…Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being actively exploited in attacks. Federal agencies have until July 17, 2026…
…Over the weekend, Defused security researchers confirmed that attackers have begun exploiting the vulnerability in the wild, with the first attempts being observed on Friday, days after ServiceNow issued patches. "We are…
…CISA added the CVE-2026-3055 vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on March 30 and ordered federal agencies to secure vulnerable Citrix appliances within three days. Over the last…
…Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. The…
Critical wp2shell WordPress flaws exploited to install webshells By Bill Toulas July 21, 2026 12:41 PM Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137…
…According to VulnCheck security researcher Caitlin Condon, their honeypots have now detected attackers exploiting the vulnerability to drop test files on vulnerable instances. "Because Langflow enables unauthenticated auto-login by default, no…
Australia warns of global campaign targeting vulnerable CMS platforms By Bill Toulas July 11, 2026 10:18 AM The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign…
…to vulnerable instances. In both cases, BeyondTrust noted that exploitation also requires a specific authentication configuration to be enabled, but it didn't share further details. BeyondTrust has also released security updates…
Microsoft warns of new Defender zero-days exploited in attacks By Sergiu Gatlan May 21, 2026 03:49 AM On Wednesday, Microsoft started rolling out security patches for two Defender vulnerabilities that…
…According to an Arista security advisory published Monday, the vulnerability allows remote attackers to access privileged functionality that was intended only for internal use and should not be remotely accessible. "Successful exploitation…
