Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Mythos 5 AI Demonstrates Autonomous Cyber Attacks: The 6-Month Countdown Begins
In September 2026, Booz Allen Hamilton confirmed that Anthropic's Mythos 5 AI model achieved autonomous end-to-end network compromise capabilities, scoring 80 on their new Cyber Weapon Index. The model successfully executed complete attack chains without human intervention, demonstrating reconnaissance, exploitation, and lateral movement across production-grade enterprise networks. This milestone represents a fundamental shift in cybersecurity threats, as AI-powered attacks can now operate at machine speed and scale, compressing traditional multi-week attack timelines into days or hours. The emergence of autonomous AI attackers marks a critical inflection point where traditional human-speed defenses become inadequate against machine-speed offensive operations.
Phantom Deal Campaign Exploits M&A Processes in Sophisticated Enterprise Fraud
The 'Phantom Deal' campaign represents a sophisticated evolution of advance fee scams targeting large enterprises through fake merger and acquisition proposals. Threat actors conducted extensive reconnaissance on companies like Gen (Norton/Avast parent company), impersonating executives via WhatsApp and creating fraudulent documentation from legitimate firms like PwC. The attackers attempted to trick employees into authorizing substantial financial transfers, with one attempt involving €626,735.45, by leveraging detailed corporate intelligence and social engineering tactics that exploited M&A processes and confidentiality requirements. This campaign highlights the growing sophistication of business email compromise attacks as threat actors increasingly target high-value corporate transactions. With M&A activity remaining robust and remote work normalizing digital-only communications, similar social engineering campaigns pose escalating risks to enterprise financial controls and decision-making processes.
The AI Vulnpocalypse: How Machine Learning Is Exposing Hidden Security Flaws at Scale
The cybersecurity industry is experiencing an unprecedented surge in vulnerability discovery driven by AI-powered research tools, dubbed the 'vulnpocalypse.' Large language models have automated and accelerated bug hunting processes, with platforms like HackerOne reporting doubled vulnerability reports year-over-year. This has overwhelmed software vendors' remediation capabilities, creating massive backlogs with critical vulnerabilities increasing 30-fold in some cases. The phenomenon exposes fundamental secure-by-design failures across the software industry, as AI doesn't sleep and can systematically find vulnerabilities at scale that were previously hidden. The AI-driven vulnerability discovery revolution is reshaping the economics of cybersecurity, forcing a reckoning with decades of insecure software development practices. Organizations are struggling to adapt their disclosure processes and remediation workflows to handle the exponential increase in discovered vulnerabilities, creating new bottlenecks in the security ecosystem.
Critical Buffer Overflow Vulnerability CVE-2026-78012 Threatens Industrial Control Systems
In September 2026, CISA disclosed CVE-2026-78012, a critical stack-based buffer overflow vulnerability in Pyramid Solutions NetStaX EtherNet/IP Stack affecting versions prior to 5.6.1. The vulnerability allows attackers to send large Class 3 explicit-message requests that exceed application-side receive buffers without generating error warnings, potentially leading to memory corruption, device crashes, or remote code execution. With a CVSS score of 9.8, this flaw impacts multiple industrial control systems across critical infrastructure sectors including manufacturing, energy, water treatment, and chemical facilities worldwide. The vulnerability represents a significant threat to operational technology environments where these industrial communication stacks are widely deployed. This incident highlights the growing cybersecurity risks facing industrial control systems as OT networks become increasingly connected and targeted by sophisticated threat actors, making secure industrial communication protocols and robust buffer management critical for protecting critical infrastructure.
Critical VPN Vulnerability CVE-2026-75925 Exposes Infrastructure to Remote Code Execution
In August 2026, CISA disclosed CVE-2026-75925, a critical CRLF injection vulnerability in IXON VPN Client versions prior to 1.4.7 with a CVSS score of 9.6. The vulnerability allows remote attackers to execute commands with root or SYSTEM privileges by injecting malicious configuration directives through unvalidated line-ending sequences. The flaw stems from improper neutralization of CRLF sequences in configuration values written to files consumed by privileged subprocesses, combined with lack of authentication for configuration changes. IXON responded by automatically rejecting connections from vulnerable client versions and releasing patches, preventing exploitation on unpatched systems that cannot establish VPN connections. This incident highlights the growing sophistication of infrastructure-targeted attacks and the critical importance of secure coding practices in VPN solutions that organizations rely on for remote access security.
GPT-6 Astra Scores Perfect on ExploitBench: The Dawn of AI-Powered Cyber Warfare
OpenAI released GPT-6 Astra in September 2026, achieving a perfect 100% score on ExploitBench, demonstrating unprecedented AI-driven exploit development capabilities including zero-day vulnerability exploitation and privilege escalation on hardened systems. While the public release includes safeguards blocking proof-of-concept exploit generation, the underlying model can autonomously develop working exploits for recently disclosed vulnerabilities and achieve arbitrary code execution in secured environments. OpenAI launched the $1 billion Daybreak initiative to provide subsidized access to defensive cybersecurity organizations while restricting offensive capabilities. This incident highlights the critical dual-use nature of frontier AI models as cyber weapons become increasingly accessible through artificial intelligence, requiring immediate policy frameworks for AI-powered exploit development and defensive capability distribution.
