Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.https://blog.cybercult.biz/en-ushttps://blog.cybercult.biz/posts/2026-11-01-google-patches-exploited-android-zero-day/https://blog.cybercult.biz/posts/2026-11-01-google-patches-exploited-android-zero-day/Google issued patches for CVE-2024-43093, an actively exploited Android Framework zero-day vulnerability in ExternalStorageProvider that allows attackers to bypass file path filters and access sensitive app data directories.Sun, 01 Nov 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-31-ptzoptics-camera-zero-day-chain-exploited/https://blog.cybercult.biz/posts/2026-10-31-ptzoptics-camera-zero-day-chain-exploited/GreyNoise uncovered active in-the-wild exploitation of two chained zero-day vulnerabilities in PTZOptics cameras, CVE-2024-8956 and CVE-2024-8957, enabling unauthenticated remote attackers to bypass access controls and execute commands as root.Sat, 31 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-31-storm-0940-chinese-hackers-quad7-botnet/https://blog.cybercult.biz/posts/2026-10-31-storm-0940-chinese-hackers-quad7-botnet/Microsoft disclosed that Chinese state-sponsored actor Storm-0940 weaponized CovertNetwork-1658, a SOHO router botnet known as Quad7, to orchestrate low-and-slow password spraying and brute-force campaigns against Microsoft 365 tenants across North America and Europe.Sat, 31 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-30-lottiefiles-npm-supply-chain-crypto-drainer/https://blog.cybercult.biz/posts/2026-10-30-lottiefiles-npm-supply-chain-crypto-drainer/Threat actors hijacked an authorized developer account to push malicious versions of the @lottiefiles/lottie-player npm library, weaponizing unpinned CDN distributions to inject cryptocurrency drainer prompts into decentralized finance and Web3 applications.Fri, 30 Oct 2026 17:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-10-30-sophos-pacific-rim-chinese-apts-firewalls/https://blog.cybercult.biz/posts/2026-10-30-sophos-pacific-rim-chinese-apts-firewalls/Sophos disclosed Operation Pacific Rim, detailing a five-year campaign where Chinese state-sponsored threat actors weaponized zero-days and custom Linux rootkits like Pygmy Goat against edge firewalls, establishing stealthy relay networks to penetrate Indo-Pacific critical infrastructure.Fri, 30 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-29-emeraldwhale-scans-git-configs-steals-cloud-credentials/https://blog.cybercult.biz/posts/2026-10-29-emeraldwhale-scans-git-configs-steals-cloud-credentials/Sysdig uncovered EmeraldWhale, an automated campaign that scanned the internet for exposed Git configuration and environment files, weaponizing leaked access tokens to clone over 10,000 private repositories and exfiltrate more than 15,000 cloud credentials to a public S3 bucket.Thu, 29 Oct 2026 17:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-10-29-evasive-panda-cloudscout-steals-cloud-session-cookies/https://blog.cybercult.biz/posts/2026-10-29-evasive-panda-cloudscout-steals-cloud-session-cookies/ESET Research disclosed CloudScout, a modular .NET framework used by China-aligned APT Evasive Panda to hijack authenticated web sessions across Google Drive, Gmail, and Microsoft Outlook by weaponizing stolen browser cookies to bypass multi-factor authentication.Thu, 29 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-28-qnap-patches-hbs-command-injection-zero-day/https://blog.cybercult.biz/posts/2026-10-28-qnap-patches-hbs-command-injection-zero-day/QNAP issued emergency updates addressing CVE-2024-50388, a critical OS command injection vulnerability in HBS 3 Hybrid Backup Sync exploited at Pwn2Own Ireland 2024 to execute arbitrary commands with root privileges on NAS appliances.Wed, 28 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-28-north-korean-jumpy-pisces-play-ransomware/https://blog.cybercult.biz/posts/2026-10-28-north-korean-jumpy-pisces-play-ransomware/Palo Alto Networks Unit 42 uncovered North Korean state actor Jumpy Pisces collaborating with the Play ransomware syndicate, marking a rare convergence between state espionage and commercial RaaS operations.Wed, 28 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-27-windows-themes-zero-day-ntlm-leak/https://blog.cybercult.biz/posts/2026-10-27-windows-themes-zero-day-ntlm-leak/A zero-day vulnerability