Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Critical Cisco Email Gateway Zero-Day Highlights Perimeter Security Risks
In September 2026, Cisco disclosed that threat actors were actively exploiting a critical zero-day vulnerability (CVE-2026-76461) in Cisco Secure Email Gateway appliances. The flaw stems from insufficient validation in email parsing logic, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted emails containing malicious SQL statements. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days. This incident represents the latest in a concerning pattern of Cisco security appliance compromises, with CISA flagging 98 Cisco vulnerabilities as actively exploited since 2021, including seven abused by ransomware gangs.
5 days ago
Kill Chain
Ransomware Gangs Exploit Critical VMware vCenter RCE Flaw (CVE-2026-59310)
In July 2026, Broadcom patched CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter's Syslog server that allows unauthenticated remote code execution. Despite urgent patching guidance, threat actors quickly began exploiting the flaw within weeks, with QUIRSO identifying over 361 compromised IP addresses across 47 countries. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog in August and recently flagged it as actively exploited by ransomware gangs, highlighting the critical risk to enterprise virtualization infrastructure. This incident underscores the accelerating timeline between vulnerability disclosure and ransomware exploitation, particularly targeting VMware environments that serve as high-value infrastructure targets for enterprise data access and lateral movement capabilities.
5 days ago
Kill Chain
PaperCut Zero-Day Incident Exposes Critical Gaps in Post-Mythos Security Response
In August 2026, PaperCut NG/MF servers faced active zero-day exploitation before any patches were available, exemplifying the new reality of AI-accelerated vulnerability discovery. The incident began on August 27 when PaperCut issued an urgent advisory about active exploitation with no CVE, exploit details, or available patches. The first emergency patch released a day later was immediately bypassed, requiring three separate patch iterations over six days while attackers maintained active exploitation capabilities. This incident highlighted the critical gap between disclosure and effective remediation in the post-Mythos era, where disclosure-to-exploitation windows have compressed from an average of 21.5 days to mere hours. This incident represents the new template for zero-day response in an era where artificial intelligence has fundamentally accelerated both vulnerability discovery and weaponization timelines. Organizations now face scenarios where traditional patch-first security models fail, requiring immediate implementation of compensating controls and technique-based validation before exploits become publicly available.
5 days ago
Kill Chain
WordPress Under Fire: CVE-2026-27540 Plugin Flaw Enables Mass Webshell Attacks
In September 2026, security researchers identified active exploitation of CVE-2026-27540, a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin. The flaw allows unauthenticated attackers to upload PHP webshells through an exposed AJAX action, enabling complete site compromise. Wordfence reported blocking over 100,000 exploitation attempts, with attack spikes occurring between June and August 2026. The vulnerability affects versions 2.0.3.1 and older of the premium plugin, which was patched in version 2.0.3.2 released in February 2026. This incident highlights the ongoing threat landscape targeting WordPress ecosystems, where third-party plugin vulnerabilities continue to provide attack vectors for cybercriminals seeking to establish persistent access to websites for malicious purposes including data theft and further payload deployment.
5 days ago
Kill Chain
CVE-2026-87886: Acronis cPanel Backup Plugin Under Active Attack
In September 2026, Acronis disclosed CVE-2026-87886, a high-severity Linux local privilege escalation vulnerability in its backup plugins for cPanel, WebHost Manager (WHM), and Plesk. The vulnerability allows low-privileged attackers to escalate permissions on vulnerable Linux servers without user interaction, potentially enabling access to sensitive data and system disruption. Acronis confirmed active exploitation in limited, targeted attacks against hosting environments, prompting immediate patching recommendations for affected versions. This incident highlights the growing trend of attackers targeting web hosting infrastructure and third-party plugins, which provide attractive attack surfaces due to their privileged access to multiple customer environments and critical business operations.
5 days ago
Kill Chain
KREMLIN Banking Malware: How Brazilian Cybercriminals Weaponize Browser Extensions
The KREMLIN banking malware operation, tracked as REF9334, has been targeting Brazilian financial institutions since May 2025 through sophisticated browser hijacking techniques. The threat actors deploy malicious Chrome and Microsoft Edge extensions that bypass Chromium integrity mechanisms by manipulating Secure Preferences files and regenerating required HMACs. The operation leverages Ethereum smart contracts as dead drop resolvers to dynamically update command-and-control endpoints, making disruption extremely difficult. Over 1,515 infected systems have been identified, with 98% located in Brazil. This incident represents the growing sophistication of banking malware that exploits browser extension ecosystems and blockchain infrastructure for resilient operations. As financial institutions increasingly rely on web-based services and multi-factor authentication through browsers, attackers are adapting with advanced techniques that bypass traditional security controls.
