Tag: authentication bypass
152 articles
BeyondTrust Zero-Day Exploited in Targeted Attacks Since August
A critical zero-day vulnerability, CVE-2026-102764, has been exploited in targeted attacks since late August, putting BeyondTrust Remote Support users at risk of file operations and even full root control by unprivileged remote attackers. The flaw affects Remote Support builds 26.2.3 and earlier, but thankfully, patches are available.
Ransomware Groups Exploit VPN Vulnerability
Ransomware groups like Qilin and Settra are sneaking into organizations by exploiting a VPN vulnerability, disguising their malicious activity as legitimate remote work. This allows them to steal credentials, move laterally, and deploy ransomware undetected until it's too late.
AhsayCBS Flaws Get Fresh Fixes After Exploitation
Don't wait until it's too late - apply the AhsayCBS hotfix immediately to shield your environment and customer data from severe vulnerabilities that can be exploited for unauthenticated remote code execution. Reboot your server after applying the fix to ensure you're fully protected.
Ivanti Discloses Zero-Day Exploits in Connect Secure
Ivanti has sounded the alarm on zero-day exploits targeting its Connect Secure software, warning that a limited number of customers have already been affected. The company has released urgent updates to patch the vulnerabilities and is urging customers to act fast to avoid falling prey to these attacks.
CISA Warns of Actively Exploited Ivanti Connect Secure Vulnerability
Warning: a high-severity vulnerability in Ivanti Connect Secure is under active exploitation, putting your systems at risk of remote attacks - don't wait to patch! Federal agencies must apply fixes by October 16, 2026, to stay secure.
Agentic Pentesting Exposes Coverage Gaps
Imagine having a powerful tool that can scan for vulnerabilities at incredible speed, but sometimes struggles to reach every corner of your system - that's what happened when agentic pentesting uncovered a major nginx-ui authentication bypass, missing 360 instances that were left without a clear verdict. By combining AI-driven dynamism with human insight, agentic pentesting offers a potent solution to bridge the gap between vulnerability discovery and exploitation.
CISA Warns of Ivanti Flaw Exploited in Zero-Day Attacks
A high-severity security flaw in Ivanti Connect Secure, known as CVE-2026-104935, has been exploited in zero-day attacks since October 1st, allowing hackers to remotely execute malicious commands without authentication. CISA is urging security teams to patch immediately and hunt for signs of compromise to protect their networks.
CISA Warns of Active Ivanti Connect Secure Exploit Attempts
Warning signs are flashing: 105 attempted hacks have targeted Ivanti Connect Secure systems in a short span, exploiting a severe authentication-bypass bug that lets attackers run malicious commands remotely. This zero-day vulnerability, tracked as CVE-2026-104935, is under active attack, putting unpatched systems at risk.
Ivanti Zero-Day Exploited Before Patch Release
Ivanti's internal discovery of a zero-day vulnerability in June didn't stop attackers from exploiting it in the wild by October 1, highlighting a disturbing gap in patch protection. Researchers uncovered a chain of three zero-day flaws being used to breach Ivanti Connect Secure authentication and execute remote code.
Ivanti Zero-Days Exploited for Root Access
Hackers are on the loose, exploiting three Ivanti zero-day vulnerabilities to gain root access to sensitive systems - and they don't even need a login to do it. This alarming exploit chain allows attackers to run commands with full system privileges, putting organizations at serious risk.
Docker Fixes Flaw That Let Users Push Images as Others on Hub
Docker patched a critical security flaw that allowed users to push images as others on Docker Hub, exposing a vulnerability that went undetected for over two years. The bug, logged as CVE-2026-105445, had a near-perfect CVSS 4.0 score of 9.4, highlighting the severity of the issue.
Ivanti Discloses Zero-Day Exploited in Targeted Attacks
A high-severity zero-day vulnerability in Ivanti Connect Secure appliances is being exploited in targeted attacks, allowing remote attackers to execute arbitrary commands without user interaction. This authentication bypass flaw, tracked as CVE-2026-104935, affects several ICS versions and requires immediate patching and mitigation.