in Windows Themes bypasses previous Microsoft fixes (CVE-2024-38030) to force outbound SMB authentication and leak user NetNTLMv2 hashes upon file preview in Windows Explorer.Tue, 27 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-27-operation-magnus-dismantles-redline-meta-infostealers/https://blog.cybercult.biz/posts/2026-10-27-operation-magnus-dismantles-redline-meta-infostealers/An international law enforcement coalition led by the Dutch Police and FBI dismantled the global infrastructure of the RedLine and Meta infostealers under Operation Magnus, seizing command servers, source code, and customer databases while unsealing US charges against a key developer.Tue, 27 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-26-french-isp-free-breach-exposes-ibans/https://blog.cybercult.biz/posts/2026-10-26-french-isp-free-breach-exposes-ibans/French telecommunications provider Free confirmed a major cyberattack compromising an internal management tool, exposing personal records for 19.2 million customers and 5.11 million IBAN numbers to threat actor drussellx on BreachForums.Mon, 26 Oct 2026 17:00:00 GMTData Breachhttps://blog.cybercult.biz/posts/2026-10-26-blackx-uefi-bootkit-exploits-baton-drop/https://blog.cybercult.biz/posts/2026-10-26-blackx-uefi-bootkit-exploits-baton-drop/A newly analyzed UEFI bootkit named BlackX, linked to Chinese threat actor APT41, exploits the Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot on fully patched Windows endpoints, neutralizing security telemetry and deploying persistent espionage implants.Mon, 26 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-25-cyberpanel-pre-auth-rce-psaux-ransomware/https://blog.cybercult.biz/posts/2026-10-25-cyberpanel-pre-auth-rce-psaux-ransomware/A critical unauthenticated remote code execution vulnerability chain in CyberPanel (CVE-2024-51567) is being mass-exploited in the wild, enabling threat actors to gain root privileges and encrypt over 22,000 servers with PSAUX ransomware.Sun, 25 Oct 2026 17:00:00 GMTRansomwarehttps://blog.cybercult.biz/posts/2026-10-25-windows-driver-signature-bypass-kernel-rootkits/https://blog.cybercult.biz/posts/2026-10-25-windows-driver-signature-bypass-kernel-rootkits/Security researchers demonstrated a Windows Driver Signature Enforcement bypass that abuses the Windows Update architecture to downgrade Code Integrity components, resurrecting patched vulnerabilities to load unsigned drivers and persistent kernel rootkits.Sun, 25 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-24-black-basta-microsoft-teams-ransomware-intrusions/https://blog.cybercult.biz/posts/2026-10-24-black-basta-microsoft-teams-ransomware-intrusions/Black Basta ransomware affiliates are breaching corporate networks by combining automated email bombing with deceptive Microsoft Teams messages posing as IT support, coercing employees into launching remote access tools like Windows Quick Assist to deploy malware.Sat, 24 Oct 2026 17:00:00 GMTRansomwarehttps://blog.cybercult.biz/posts/2026-10-24-amazon-disrupts-apt29-rogue-rdp-campaign/https://blog.cybercult.biz/posts/2026-10-24-amazon-disrupts-apt29-rogue-rdp-campaign/Amazon seized domains used by Russian state-sponsored actor APT29 in a global spear-phishing campaign that weaponized digitally signed Remote Desktop Protocol configuration files and client device redirection to covertly exfiltrate credentials and sensitive files without executing malware on target hosts.Sat, 24 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-23-nodejs-patches-critical-brotli-rce-flaw/https://blog.cybercult.biz/posts/2026-10-23-nodejs-patches-critical-brotli-rce-flaw/The Node.js project has released emergency security updates addressing a critical remote code execution vulnerability dubbed Node2Shell (CVE-2026-111497) in its bundled Brotli decompression library, allowing unauthenticated attackers to execute arbitrary code via malformed payload streams.Fri, 23 Oct 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-23-cisco-patches-exploited-asa-vpn-dos-flaw/https://blog.cybercult.biz/posts/2026-10-23-cisco-patches-exploited-asa-vpn-dos-flaw/Cisco released security updates addressing CVE-2024-20481, an actively exploited resource exhaustion vulnerability in the Remote Access VPN service of ASA and Firepower Threat Defense software that enables unauthenticated remote