5 days ago
Kill Chain
VectraRAT: How a $250 Subscription Makes Enterprise Hacking Accessible
VectraRAT represents a sophisticated malware-as-a-service (MaaS) platform discovered by SOCRadar researchers in June 2026, offering cybercriminals comprehensive enterprise attack capabilities for just $250 per month. The platform provides a full-stack solution including a custom Windows implant, command-and-control infrastructure, and operator panel built entirely from scratch rather than leveraging existing malware frameworks. The RAT incorporates advanced features like User Account Control bypass, proprietary C2 protocols, credential harvesting, and remote desktop access. Analysis revealed 48% of victims were corporate Windows environments including Enterprise editions and Windows Server 2025, with confirmed data exfiltration from compromised systems across the US, Russia, and Germany. This incident highlights the concerning democratization of sophisticated cyberattack capabilities, as professional-grade attack infrastructure becomes increasingly accessible through affordable subscription models, significantly lowering the technical barriers for cybercriminals targeting enterprise networks.
5 days ago
Kill Chain
Critical SAML Flaw in Siemens Mendix Enables Account Hijacking Across Industrial Systems
A critical authentication bypass vulnerability (CVE-2026-80465) was discovered in Siemens Mendix SAML modules across multiple versions, scoring 8.7 on the CVSS scale. The flaw stems from improper validation of SAML response signatures, allowing unauthenticated remote attackers to hijack user accounts and sessions in specific Single Sign-On (SSO) configurations. Affected versions include Mendix 9.24, 10, and 11 compatible modules, with the vulnerability impacting critical manufacturing and IT infrastructure worldwide. Siemens has released patches requiring immediate updates to versions 3.6.27 or 4.2.3 depending on the Mendix platform version. This incident highlights the growing trend of authentication protocol vulnerabilities targeting enterprise SSO systems, particularly as organizations increasingly rely on federated identity management for cloud and hybrid environments.
5 days ago
Kill Chain
Cisco Email Gateway Under Attack: CVE-2026-76461 Grants Root Access via Malicious Emails
In September 2026, Cisco disclosed CVE-2026-76461, a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway with a CVSS score of 9.8. The flaw stems from insufficient validation in email parsing logic, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted email messages containing malicious SQL statements. Cisco confirmed active exploitation in the wild and directly contacted customers whose devices showed signs of compromise. The U.S. CISA immediately added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies apply patches by September 17, 2026. This incident highlights the escalating threat to email security infrastructure as attackers increasingly target messaging gateways to gain initial foothold and root-level access, coinciding with broader campaigns against network appliances like the concurrent Fortinet VPN credential attacks reported in late August 2026.
5 days ago
Kill Chain
Critical LiteSpeed Enterprise Flaw Exposes Shared Hosting Infrastructure to Root Access Attacks
A critical privilege escalation vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 allows low-privilege hosting account users to gain root access on shared hosting servers. Disclosed by cPanel on September 14, 2026, the flaw bypasses security controls including CageFS that normally isolate hosting accounts from each other. The vulnerability enables attackers with basic hosting accounts to access or alter other customers' websites and compromise the entire server infrastructure. LiteSpeed released version 6.3.7 on September 11 to address the issue, though specific technical details and CVE assignment remain pending. This represents the third LiteSpeed-related privilege escalation flaw reported since May 2026, highlighting ongoing security challenges in shared hosting environments where multiple customer websites coexist on single servers.
5 days ago
Kill Chain
Vite Development Servers Under Attack: Mass Campaign Steals Cloud Credentials
In 2024, cybersecurity researchers from F5 Labs disclosed a mass-scanning campaign targeting exposed Vite development servers to extract sensitive cloud credentials and configuration data. The automated attack systematically scanned internet-facing Vite instances, exploiting misconfigurations to steal AWS and Microsoft Azure credentials, infrastructure state files, and other sensitive development artifacts. The campaign demonstrated how exposed development environments can become critical attack vectors for cloud infrastructure compromise, potentially leading to broader cloud account takeovers and data breaches across multiple organizations. This incident highlights the growing threat to cloud-native development workflows as attackers increasingly target DevOps toolchains and CI/CD pipelines. With organizations rapidly adopting cloud-first development practices and infrastructure-as-code approaches, securing development servers and preventing credential exposure has become a critical security imperative for preventing cloud account compromise.
5 days ago
Kill Chain
Apple's Record-Breaking Security Update: 261 Vulnerabilities Patched Across All Platforms
On September 14, 2024, Apple released comprehensive security updates across all operating systems, patching a record-breaking 261 vulnerabilities in iOS 27, macOS Golden Gate 27, and other platforms. The vulnerabilities spanned critical system components including kernel memory corruption, privilege escalation flaws, and sandbox escape vulnerabilities affecting core frameworks like WebKit, Kernel, CUPS, and SMB protocols. While Apple reported no active exploitation, the patches addressed severe security gaps including remote code execution, information disclosure, and authentication bypass vulnerabilities that could enable attackers to gain root privileges or access sensitive user data. This massive patch release reflects the evolving complexity of modern attack surfaces and Apple's proactive approach to security hardening. The scale of vulnerabilities demonstrates the critical importance of comprehensive endpoint security and zero-trust architectures as threat actors increasingly target foundational system components and inter-service communications.
5 days ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports