Tag: emerging threats
8348 articles
Qilin Ransomware Exploits Palo Alto Networks Flaw for Initial Access
In a recent wave of attacks, hackers exploited a high-severity flaw in Palo Alto Networks' PAN-OS software to gain initial access for Qilin ransomware attacks. This vulnerability, known as CVE-2026-0257, allowed attackers to bypass authentication and establish VPN sessions without valid credentials.
SharePoint Flaw CVE-2026-50522 Sees Active Exploitation After PoC Release
Attackers are actively exploiting a critical SharePoint vulnerability, CVE-2026-50522, using a single request to gain persistent access by pulling SharePoint machine keys. This flaw, patched by Microsoft in July, has a CVSS score of 9.8 and allows attackers to inject and execute code remotely on the SharePoint Server.
Zero Trust Bolsters Critical Infrastructure Against Identity Threats
A single compromised account, like the inactive VPN login used to breach Colonial Pipeline in 2021, can have devastating ripple effects - just imagine a national crisis triggered by a simple vulnerability. The Colonial Pipeline ransomware attack is a stark reminder of the catastrophic consequences that can unfold when critical infrastructure is compromised.
Russian Hacker Exploits Claude AI in Commercial Pentest Platform
A Russian hacker spent just $4 on a grey-market Claude API key, and within months, was selling a powerful commercial pentest tool built using jailbreak techniques to exploit the AI. This all started with a detailed tutorial on March 31, where six clever methods were shared to bypass Claude's safety filters.
Suno Data Breach Exposes 55M Users
A massive data breach at AI music platform Suno has exposed a staggering 55 million user accounts, a figure confirmed by breach tracking service Have I Been Pwned. This huge leak puts millions of users at risk.
Cloud Tenants Can Disrupt Power Grids With GPU Workloads
Researchers at Zhejiang University have made a startling discovery: ordinary GPU workloads in the cloud can be manipulated to disrupt power grids, and they've backed it up with measurements and simulations. By exploiting the link between a GPU's power draw and its computing activity, malicious cloud tenants can unwittingly - or intentionally - cause power grid instability.
Patching Speed Falls Behind as AI-Generated Exploits Rise
The clock is ticking faster than ever: AI can now turn software patches into working exploits in under an hour, shattering the old assumption that reverse-engineers had weeks to spare. Anthropic's Claude Mythos Preview has already proven its mettle, converting 18 Firefox patches into 8 code-execution exploits at alarming speed.
Invisible Screen Text Exposes Android AI Agents to Code Injection Attacks
Researchers found that a simple payload could launch a code injection attack on four open-source Android agent frameworks, successfully executing commands on the host's system in every trial. This alarming vulnerability allows attackers to exploit AI agents by manipulating text on the screen, turning a harmless string into a malicious command.
Ransomware Attacks Exploited Compromised Identities in 79% of Incidents
Ransomware attacks are often sparked by something surprisingly simple: 79% of incidents start with compromised identities, highlighting the vulnerability of legitimate user logins and credentials. This means that in nearly 8 out of 10 cases, attackers gain a foothold using stolen or hijacked identities rather than complex hacking techniques.
Ransomware Landscape Fractures as New Groups Proliferate
The ransomware landscape is shattering into more factions than ever, with over one new group emerging every week in 2026, according to the Black Kite Ransomware Report. This explosion of new players has led to a surge in attacks, with 61 new groups appearing in just one year alone.
FBI Warns of Deepfake Videos Targeting IC3 Leadership
Impersonation scams have taken a chilling turn, with scammers now using deepfake videos and AI-generated content to convincingly pose as government officials, including senior FBI leadership. These sophisticated cons combine social media impersonation, fake complaint portals, and high-fidelity videos to re-target previous fraud victims.
US Disrupts 1,000 Websites in FIFA World Cup Piracy Crackdown
In a major crackdown on piracy, the US Justice Department has seized over 1,000 websites and blocked nearly 2,000 domains used to illegally stream FIFA World Cup matches, protecting consumers from malicious software. This effort, dubbed Operation Offsides, is part of a broader initiative to safeguard copyrights and keep Americans safe online.