Docker Hub vulnerability exposes user impersonation risk
A critical vulnerability in Docker Hub, known as CVE-2026-105445, allowed attackers to impersonate users by exploiting a loophole in personal access token handling, putting user accounts at risk of being compromised. This flaw enabled malicious actors to convert a personal account into an organization, reassigning the token to another user without their consent.
Ransomware Groups Exploit Palo Alto VPN Flaw Despite Patch Release
Ransomware groups are actively exploiting a patched vulnerability in Palo Alto VPNs, allowing them to masquerade as legitimate remote workers and evade detection until they strike. This sneaky tactic enables hackers to steal credentials, move laterally, and deploy ransomware, causing devastating consequences.
AhsayCBS flaws exploited to deploy webshells, crypto miners
Cyber attackers have struck at least five organizations by exploiting two unpatched flaws in the AhsayCBS backup management platform, using a clever two-step attack chain to gain access and deploy malicious code. By chaining these vulnerabilities, the attackers were able to quickly move from gaining access to taking control of the compromised systems.
Mythos Exposes New Vulnerability in Rejetto HTTP File Server
A critical vulnerability, CVE-2026-61500, has been uncovered in Rejetto HTTP File Server (HFS), allowing for full administrator access and remote code execution. This flaw was discovered using Anthropic's bug-hunting model Mythos and can be exploited with alarming ease.
Zero Trust Vulnerable to Onboarding Attacks
The often-overlooked onboarding process is a glaring weak spot in Zero Trust security, leaving companies vulnerable to attacks that exploit the "Day One window" when new hires are first brought into the environment. Stolen credentials, involved in nearly 45% of breaches, can easily be stolen during this chaotic period when service desk agents are busy activating accounts and issuing initial credentials.
CISA Flags Exploited Cisco SD-WAN Flaw
A critical vulnerability in Cisco SD-WAN Manager, known as CVE-2026-76504, has been flagged by CISA and is being actively exploited, allowing hackers to gain admin-level access with a CVSS score of 9.8. This hex encoding flaw could let unauthenticated attackers remotely access and control affected systems.
Cisco SD-WAN Manager Flaw Exploited by Attackers
Cisco's SD-WAN Manager has a critical vulnerability that allows attackers to bypass authentication and access the Manager's API as an admin user without login credentials. This flaw, rated 9.8 out of 10 in severity, is being actively exploited, prompting Cisco to urge immediate upgrades to fixed releases.
MCP Python SDK Flaw Exposes OAuth Credentials to Malicious Servers
A shocking flaw in the MCP Python SDK leaves OAuth credentials vulnerable to malicious servers, allowing hackers to steal sensitive data with a simple trick. Without a crucial security setting, the SDK can be easily duped into sending login info to the wrong server.
CISA Warns of Widespread Exploitation of SharePoint, Adobe Commerce Flaws
Don't wait until it's too late - with nearly 1,000 customers across critical sectors like banking, government, and telecommunications at risk, organizations can't afford to delay action against widespread exploitation of SharePoint and Adobe Commerce flaws. A critical authentication-bypass vulnerability, CVE-2026-5430, is already being exploited, putting multiple WSO2 products at risk.
Ransomware gangs exploit TeamCity flaw in targeted attacks
A critical TeamCity vulnerability, now patched, could let attackers run malicious commands and bypass security checks, putting sensitive data and configurations at risk. This flaw highlights the importance of updating to versions 2025.11.7 and 2026.1.3 to safeguard against potential threats.
GitLab Exposes Email Token Flaw, Enabling Unauthorized Code Pushes
GitLab has a security flaw that exposes a private email token, allowing unauthorized users to push code changes to projects - essentially giving anyone carte blanche to act on your behalf. This token, tied to your account, doesn't expire and grants access to all projects you have permission to open.
Cisco Zero-Day Exploited in Active Attacks
Cisco is warning of a critical zero-day flaw in its Identity Services Engine (ISE) that's being actively exploited, allowing attackers to bypass authentication and gain unauthorized access with just a crafted request. This severe vulnerability, tracked as CVE-2026-76460, has been assigned a maximum CVSS score of 10.0.