attackers to trigger persistent denial-of-service conditions.Fri, 23 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-22-synology-patches-zero-click-risk-station-flaw/https://blog.cybercult.biz/posts/2026-10-22-synology-patches-zero-click-risk-station-flaw/Synology issued emergency patches addressing CVE-2024-10443, a maximum-severity zero-click command injection vulnerability dubbed RISK:STATION in Synology Photos and BeePhotos that allows unauthenticated remote attackers to execute arbitrary code as root on internet-exposed NAS appliances.Thu, 22 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-22-php-emergency-patches-php2shell-rce-flaws/https://blog.cybercult.biz/posts/2026-10-22-php-emergency-patches-php2shell-rce-flaws/The PHP development team has released emergency security updates addressing two critical vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote attackers to execute arbitrary code or exfiltrate worker memory across core PHP runtimes.Thu, 22 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-21-lazarus-exploited-chrome-zero-day-fake-game/https://blog.cybercult.biz/posts/2026-10-21-lazarus-exploited-chrome-zero-day-fake-game/North Korean state-sponsored threat group Lazarus exploited a Google Chrome zero-day vulnerability, CVE-2024-4947, via a deceptive Web3 game website to execute arbitrary code and deploy Manuscrypt malware against cryptocurrency targets.Wed, 21 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-21-windows-winreg-ntlm-relay-flaw-cve-2024-43532/https://blog.cybercult.biz/posts/2026-10-21-windows-winreg-ntlm-relay-flaw-cve-2024-43532/A public proof-of-concept exploit has been released for CVE-2024-43532, an elevation of privilege flaw in Windows Remote Registry that insecurely falls back to unverified RPC transports, allowing attackers to relay NTLM credentials to Active Directory Certificate Services for domain takeover.Wed, 21 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-20-bumblebee-loader-resurfaces-attacks-operation-endgame/https://blog.cybercult.biz/posts/2026-10-20-bumblebee-loader-resurfaces-attacks-operation-endgame/Bumblebee malware has resurfaced in new spear-phishing campaigns four months after international law enforcement disrupted its infrastructure in Operation Endgame, adopting stealthy MSI installers to execute payloads directly in memory.Tue, 20 Oct 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-20-roundcube-webmail-stored-xss-flaw-exploited/https://blog.cybercult.biz/posts/2026-10-20-roundcube-webmail-stored-xss-flaw-exploited/Threat actors are actively exploiting CVE-2024-37383, a stored cross-site scripting vulnerability in Roundcube Webmail, to execute malicious JavaScript via crafted SVG elements, harvest user credentials, and exfiltrate emails from government targets.Tue, 20 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-19-sharepoint-rce-flaw-exploited-corporate-breaches/https://blog.cybercult.biz/posts/2026-10-19-sharepoint-rce-flaw-exploited-corporate-breaches/Threat actors are actively exploiting CVE-2024-38094, a high-severity deserialization flaw in on-premises Microsoft SharePoint Server, to breach corporate networks, deploy web shells, hijack Exchange service accounts, and neutralize endpoint defenses.Mon, 19 Oct 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-19-intel-amd-cpus-post-barrier-spectre-bypass/https://blog.cybercult.biz/posts/2026-10-19-intel-amd-cpus-post-barrier-spectre-bypass/Researchers from ETH Zurich disclosed Post-Barrier Spectre attacks bypassing Indirect Branch Predictor Barrier defenses on modern Intel and AMD processors under Linux, enabling local unprivileged actors to leak root hashes and kernel memory.Mon, 19 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-18-hackers-compromise-eset-partner-distribute-wiper/https://blog.cybercult.biz/posts/2026-10-18-hackers-compromise-eset-partner-distribute-wiper/Threat actors compromised Comsecure, ESET's exclusive distributor in Israel, abusing authenticated mail servers to distribute a destructive data wiper disguised as a security tool named ESET Unleashed.Sun, 18 Oct 2026 17:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-10-18-macos-safari-tcc-bypass-hm-surf/https://blog.cybercult.biz/posts/2026-10-18-macos-safari-tcc-bypass-hm-surf/Microsoft disclosed a critical macOS Transparency, Consent, and