Qilin Ransomware Gang Exploits Palo Alto VPN Bug in Ongoing Attacks
The Qilin ransomware gang is actively exploiting a critical vulnerability in Palo Alto Networks' VPN software, CVE-2026-0257, to breach security and launch attacks, despite a patch being released on May 13. This alarming development follows reports of multiple intrusions by Qilin in June, highlighting the urgent need for updates.
North Korean Hackers Expose Web3 Pros to Sophisticated ClickFake Scams
One in three employees have admitted to using company tech for personal gain, and North Korean hackers are exploiting this vulnerability with a clever recruitment scam that can give them access to corporate funds. The sophisticated scheme, attributed to the notorious Famous Chollima group, targets Web3 and cryptocurrency pros with fake job offers on popular platforms like LinkedIn and Telegram.
Craneware Discloses Data Theft in Cyber Incident
A recent cyber incident at healthcare finance software provider Craneware exposed a significant volume of sensitive data, including customer and business partner records, highlighting the ease with which determined attackers can carry out data exfiltration. Even seemingly low-severity incidents can pose a real risk of data exposure.
Microsoft Offers Manual Fix for WSUS Sync Delays
Microsoft has restored synchronization times and sync operations on WSUS servers for new installations and rebuilds, and is offering a manual fix for those still experiencing delays. The tech giant took swift action to address the issue, which was causing Windows Update scans to fail or time out, starting with a service-side mitigation on July 13.
WordPress Exploitation Surges as Public Exploit Fuels Remote Code Execution
A surge in WordPress exploitations is underway as hackers leverage a public exploit to enable remote code execution on vulnerable sites, posing a threat to organizations of all sizes and industries. The flaw, dubbed "wp2shell," allows unauthenticated attacks on default WordPress installations, sparking widespread scanning and compromise.
Unofficial Patches Mitigate Windows Zero-Day Flaw
Microsoft is investigating a newly discovered Windows zero-day flaw, dubbed LegacyHive, and is working to update impacted products to protect customers as soon as possible. A researcher disclosed the vulnerability, along with a proof-of-concept exploit, on the same day as Microsoft's July 2024 Patch Tuesday updates.
ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
A critical vulnerability in the ServiceNow AI Platform, known as CVE-2026-6875, has been discovered, allowing unauthenticated users to execute arbitrary code and potentially compromise entire instances and connected proxy servers. This severe flaw has been assigned a CVSS score of 9.5, highlighting the urgent need for enhanced security measures.
ENCFORGE Ransomware Targets AI Model Files in Langflow Attack
A new ransomware called ENCFORGE is targeting AI model files, exploiting a high-severity flaw in Langflow to deploy a custom-built payload that threatens machine learning systems. This highly specialized attack focuses on encrypting critical AI data, including PyTorch, TensorFlow, and Hugging Face files.
Flock Cameras Expose License Plate Tracking Flaws
A simple typo in a police report led to a writer's mistaken identity, tracking, and arrest - highlighting a glaring flaw in Flock camera's license plate tracking technology. The AI system failed to catch a small numeric discrepancy, matching a partial plate entry to a completely different vehicle.
Cyberattack Disrupts Coca-Cola's Fairlife Production Operations
A cyberattack has forced Coca-Cola's fairlife, LLC to temporarily halt production in the US, but the company assures that product quality and safety remain unaffected. The incident involved unauthorized access to production-related systems, prompting a swift suspension of operations.
OVH Disrupts Januscape Bug with Mass Reboots
To minimize risk to customers, OVH took swift action with mass reboots to disrupt the Januscape bug, opting for decisive action over detailed communication that could have tempted some to test the publicly available exploit. This critical flaw, tracked as CVE-2026-53359, allowed attackers to escape guest VMs and wreak havoc on host systems.
Estée Lauder Breach Exposes Sensitive Data via Oracle Flaw
Estée Lauder's HR system was hacked through a vulnerability in Oracle's E-Business Suite, exposing sensitive personal data of certain individuals after an unauthorized access on August 9, 2025. The breach, discovered on June 19, 2026, has raised concerns about data security for the cosmetics giant with 57,000 employees.