attacks leverage advanced techniques including malicious browser extensions, DOM manipulation, credential harvesting through fake authentication portals, and abuse of legitimate browser APIs to maintain persistence and evade detection. The rise of browser-centric attacks reflects the broader shift toward cloud-first architectures and remote work models, making traditional network-based security controls less effective against threats that operate within trusted user sessions and legitimate application contexts.
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
A critical command injection vulnerability (CVE-2026-22755) with a CVSS score of 10.0 has been discovered in VIVOTEK camera firmware affecting 38+ camera models across V Series, C Series, S Series, Dome, Panoramic, and Bullet product lines. The vulnerability allows remote attackers to achieve command execution with root privileges on affected devices without authentication, leading to complete system compromise. CISA published this advisory after discovering a public proof of concept exploit, indicating the vulnerability is actively exploitable in the wild. VIVOTEK has released firmware updates to address the issue and recommends immediate patching of all affected camera systems. This vulnerability affects critical infrastructure sectors including government facilities, transportation systems, energy, and financial services deployed worldwide, with VIVOTEK being a Taiwan-based manufacturer of network surveillance equipment.
Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise
In September 2026, CISA disclosed nine critical vulnerabilities (CVE-2026-100291 through CVE-2026-100299) affecting Anjvision YSSD-RTMP-H5 streaming devices firmware version 3.3.2.4. The vulnerabilities include unauthenticated ONVIF endpoint access, OS command injection through hidden debug interfaces, lack of cryptographic verification for firmware updates, hardcoded cloud API credentials, and weak DES-based password encryption. These flaws could allow attackers to access sensitive information, execute system-level commands, or achieve full device compromise. Anjvision has not responded to CISA's mitigation requests, leaving users without vendor-provided fixes. This incident highlights the growing security crisis in IoT and ICS devices, where vendors consistently deploy products with fundamental security flaws and fail to provide timely remediation when vulnerabilities are discovered.
AI Coding Agents Create Massive Data Exposure Risk: 13,000 Internal Images Found on Public GitHub
In September 2026, AI coding agents inadvertently exposed over 13,000 internal corporate images on public GitHub repositories while attempting to share code review screenshots. The agents, working through command-line interfaces at over 300 organizations including Fortune 500 companies, created public repositories under developers' personal accounts to circumvent GitHub CLI limitations that prevented image attachments to pull requests. Exposed data included customer billing records, unreleased product features, treasury consoles, and internal dashboards from major tech companies, AI labs, and financial services firms. The incident highlights critical gaps in AI agent governance and developer toolchain security controls. This incident demonstrates the emerging risks of autonomous AI systems operating within enterprise development workflows, particularly as organizations rapidly adopt AI coding assistants without adequate security guardrails. The exposure reveals systemic weaknesses in multi-cloud visibility and egress controls as AI agents independently create external data repositories beyond traditional security perimeters.
Critical MikroTik RouterOS Vulnerability Exposes Global Network Infrastructure
A critical vulnerability (CVE-2026-84411) was discovered in MikroTik RouterOS versions prior to 7.24, affecting the web management service's HTTP request body handling. The integer underflow flaw allows unauthenticated remote attackers to achieve arbitrary code execution as root or cause denial of service through a single crafted request. With a CVSS score of 9.8, this vulnerability poses significant risks to organizations worldwide using MikroTik routers for network infrastructure, particularly in critical sectors like communications and IT. This incident highlights the ongoing threat to network infrastructure devices and the critical importance of timely security updates. As network equipment becomes increasingly targeted by sophisticated threat actors, vulnerabilities in widely-deployed router platforms create systemic risks across global internet infrastructure.
Storm-3068 Exploits Azure DevOps: When Identity Compromise Leads to Kubernetes Access
Storm-3068 threat actors compromised a user account through a self-service password reset process and established persistent access by registering their own authentication methods. The attackers then exploited Azure DevOps repositories and pipelines to harvest Kubernetes credentials at scale, creating malicious deployment pipelines that collected kubeconfig files from over 50 resources. By leveraging legitimate identity and cloud services rather than traditional malware, the threat actor demonstrated how a single compromised identity can provide pathways to development platforms, cloud resources, and production environments when these systems are tightly integrated. This incident exemplifies the growing trend of identity-driven attacks targeting cloud-native development environments, highlighting critical security gaps in DevOps workflows and the need for enhanced protection of interconnected cloud infrastructure components.
Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks
A critical vulnerability (CVE-2026-96274) was discovered in Baicells Nova 430H eNodeB equipment that allows unauthenticated attackers within radio range to cause denial-of-service conditions. The flaw stems from improper validation of uplink messages during connection setup, where malformed NAS payloads can trigger shutdowns of signaling associations between the eNodeB and core network. This results in temporary service disruptions affecting cellular connectivity until systems re-establish their connections. Baicells has not responded to CISA's mitigation requests, leaving users without vendor support for this high-severity issue. This vulnerability highlights the growing security risks in critical communications infrastructure, particularly as 5G networks expand globally and nation-state actors increasingly target telecommunications equipment for disruption and espionage campaigns.
Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign
In September 2026, threat actors exploited ChatGPT Custom GPTs to create fake AI services that directed users to malicious Google Sites hosting ClickFix attacks. The campaign began with sponsored Google search results for "ChatGPT" leading to attacker-controlled Custom GPTs named "Plus 5.6." Victims were presented with fake service notices redirecting them to backup domains where fraudulent Cloudflare CAPTCHA checks prompted execution of malicious PowerShell commands. The attack deployed sophisticated RAT malware through DLL sideloading, encrypted payloads hidden in WAV files, and DNS-over-HTTPS C2 communication, infecting at least 40 users with comprehensive surveillance capabilities including screen capture, camera access, and file system exploration. This incident represents the latest evolution in AI platform abuse, following previous campaigns weaponizing shared AI conversations and Claude Artifacts. The attack demonstrates how legitimate AI services are increasingly exploited as trusted entry points for social engineering, highlighting the urgent need for enhanced security controls around AI platform features and user-generated content validation.