Control bypass dubbed HM Surf (CVE-2024-44133), which abuses Safari private entitlements and directory path manipulation to silently access cameras, microphones, and location data, with observed exploitation by Adload malware.Sun, 18 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-17-iranian-actors-broker-critical-infrastructure-access/https://blog.cybercult.biz/posts/2026-10-17-iranian-actors-broker-critical-infrastructure-access/A joint advisory from CISA, the FBI, and international allies warned that Iranian state-sponsored cyber actors are weaponizing password spraying and MFA push bombing to breach critical infrastructure, monetizing stolen credentials and network access on underground cybercriminal forums.Sat, 17 Oct 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-17-discover-tech-targeted-ads-candiru-zero-click/https://blog.cybercult.biz/posts/2026-10-17-discover-tech-targeted-ads-candiru-zero-click/Citizen Lab revealed that Israeli ad-tech vendor Discover-Tech abused programmatic real-time bidding auctions via its Controlium platform to deploy Candiru zero-click mercenary spyware against media organizations, triggering device compromises upon ad rendering without user interaction.Sat, 17 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-16-beyondtrust-patches-remote-support-zero-day/https://blog.cybercult.biz/posts/2026-10-16-beyondtrust-patches-remote-support-zero-day/BeyondTrust has patched a critical zero-day vulnerability (CVE-2026-102764) in Remote Support actively exploited since August by China-nexus group ARMORY CASTLE to deploy SAWFLY webshells, escalate to root, and tunnel traffic via BARECLAW.Fri, 16 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-16-collabora-rce-flaw-backdoors-nextcloud-servers/https://blog.cybercult.biz/posts/2026-10-16-collabora-rce-flaw-backdoors-nextcloud-servers/Threat actors are actively exploiting a critical command injection flaw (CVE-2026-110447) in the Collabora Online Built-in CODE Server app for Nextcloud, planting persistent PHP web shells to hijack servers and exfiltrate credentials whenever the document engine restarts.Fri, 16 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-15-doj-indicts-anonymous-sudan-seizes-ddos-infrastructure/https://blog.cybercult.biz/posts/2026-10-15-doj-indicts-anonymous-sudan-seizes-ddos-infrastructure/The US Department of Justice unsealed an indictment against two Sudanese nationals for operating Anonymous Sudan, while federal authorities and industry partners seized the Godzilla and InfraShutdown attack clusters responsible for over 35,000 distributed denial-of-service attacks.Thu, 15 Oct 2026 17:00:00 GMTInfrastructurehttps://blog.cybercult.biz/posts/2026-10-15-scarcruft-exploits-windows-zero-day-toast-ads/https://blog.cybercult.biz/posts/2026-10-15-scarcruft-exploits-windows-zero-day-toast-ads/North Korean threat group ScarCruft weaponized a zero-day type confusion flaw in the Internet Explorer scripting engine (CVE-2024-38178) via compromised advertising networks to deploy RokRAT malware through zero-click desktop toast notifications.Thu, 15 Oct 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-14-supply-chain-attackers-abuse-package-entry-points/https://blog.cybercult.biz/posts/2026-10-14-supply-chain-attackers-abuse-package-entry-points/Security researchers demonstrated how threat actors weaponize entry point configurations across PyPI, npm, and open-source registries to execute command-jacking and stealth command-wrapping attacks that hijack developer tooling and bypass install-time security controls.Wed, 14 Oct 2026 17:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-10-14-automattic-patches-critical-jetpack-form-flaw/https://blog.cybercult.biz/posts/2026-10-14-automattic-patches-critical-jetpack-form-flaw/Automattic issued security updates across 101 versions of the Jetpack WordPress plugin to address an authorization bypass flaw (CVE-2024-9926) in the Contact Form REST API that allowed low-privileged users to access private visitor form submissions.Wed, 14 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-13-splunk-enterprise-remote-code-execution-flaws/https://blog.cybercult.biz/posts/2026-10-13-splunk-enterprise-remote-code-execution-flaws/Splunk patched high-severity vulnerabilities in Splunk Enterprise for Windows, including an insecure