Find what you’re looking for
Browse everything
6,838 results in Threat Reports
No Memory Corruption Needed: How Five Logic Bugs Broke Microsoft Edge for $175,000 at Pwn2Own 2026
In May 2026, security researcher Orange Tsai of DEVCORE won $175,000 at Pwn2Own Berlin by chaining five logic flaws in Microsoft Edge to achieve a full sandbox escape and remote code execution—without a single memory-corruption bug. The exploit, under 100 lines of code, began with a misconfigured conditional access navigation throttle to generate a universal cross-site scripting primitive, leveraged a hardcoded allowlist bypass, an auto-sign-in feature, and a misconfigured CORS header on assets.msn.com, then used Edge's Immersive Reader and a diagnostic log-zip function to write arbitrary files to disk, ultimately hijacking the telnet:// protocol handler to execute attacker-planted code. Microsoft patched the three CVEs (CVE-2026-45492, CVE-2026-45494, CVE-2026-45495) within 24 hours in Edge 148.0.3967.70. This exploit signals a paradigm shift in browser attack research: logic-only chains that produce full code execution are now viable, lowering the technical barrier for sophisticated threat actors who previously required rare memory-corruption primitives. As enterprise browsers become identity and SaaS gateways, logic-abuse chains targeting browser features represent a growing and underappreciated attack surface demanding renewed focus on egress controls, sandbox telemetry, and east-west traffic inspection.
The Shai-Hulud Worm Proves SBOMs Are Not Enough: What Supply Chain Defenders Must Do Now
At the ISC2 Security Congress 2026, Atlassian product security manager Deepam Kanjani detailed a real-world supply chain compromise involving the Shai-Hulud worm, a malicious transitive dependency buried three layers deep inside a seemingly legitimate npm package with over 3,400 GitHub stars and a matching SHA hash. Because the dependency was not direct, it evaded top-level SBOM audits and initial behavioral alerts were dismissed as false positives. The team was forced to manually correlate logs across more than 400 services without reliable runtime telemetry, severely hampering incident scoping. Attribution led to dead ends, with the publisher identity fabricated, though later research linked subsequent Shai-Hulud campaigns to threat actor TeamPCP. This incident underscores a widening gap between static dependency inventories and the dynamic reality of production environments. As software supply chain attacks grow in sophistication and frequency, organizations that rely solely on SBOMs for incident scoping face dangerous blind spots in runtime visibility, transitive dependency tracking, and rapid stakeholder communication during active compromise.
15 Minutes to Malware: How Black Basta Turned Microsoft Teams Into a Ransomware On-Ramp
Since mid-2024, threat actors linked to the Black Basta ransomware ecosystem have weaponized Microsoft Teams' external chat functionality at scale, combining email-bombing with IT-support impersonation to achieve payload execution in under 15 minutes. Across more than 400 observed incidents, attackers flood a target's inbox, then contact them via Teams using display names such as 'IT Support (Internal)' from throwaway or attacker-controlled tenants. Victims are coaxed into granting remote access via tools including Quick Assist, AnyDesk, and Atera, after which attackers execute PowerShell payloads, deploy C2 beacons, harvest credentials via Kerberoasting, and stage ransomware. Roughly 15% of targeted users progressed to full compromise. This campaign signals a maturation of social-engineering-as-a-service tradecraft, with standardized infrastructure, locale-aware lures, and integration with ClickFix-style techniques. As Microsoft prepares AI-powered phishing detection for Teams and organizations expand hybrid collaboration tooling, defenders must close the gap between user-trust assumptions and verified identity controls before attackers further automate the playbook.
PolyShell & Node2Shell: How Two Critical CVEs in 2026 Breached 953+ E-Commerce Stores and Put 91% of Cloud Environments at Risk
In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48356 (CVSS 9.3), an unrestricted file upload flaw in Adobe Commerce and Magento dubbed PolyShell, and CVE-2026-111497 (CVSS 9.2), a memory-corruption RCE in Google's Brotli decoder library dubbed Node2Shell. Threat actors exploited CVE-2026-48356 to breach over 953 e-commerce stores, injecting malicious loaders via Magento CMS blocks active since at least July 2025. Simultaneously, live Node2Shell exploit traffic was recorded in the wild from a Netherlands-based IP also linked to PHP2Shell campaigns, signaling mass-exploitation tooling adoption across the web stack. These twin campaigns illustrate a maturing pattern of attackers chaining supply-chain library flaws with CMS upload vulnerabilities to achieve persistent RCE at scale. With 91% of cloud environments reported vulnerable to CVE-2026-111497 and FCEB agencies given until November 10, 2026 to patch, organizations running unpatched Node.js, PHP, or Adobe Commerce instances face immediate, high-probability compromise risk.
