Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
… Deleting critical files, such as wp-config.php , can revert the site to its initial setup state, potentially leading to a full site takeover and remote code execution. …
Search
Critical SimpleHelp flaw exploited to deploy new stealer malware
… Browser data, shell history, SSH configuration, PGP keys, database client configuration, operating system information, and other user files. …
KnowledgeDeliver flaw exploited as a zero-day to install web shells
… 24, 2026 relied on a standardized web.config file provided by the vendor. This configuration file contained hardcoded machineKey values used by the ASP.NET framework to encrypt and sign data, including ViewState payloads,” Mandiant explains. …
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access
… This includes backing up configuration files before modifying them and then restoring them after exploitation. They also cleaned up traces of exploitation by deleting the malicious CSV payload, removing temporary files created during the attack, and erasing evidence of the rogue root account. …
Avada Builder WordPress plugin flaws allow site credential theft
… The issue is that the plugin does not properly validate file types or sources, allowing access to sensitive files such as wp-config.php, which typically contains database credentials and cryptographic keys. …
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
… Organizations should review VCO logs for signs of exploitation, including: Unusual web requests containing encoded characters, URL-like path components, references to local or internal services, or abnormally high request rates Connections from known malicious IP addresses Unexpected outbound HTTP … …
New RefluXFS Linux flaw lets attackers gain root privileges
… Dubbed RefluXFS by the Qualys Threat Research Unit TRU , which found and reported it, the security flaw affects systems with an XFS filesystem with reflink enabled a default configuration on major enterprise Linux distributions , running Linux kernel v4.11 or later, with a directory writable by an … …
Cisco warns of unpatched SD-WAN zero-day exploited in attacks
… However, it shared indicators of compromise IOCs warning admins to check their SD-WAN /var/log/scripts.log file for attempts to upload tenant configuration data to vSmart controllers to escalate privileges through legitimate commands, as in the following example: Apr 15 09:44:57 vmanage vScript: Te… …
Exploit available for new DirtyDecrypt Linux root escalation flaw
… Successful exploitation requires running a Linux kernel with the CONFIG RXGK configuration option , which enables RxGK security support for the Andrew File System AFS client and network transport. …
NAIC says public data stolen in ShinyHunters' PeopleSoft breach
The National Association of Insurance Commissioners NAIC says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server.