Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
… Deleting critical files, such as wp-config.php , can revert the site to its initial setup state, potentially leading to a full site takeover and remote code execution. …
Search
All sources
bleepingcomputer.com
68
cloud.google.com
6
theregister.com
4
about.gitlab.com
4
windowscentral.com
3
techradar.com
3
appleinsider.com
3
igorslab.de
3
tomshardware.com
2
arstechnica.com
2
developer.nvidia.com
2
9to5mac.com
2
Critical SimpleHelp flaw exploited to deploy new stealer malware
… Browser data, shell history, SSH configuration, PGP keys, database client configuration, operating system information, and other user files. …
KnowledgeDeliver flaw exploited as a zero-day to install web shells
… 24, 2026 relied on a standardized web.config file provided by the vendor. This configuration file contained hardcoded machineKey values used by the ASP.NET framework to encrypt and sign data, including ViewState payloads,” Mandiant explains. …
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access
… This includes backing up configuration files before modifying them and then restoring them after exploitation. They also cleaned up traces of exploitation by deleting the malicious CSV payload, removing temporary files created during the attack, and erasing evidence of the rogue root account. …
Avada Builder WordPress plugin flaws allow site credential theft
… The issue is that the plugin does not properly validate file types or sources, allowing access to sensitive files such as wp-config.php, which typically contains database credentials and cryptographic keys. …
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
… Organizations should review VCO logs for signs of exploitation, including: Unusual web requests containing encoded characters, URL-like path components, references to local or internal services, or abnormally high request rates Connections from known malicious IP addresses Unexpected outbound HTTP … …
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit | Google Cloud Blog
… Staging & C2 Network Indicators 142.11.200.186 142.11.200.187 142.11.200.188 142.11.200.189 142.11.200.190 azurenetfiles.net Staging Payloads & Attacker Files File Path / Name Indicator Type Description Value / Hash SHA-256 .bash history File Hash Attacker command history 2ab684d93c1553fad87041b4de…
New RefluXFS Linux flaw lets attackers gain root privileges
… Dubbed RefluXFS by the Qualys Threat Research Unit TRU , which found and reported it, the security flaw affects systems with an XFS filesystem with reflink enabled a default configuration on major enterprise Linux distributions , running Linux kernel v4.11 or later, with a directory writable by an … …
Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager | Google Cloud Blog
… Filename Description SHA256 /home/admin/.orig vbond vsmart tenant list Backup configuration file Not recovered /home/admin/.orig vbond vsmart tenant list.state State file Not recovered /home/admin/.orig passwd Backup password file Not recovered /home/admin/.orig shadow Backup password file Not reco… …
Cisco warns of unpatched SD-WAN zero-day exploited in attacks
… However, it shared indicators of compromise IOCs warning admins to check their SD-WAN /var/log/scripts.log file for attempts to upload tenant configuration data to vSmart controllers to escalate privileges through legitimate commands, as in the following example: Apr 15 09:44:57 vmanage vScript: Te… …