Find what you’re looking for
Browse everything
6,844 results in Threat Reports
Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence
In September 2026, Kiteworks (formerly Accellion) took the unprecedented step of urging customers to shut down their systems for nine hours as a precautionary measure after receiving credible threat intelligence from federal authorities about an imminent cyber attack. The company emphasized that no evidence of compromise was found and that all known vulnerabilities had been addressed in software release 9.5.1. This proactive response demonstrates how threat intelligence sharing between government agencies and private sector entities can enable preventive security measures. This incident highlights the growing sophistication of threat actor reconnaissance and the critical importance of proactive threat intelligence in modern cybersecurity defense strategies, particularly given the increasing frequency of supply chain and managed service provider attacks targeting multiple organizations simultaneously.
Critical SharePoint RCE and MikroTik RouterOS Vulnerabilities Under Active Attack
In September 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog following evidence of active exploitation in the wild. CVE-2026-65660, a remote code execution flaw in Microsoft SharePoint Server initially misclassified as a spoofing vulnerability, allows authenticated attackers to execute arbitrary code over the network. Simultaneously, CVE-2026-67279 affecting MikroTik RouterOS was chained with CVE-2026-86060 in an exploit dubbed 'MikroTrick' to achieve complete administrative takeover of internet-exposed routers without authentication. Microsoft confirmed reliable evidence of attacks against SharePoint but has not disclosed attribution, scope, or impact details. These incidents highlight the growing sophistication of threat actors exploiting trust boundary failures and authentication bypass vulnerabilities to gain initial access to critical infrastructure components.
Critical Elementor CSRF Flaw Exposes 2 Million WordPress Sites to Admin Takeover
A critical cross-site request forgery (CSRF) vulnerability in the Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 allowed unauthenticated attackers to create rogue administrator accounts and take complete control of affected websites. The flaw, scoring 8.8 on the CVSS scale, affected over 2 million WordPress sites and required only that an administrator click a specially crafted link. The vulnerability stemmed from the Editor Events module bypassing CSRF protection for REST API requests containing the string 'elementor/v1/events/' anywhere in the URI, effectively disabling security controls for the entire WordPress REST API surface. This incident highlights the growing sophistication of web application attacks targeting content management systems and the critical importance of secure development practices in widely-deployed plugins. With WordPress powering over 40% of websites globally, vulnerabilities in popular plugins present massive attack surfaces that threat actors increasingly exploit.
ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique
The ShinyHunters-affiliated threat group UNC6240 launched a renewed mass exploitation campaign in September 2026, targeting Oracle PeopleSoft systems globally across education, healthcare, government, and technology sectors. The attackers weaponized CVE-2026-35273, a critical remote code execution vulnerability, by developing a WAF bypass technique using URL-encoded characters to evade security controls. The campaign deployed web shells on dozens of systems, established persistent access through legitimate RMM tools like MeshAgent, and deployed the SIDEEYE backdoor for credential theft and data exfiltration, ultimately leading to ransomware deployment and data extortion threats. This incident highlights the evolving sophistication of ransomware groups in bypassing modern security architectures, particularly the limitations of signature-based WAF protection against adaptive threat actors who can rapidly modify exploits to evade detection rules.
CISA Elevates WordPress RFI Threat: CVE-2026-87902 Joins Critical KEV Catalog
CISA has added CVE-2026-87902, a critical WordPress Core Remote File Inclusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability allows attackers to include and execute arbitrary files from remote servers, potentially leading to complete system compromise. The addition to the KEV catalog under Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of this high-risk vulnerability on publicly exposed assets, as successful exploitation can grant threat actors total control of affected WordPress installations. This incident highlights the continuing evolution of web application attack vectors and the critical importance of timely patch management in an era where WordPress powers over 40% of all websites globally, making such vulnerabilities attractive targets for cybercriminals seeking large-scale compromise opportunities.
Cameron Wagenius Sentenced for Multi-Year AT&T and Snowflake Attack Campaign
Former Army soldier Cameron John Wagenius was sentenced to 70 months in prison for orchestrating a multi-year cybercrime campaign targeting major companies including AT&T, Ticketmaster, and Santander. Operating under aliases 'kiberphant0m' and 'cyb3rph4nt0m,' Wagenius collaborated with Connor Moucka to compromise over 165 Snowflake customer environments, stealing billions of records and attempting to extort over $1 million from victims. The breach exposed call detail records of high-profile government officials and resulted in the theft of nearly all AT&T customer phone and text records spanning six months. This case highlights the growing threat of insider compromise and the vulnerability of cloud infrastructure, particularly as organizations increasingly rely on third-party cloud platforms for sensitive data storage. The incident underscores the critical need for enhanced access controls, comprehensive monitoring, and zero-trust security architectures to prevent credential-based attacks and lateral movement.