When Your AI Bot Is Actually a Threat Actor: The 2026 Credential Scan Campaign
Beginning in late September 2026, an unidentified threat actor launched a persistent, automated credential-harvesting campaign by impersonating more than 32 legitimate AI bots—including crawlers and assistants attributed to OpenAI, Anthropic, Perplexity, and Meta. Operating around the clock, the scanner fired bursts of 50–190 HTTP requests in under eight seconds per target, probing roughly 90 file paths known to contain passwords, API keys, SSH private keys, and cloud credentials. On a single day in October 2026, 48% of organizations protected by Cequence Security received the malicious traffic. Targeted sectors included retail, financial services, telecommunications, energy, and software. Nearly all requests were blocked or failed, but the campaign remained active as of late October 2026. This incident underscores a structural shift in the threat landscape: as enterprises accelerate AI agent adoption, attackers are weaponizing AI identity itself. The ability to rotate through dozens of trusted bot personas in seconds exposes a critical gap in perimeter and API security controls that were designed for human or single-service traffic patterns, not polymorphic machine identities.
Three Flaws, One Patch, One Zero-Day: How ShinyHunters Dismantled Oracle PeopleSoft Security
Between May 27 and June 9, 2026, the financially motivated threat group ShinyHunters (tracked by Mandiant as UNC6240) exploited a zero-day chain in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, later patched as CVE-2026-35273 (CVSS 9.8). The attack chains three distinct flaws: an unauthenticated server-side request forgery (SSRF) in the Integration Gateway (PSIGW), a loopback-trust bypass in the Environment Management Hub (PSEMHUB), and either an arbitrary file-write for web shell deployment or a malicious XMLDecoder payload for stealthier code execution. Oracle issued an out-of-band patch on June 10; a second, broader campaign targeting universities, healthcare, government, and technology sectors was confirmed by Mandiant in September 2026. The September wave demonstrated that WAF-based mitigations were bypassed trivially via URL-encoding, underscoring a persistent industry pattern: perimeter controls are insufficient when attackers can manipulate request encoding, and organizations relying on signature-based filtering rather than patching remain exposed. ShinyHunters' data-theft-then-extortion model means affected organizations face both data breach notification obligations and ransom demands simultaneously.
Tailworm: How Tailscale SSH Flaws Turned Trusted Devices Into Root-Access Gateways
In October 2026, Tailscale disclosed four security bulletins (TS-2026-014 through TS-2026-017) affecting its built-in SSH server on Linux and open-source macOS builds. Researcher Erica Windisch of Cyberdione Labs published the Tailworm report revealing that an attacker with an already-trusted device on a Tailscale network could exploit Unix socket-forwarding logic—running with root privileges—to reach root-only sockets such as the Docker control socket, read /etc/shadow, crash Tailscale nodes via memory exhaustion, and remotely control nodes via the tailscaled local API. Tailscale released version 1.104.4 on October 28, 2026, remediating the issues by dropping forwarding privileges to the logged-in user and relying on OS-level file permissions. No confirmed real-world exploitation was reported at time of publication. This incident underscores a growing pattern of privilege-escalation vulnerabilities in zero-trust network tooling itself—the very infrastructure organizations rely on to enforce least-privilege access. As enterprises accelerate adoption of overlay networking and identity-based SSH, attackers are shifting focus to the trust fabric, making supply-chain and tooling security a board-level concern.
GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services
In October 2026, GMO Internet Group's Onamae.com Desktop Cloud service — a Windows virtual desktop platform used by retail FX traders — suffered a significant breach. Attackers exploited a cloud misconfiguration, reportedly leveraging a shared administrator account across all customer servers, to install malicious software, exfiltrate customer data, and harvest login credentials stored in trading platforms such as MetaTrader 4 and 5. Up to 26,739 servers were potentially affected. Stolen credentials were subsequently used to execute unauthorized trades on customer accounts at brokers including OANDA Japan. Attackers then issued a $50 million extortion demand and threatened ransomware deployment, data publication, and account manipulation across more than 70 financial firms. This incident underscores how cloud misconfigurations — particularly flat administrative access models and inadequate east-west segmentation — directly translate into credential theft, financial fraud, and large-scale extortion. As regulated financial services increasingly migrate workloads to cloud-hosted virtual desktops, the risk profile of shared infrastructure vulnerabilities has grown substantially, drawing renewed regulatory and law-enforcement scrutiny globally.
AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security
In October 2026, Anthropic disclosed that an internal, unreleased AI research model autonomously identified and chained multiple zero-day vulnerabilities across Chrome, Safari, Android, Windows, and Linux into working proof-of-concept exploits. The model required only minimal human prompting to construct five complete exploit chains, including a Chrome sandbox escape, a Safari same-origin policy bypass, and a Linux root-shell exploit rated CVSS 9.8 (CVE-2026-98432). All flaws were responsibly disclosed and patched by respective vendors prior to publication. Apple and Google independently credited Anthropic and its Claude model in their security advisories, providing third-party validation. This disclosure signals a fundamental shift in the offensive security landscape: AI models can now autonomously perform vulnerability research and exploit development at a level previously reserved for elite red teams. The convergence of AI capability with exploit engineering raises urgent questions about the defensive readiness of enterprise cloud, browser, and kernel-layer infrastructure against AI-accelerated adversaries.
Virtualine Seized: Inside the Bulletproof Hosting Network Powering Ransomware, Phishing, and Bitcoin Money Laundering
In October 2026, the FBI and international law enforcement agencies seized the domain of Virtualine, a bulletproof hosting (BPH) provider operating under aliases including Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Virtualine openly marketed its infrastructure to cybercriminals on forums for phishing, carding, spam, and port scanning while knowingly hosting child sexual abuse material (CSAM) and facilitating international Bitcoin money laundering through unhosted wallet addresses. Blockchain analytics firm Chainalysis confirmed direct on-chain exposure to ransomware operators, infostealer infrastructure, and illicit marketplaces. The coordinated takedown involved Hessen State Police, the Netherlands National Police Corps, the UK National Crime Agency, OverRIPE, and Lumen Technologies. This seizure underscores an accelerating law enforcement trend targeting the criminal-hosting ecosystem that underpins ransomware, infostealer, and phishing campaigns globally. As BPH providers rapidly re-acquire ASNs and shift infrastructure, enterprises and cloud security teams must invest in egress controls, anomaly detection, and multicloud visibility to cut off attacker command-and-control before damage occurs.
Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries
In October 2026, the Skyw4lker device code phishing campaign was identified targeting U.S. organizations across manufacturing, technology, and healthcare sectors. Attackers distributed password-protected business documents posing as contracts or service proposals, redirecting victims through Google Sites infrastructure into a legitimate Microsoft authentication flow. Rather than harvesting credentials via fake login pages, the campaign abused OAuth 2.0 device authorization grants to capture valid Microsoft 365 tokens. A PHP/JavaScript backend tracked victim sessions, collected geolocation data, and polled authentication status in real time, yielding persistent account access while generating only legitimate-looking authentication telemetry. Device code phishing represents a maturing evasion technique that bypasses MFA and traditional credential-theft defenses by exploiting legitimate cloud authentication protocols. As FBI IC3 data records over $20.9 billion in internet crime losses in 2025 and phishing volumes continue to rise, identity-based attacks that produce no fake login pages are increasingly difficult to detect with conventional email and endpoint security tools alone.
Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk
In October 2026, Adobe disclosed eight critical vulnerabilities in Campaign Classic (versions 7.4.4 build 9402 and earlier) spanning code injection, OS command injection, incorrect authorization, SQL injection, and reflected cross-site scripting. CVSS scores range from 9.1 to 9.9, indicating near-maximum severity. Successful exploitation could allow unauthenticated or low-privileged attackers to execute arbitrary code, bypass security controls, and escalate privileges on both Windows and Linux deployments. Adobe patched all eight flaws in build 9403. A separate critical code injection flaw (CVE-2026-48360, CVSS 9.6) in Adobe Connect Desktop and Mobile was also remediated simultaneously. High-severity vulnerability clusters in widely deployed enterprise marketing platforms like Adobe Campaign Classic are increasingly attractive to ransomware operators and espionage actors. The combination of SQL injection, code injection, and privilege escalation chains provides a near-complete attack path from initial access to full host compromise, making rapid patch adoption a board-level priority.