session storage flaw (CVE-2024-45733) enabling remote code execution and an arbitrary file write defect (CVE-2024-45731) allowing system root compromise.Tue, 13 Oct 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-13-trickmo-trojan-steals-android-pins/https://blog.cybercult.biz/posts/2026-10-13-trickmo-trojan-steals-android-pins/Security researchers discovered 40 new variants of the TrickMo Android banking trojan that tamper with ZIP archive headers to evade static analysis and deploy deceptive full-screen overlays to capture device PINs and unlock patterns for automated on-device fraud.Tue, 13 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-12-cisco-investigates-devhub-data-theft-leak/https://blog.cybercult.biz/posts/2026-10-12-cisco-investigates-devhub-data-theft-leak/Cisco launched an investigation and took its DevHub portal offline after threat actor IntelBroker leaked stolen repositories, API tokens, and customer automation scripts obtained via misconfigured public access controls on the developer resource center.Mon, 12 Oct 2026 17:00:00 GMTData Breachhttps://blog.cybercult.biz/posts/2026-10-12-edrsilencer-abused-block-endpoint-telemetry-wfp/https://blog.cybercult.biz/posts/2026-10-12-edrsilencer-abused-block-endpoint-telemetry-wfp/Threat actors are actively deploying the open-source EDRSilencer tool to identify endpoint detection agents and weaponize the Windows Filtering Platform to drop outbound telemetry, blinding security operations centers without terminating processes or triggering anti-tamper alarms.Mon, 12 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-11-fastcash-linux-malware-targets-atm-payment-switches/https://blog.cybercult.biz/posts/2026-10-11-fastcash-linux-malware-targets-atm-payment-switches/Security researchers uncovered a new Linux variant of North Korea's FASTCash malware, dubbed libMyFc.so, engineered to inject into banking payment switch daemons and manipulate ISO 8583 transaction messages to authorize fraudulent ATM cash withdrawals.Sun, 11 Oct 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-11-shadowlogic-implants-codeless-backdoors-ai-graphs/https://blog.cybercult.biz/posts/2026-10-11-shadowlogic-implants-codeless-backdoors-ai-graphs/HiddenLayer researchers unveiled ShadowLogic, an attack manipulating neural network computational graphs to embed persistent, codeless backdoors that survive model fine-tuning and format conversion.Sun, 11 Oct 2026 05:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-10-10-cisa-warns-f5-big-ip-cookie-reconnaissance/https://blog.cybercult.biz/posts/2026-10-10-cisa-warns-f5-big-ip-cookie-reconnaissance/CISA warned that threat actors are exploiting unencrypted persistence cookies in F5 BIG-IP Local Traffic Manager to map internal network infrastructure, decoding backend pool member IP addresses and ports to stage targeted downstream attacks.Sat, 10 Oct 2026 17:00:00 GMTInfrastructurehttps://blog.cybercult.biz/posts/2026-10-10-cisa-flags-exploited-microsoft-configuration-manager-flaw/https://blog.cybercult.biz/posts/2026-10-10-cisa-flags-exploited-microsoft-configuration-manager-flaw/CISA warned that threat actors are actively exploiting CVE-2024-43468, a critical unauthenticated SQL injection flaw in Microsoft Configuration Manager that allows remote attackers to execute arbitrary commands with sysadmin privileges and compromise entire enterprise device fleets.Sat, 10 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-09-us-uk-warn-russian-apt29-server-exploitation/https://blog.cybercult.biz/posts/2026-10-09-us-uk-warn-russian-apt29-server-exploitation/US and UK intelligence agencies issued a joint advisory warning that Russian SVR actors tracked as APT29 are conducting mass-scale opportunistic scanning and exploitation of unpatched JetBrains TeamCity and Zimbra Collaboration servers to compromise global government and defense networks.Fri, 09 Oct 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-09-gitlab-critical-pipeline-execution-flaw/https://blog.cybercult.biz/posts/2026-10-09-gitlab-critical-pipeline-execution-flaw/GitLab released security updates addressing CVE-2024-9164, a critical flaw allowing unauthorized users to trigger CI/CD pipelines on arbitrary branches, bypassing repository branch protections to execute unauthorized code and expose sensitive deployment secrets.Fri, 09 Oct 