Critical Vulnerabilities Expose Rockwell Automation Industrial Control Systems to Remote Attacks
CISA disclosed two critical vulnerabilities (CVE-2026-19471, CVE-2026-19472) affecting Rockwell Automation's ArmorStart LT motor protection devices version 2.001 and earlier. CVE-2026-19471 involves stored cross-site scripting (XSS) vulnerabilities that allow attackers to inject malicious scripts executed when users access affected web pages. CVE-2026-19472 is a denial-of-service vulnerability triggered by crafted HTTP PUT requests that can disable the embedded web server. Both vulnerabilities require no authentication and can be exploited remotely, potentially compromising industrial control systems used in critical manufacturing worldwide. These vulnerabilities highlight the growing attack surface of industrial IoT devices and the critical need for secure-by-design principles in operational technology environments, especially as industrial systems become increasingly connected to enterprise networks.
Critical OT Vulnerability Exposes Industrial Control Systems to Code Execution Attacks
Rockwell Automation's ControlFLASH software versions 15.07 and earlier contain a critical vulnerability (CVE-2026-12663) that grants write permissions to the 'Everyone' group on installation directories. This security flaw allows attackers to execute arbitrary code at the logged-in user's permission level, potentially compromising industrial control systems across critical infrastructure sectors including manufacturing, energy, and water systems. The vulnerability stems from missing authentication for critical functions and affects installations worldwide. Rockwell has released version 15.08 to address this issue and provided manual mitigation steps for systems that cannot immediately upgrade. This incident highlights the growing cybersecurity risks facing operational technology (OT) environments as industrial systems become increasingly connected and targeted by threat actors seeking to disrupt critical infrastructure operations.
Chrome V8 Zero-Day CVE-2026-85046: Critical Browser Security Incident Analysis
Google patched CVE-2026-85046, a high-severity type confusion vulnerability in Chrome's V8 JavaScript engine, actively exploited in the wild. The zero-day flaw allowed remote attackers to execute arbitrary code through crafted HTML pages, representing the sixth Chrome zero-day addressed by Google in 2026. Security researcher Salvatore Gulizia discovered the bug in V8's compilers that led to array element type confusion, enabling arbitrary read/write operations on the JavaScript heap. This incident highlights the continued targeting of browser engines by threat actors seeking code execution capabilities through web-based attack vectors, emphasizing the critical importance of rapid patch deployment for client-side security vulnerabilities.
Critical Vulnerabilities in Tycon Systems Industrial Monitoring Devices Threaten Infrastructure Security
In September 2026, CISA disclosed three critical vulnerabilities (CVE-2026-77847, CVE-2026-82712, CVE-2026-82684) affecting Tycon Systems TPDIN-Monitor-WEB3 industrial control system devices version 2.2.9 and prior. These vulnerabilities include hard-coded credentials, cross-site request forgery, and missing authorization controls that could enable attackers to perform man-in-the-middle attacks, extract system credentials, cause factory resets, or retrieve sensitive operational data from critical infrastructure systems deployed worldwide in energy and manufacturing sectors. These vulnerabilities highlight the ongoing security challenges in operational technology environments where legacy authentication models and insufficient access controls create attack vectors that could disrupt critical infrastructure operations and expose sensitive industrial data.
Critical Plex Security Update: Multiple Vulnerabilities Patched in September 2026
In September 2026, Plex urged users to immediately update their Media Server and Desktop applications following the discovery of multiple undisclosed security vulnerabilities. The streaming media service released patches in Plex Media Server version 1.43.3 and Plex Desktop 1.115.0, with CVE identifiers requested for the flaws. While technical details remain undisclosed, this follows a pattern of critical Plex vulnerabilities, including a high-severity authentication bypass flaw (CVE-2025-34158) patched in August 2025 that exposed server owner credentials to any authenticated user. This incident highlights the ongoing security challenges facing media streaming infrastructure, particularly as threat actors increasingly target home and small business servers. With over 360,000 Plex servers exposed to the internet and a history of exploitation including the 2022 LastPass breach chain, these vulnerabilities underscore the critical need for rapid patch deployment and network segmentation.
Mass WordPress Plugin Exploitation: 440,000 Attacks Target Critical RCE Flaws
In July-August 2026, threat actors launched widespread exploitation campaigns targeting critical remote code execution vulnerabilities in two popular WordPress plugins: Super Forms (CVE-2026-14894, CVSS 9.8) and Elementor Pro (CVE-2026-32475, CVSS 9.0-9.8). Both flaws allow unauthenticated attackers to upload malicious PHP files through missing file type validation, enabling complete site takeover. Wordfence blocked over 440,000 exploit attempts across both vulnerabilities, with attackers deploying web shells like "Mushr00w_upl.php" to establish persistent access and exfiltrate data. The mass exploitation demonstrates the continued threat to web applications through plugin vulnerabilities. These attacks highlight the accelerating pace of WordPress plugin exploitation in 2026, as threat actors increasingly target content management systems to gain initial access for broader campaigns including ransomware deployment and data theft operations.