North Korean Hackers Steal $351.6 Million from Bitget Exchange in Sophisticated Backend Attack
In September 2026, suspected North Korean hackers infiltrated Bitget cryptocurrency exchange's backend wallet infrastructure, stealing $351.6 million from hot and warm wallets across multiple blockchain networks including Ethereum, XRP Ledger, and Arbitrum. The attackers compromised critical backend systems to spoof transaction data and trigger unauthorized fund transfers, affecting assets including ETH, XRP, BNB, AVAX, USDT, and USDC. Bitget suspended withdrawals immediately upon detection and activated its $464 million User Protection Fund to cover all customer losses. This incident highlights the persistent and evolving threat posed by North Korean state-sponsored groups targeting cryptocurrency exchanges, with these actors having stolen over $6 billion in crypto assets since 2017 to fund weapons programs.
Rydox Cybercrime Marketplace Admin Faces 22 Years After FBI Takedown
Between February 2016 and December 2024, the Rydox cybercrime marketplace facilitated over 7,600 sales of stolen credentials, credit card data, and personal information targeting thousands of U.S. citizens. Kosovo national Ardit Kutleshi, who operated the platform alongside two other administrators, pleaded guilty to aggravated identity theft and money laundering conspiracy in 2026. The marketplace generated significant revenue through a commission-based model, charging sellers $200-500 registration fees while retaining 40% of all sales proceeds from cryptocurrency transactions. Joint international law enforcement operations led by the FBI successfully dismantled the platform, seized its servers in Malaysia, and arrested the three administrators in coordinated raids across Kosovo and Albania. This case demonstrates the growing sophistication of underground marketplaces and law enforcement's enhanced capabilities in cross-border cybercrime investigations, particularly as cryptocurrency-based illegal commerce continues to expand globally.
Four Critical Enterprise Vulnerabilities Added to CISA's Must-Patch List
In September 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The most severe include CVE-2026-5430, a critical authentication bypass in WSO2 API Manager affecting nearly 1,000 customers across banking, government, and telecommunications sectors, and CVE-2026-71362, a critical authorization flaw in Adobe Commerce allowing account hijacking without authentication. Additional vulnerabilities include a code injection flaw in Microsoft SharePoint (CVE-2026-65660) and an SSH bypass in Mikrotik RouterOS (CVE-2026-67279). Federal agencies received 48-72 hour remediation deadlines, with attackers demonstrating sophisticated JWT token forgery techniques and targeting high-value enterprise infrastructure. This incident highlights the accelerating pace of vulnerability exploitation in 2026, with threat actors increasingly targeting enterprise software platforms that serve as central authentication and API management hubs. The exploitation of WSO2 and Adobe Commerce reflects a strategic shift toward compromising platforms that provide access to multiple downstream systems and customer data.
How ShinyHunters Exploited CVE-2026-42608 to Breach Clop's Ransomware Leak Site
In September 2026, the ShinyHunters extortion group successfully breached and defaced the Clop ransomware gang's data leak site by exploiting an unpatched path traversal vulnerability (CVE-2026-42608) in Grav CMS version 1.7.43. The attackers leveraged an unauthenticated file upload flaw that allowed directory traversal through the __unique_form_id__ parameter, enabling them to upload malicious files outside the intended directory structure. ShinyHunters claimed to have stolen source code, CMS plugins, server logs, and private Tor service keys, subsequently demanding ransom from Clop. This incident represents a notable case of cybercriminal groups targeting each other's infrastructure, highlighting the evolving threat landscape where established ransomware operations face attacks from competing threat actors seeking to exploit vulnerabilities in their own web-facing assets.
Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover
A critical Cross-Site Request Forgery (CSRF) vulnerability in the Elementor WordPress plugin affected versions 4.3.0 and 4.3.1, impacting up to 2 million websites. The flaw allowed unauthenticated attackers to create administrator accounts by tricking logged-in administrators into clicking malicious links. The vulnerability exploited Elementor's Editor Events module, which bypassed WordPress's REST nonce validation when specific URI paths were present, enabling one-click privilege escalation attacks. Security firm Patchstack disclosed the vulnerability on September 22, 2026, and Elementor released a patch in version 4.3.2 within two days. This incident highlights the growing sophistication of web application attacks targeting popular content management systems and the critical importance of secure API design patterns in preventing privilege escalation vulnerabilities.
Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence
In September 2026, Kiteworks, a secure file-sharing platform used by government organizations and enterprises, issued an unprecedented global shutdown advisory after receiving credible threat intelligence from federal law enforcement. The company urged all customers worldwide to shut down their servers for a six-hour window to protect against potential zero-day attacks targeting their systems. While no actual breach was confirmed, the proactive measure highlighted the sophisticated threat landscape facing secure file transfer platforms that handle sensitive documents. The incident underscores the increasing sophistication of threat actors targeting enterprise file-sharing platforms, particularly following successful campaigns by groups like Clop ransomware gang against similar services. This preemptive approach represents a new paradigm in incident response, where organizations act on intelligence rather than waiting for active exploitation, reflecting the evolving threat landscape where secure file platforms have become high-value targets for data theft extortion operations.