2026 05:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-10-08-cisa-flags-exploited-fortinet-fortios-flaw/https://blog.cybercult.biz/posts/2026-10-08-cisa-flags-exploited-fortinet-fortios-flaw/CISA added CVE-2024-23113, a critical remote code execution flaw in the FortiOS FGFM daemon, to its Known Exploited Vulnerabilities catalog after observing active in-the-wild attacks targeting internet-facing Fortinet perimeter appliances.Thu, 08 Oct 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-08-internet-archive-breach-exposes-user-records/https://blog.cybercult.biz/posts/2026-10-08-internet-archive-breach-exposes-user-records/The Internet Archive suffered a massive breach exposing 31 million user records after threat actors leveraged an exposed GitLab authentication token to access internal repositories, harvest database credentials, and modify client-facing JavaScript assets.Thu, 08 Oct 2026 05:00:00 GMTData Breachhttps://blog.cybercult.biz/posts/2026-10-07-oilrig-exploits-windows-kernel-flaw-stealhook/https://blog.cybercult.biz/posts/2026-10-07-oilrig-exploits-windows-kernel-flaw-stealhook/Iranian state-sponsored actor OilRig exploited a Windows kernel race condition flaw tracked as CVE-2024-30088 to escalate privileges to SYSTEM, deploying the STEALHOOK backdoor and malicious LSA password filters to exfiltrate credentials via Microsoft Exchange servers.Wed, 07 Oct 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-07-microsoft-patches-actively-exploited-mmc-mshtml-zero-days/https://blog.cybercult.biz/posts/2026-10-07-microsoft-patches-actively-exploited-mmc-mshtml-zero-days/Microsoft released security updates addressing 118 vulnerabilities, headlined by two actively exploited zero-days in the Microsoft Management Console and legacy MSHTML platform tracked as CVE-2024-43572 and CVE-2024-43573.Wed, 07 Oct 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-06-casio-ransomware-attack-disrupts-systems/https://blog.cybercult.biz/posts/2026-10-06-casio-ransomware-attack-disrupts-systems/Casio disclosed a network breach and IT systems shutdown after the Underground ransomware group penetrated corporate networks via phishing, exfiltrating over 200 GB of confidential data.Tue, 06 Oct 2026 17:00:00 GMTRansomwarehttps://blog.cybercult.biz/posts/2026-10-06-american-water-cyberattack-forces-system-shutdown/https://blog.cybercult.biz/posts/2026-10-06-american-water-cyberattack-forces-system-shutdown/American Water disconnected customer portals and billing networks following an unauthorized cyberattack on corporate IT systems, initiating emergency isolation protocols to protect operational technology.Tue, 06 Oct 2026 05:00:00 GMTInfrastructurehttps://blog.cybercult.biz/posts/2026-10-05-samsung-exynos-processor-zero-day-flaw/https://blog.cybercult.biz/posts/2026-10-05-samsung-exynos-processor-zero-day-flaw/Samsung released security updates addressing CVE-2024-44068, a critical use-after-free zero-day flaw in Exynos processor media drivers exploited in targeted attacks to achieve privileged code execution and process hijacking on mobile devices.Mon, 05 Oct 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-10-05-solarwinds-web-help-desk-hardcoded-credential-flaw/https://blog.cybercult.biz/posts/2026-10-05-solarwinds-web-help-desk-hardcoded-credential-flaw/CISA warned that threat actors are actively exploiting CVE-2024-28987, a critical hardcoded credential vulnerability in SolarWinds Web Help Desk that enables unauthenticated remote attackers to access internal endpoints, read sensitive service desk tickets, and steal credentials.Mon, 05 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-04-palo-alto-expedition-flaws-firewall-hijacking/https://blog.cybercult.biz/posts/2026-10-04-palo-alto-expedition-flaws-firewall-hijacking/Palo Alto Networks urged customers to patch critical vulnerabilities in its Expedition migration tool, including unauthenticated command injection CVE-2024-9463, which public exploits chain to exfiltrate database secrets and hijack managed PAN-OS firewalls.Sun, 04 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-03-critical-ivanti-epm-sqli-flaw-exploited/https://blog.cybercult.biz/posts/2026-10-03-critical-ivanti-epm-sqli-flaw-exploited/CISA and Ivanti warned of active in-the-wild exploitation targeting CVE-2024-29824, a critical SQL injection flaw in Endpoint Manager Core servers allowing unauthenticated network attackers to achieve remote code execution via xp_cmdshell.Sat, 03 Oct 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-03-stealthy-perfctl-linux-malware-rootkits/https://blog.cybercult.biz/posts/2026-10-03-stealthy-perfctl-linux-malware-rootkits/Aqua Nautilus identified a widespread campaign deploying stealthy 'perfctl' malware across thousands of Linux servers, leveraging vulnerabilities like CVE-2023-33246 and CVE-2021-4034 to drop evasive userland rootkits that hijack system resources.Sat, 03 Oct 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-02-draytek-fixes-critical-draybreak-router-flaws/https://blog.cybercult.biz/posts/2026-10-02-draytek-fixes-critical-draybreak-router-flaws/DrayTek released urgent firmware updates addressing 14 security vulnerabilities dubbed DRAY:BREAK, including a CVSS 10.0 buffer overflow and an OS command injection flaw that allow remote unauthenticated attackers to gain root access across 700,000 internet-exposed routers.Fri, 02 Oct 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-02-kubernetes-image-builder-root-flaw/https://blog.cybercult.biz/posts/2026-10-02-kubernetes-image-builder-root-flaw/A critical vulnerability in Kubernetes Image Builder allows remote unauthenticated attackers to gain root access to cluster nodes via persistent default credentials embedded in Proxmox virtual machine templates, tracked as CVE-2024-9486.Fri, 02 Oct 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-10-01-goldenjackal-apt-breaches-air-gapped-networks/https://blog.cybercult.biz/posts/2026-10-01-goldenjackal-apt-breaches-air-gapped-networks/ESET researchers disclosed that cyberespionage group GoldenJackal breached air-gapped government and diplomatic networks using custom, modular USB malware toolchains designed to bridge physical network isolation, exfiltrate sensitive files, and execute arbitrary commands.Thu, 01 Oct 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-10-01-mozilla-patches-exploited-firefox-zero-day/https://blog.cybercult.biz/posts/2026-10-01-mozilla-patches-exploited-firefox-zero-day/Mozilla shipped emergency updates for CVE-2024-9680, a critical use-after-free zero-day in Firefox Animation timelines actively exploited in drive-by attacks to achieve remote code execution in browser content processes.Thu, 01 Oct 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-30-cisco-catalyst-sd-wan-zero-day/https://blog.cybercult.biz/posts/2026-09-30-cisco-catalyst-sd-wan-zero-day/Cisco patched a critical CVSS 9.8 authentication bypass zero-day in Catalyst SD-WAN Manager (CVE-2026-76504) actively exploited via URI encoding to achieve unauthenticated remote admin control.Wed, 30 Sep 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-30-fortinet-fortimanager-zero-day-cve-2024-47575/https://blog.cybercult.biz/posts/2026-09-30-fortinet-fortimanager-zero-day-cve-2024-47575/Fortinet warned of active zero-day exploitation of CVE-2024-47575, a critical flaw in the FortiManager fgfmd daemon allowing unauthenticated remote attackers to execute arbitrary commands and exfiltrate configurations across managed FortiGate firewalls.Wed, 30 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-29-salt-typhoon-infiltrates-us-telecom-wiretap-systems/https://blog.cybercult.biz/posts/2026-09-29-salt-typhoon-infiltrates-us-telecom-wiretap-systems/Chinese state-sponsored espionage group Salt Typhoon breached major U.S. telecommunications providers, compromising CALEA lawful intercept platforms to intercept communications and harvest call records of senior government officials.Tue, 29 Sep 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-29-qualcomm-dsp-driver-zero-day-exploited/https://blog.cybercult.biz/posts/2026-09-29-qualcomm-dsp-driver-zero-day-exploited/Qualcomm disclosed active, targeted exploitation of CVE-2024-43047, a high-severity use-after-free flaw in its Digital Signal Processor FastRPC driver that enables local privilege escalation and memory corruption across 64 chipset architectures used in billions of mobile devices.Tue, 29 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-28-gorilla-botnet-surge-ddos-attacks/https://blog.cybercult.biz/posts/2026-09-28-gorilla-botnet-surge-ddos-attacks/A sophisticated Mirai-derived malware campaign dubbed GorillaBot launched over 300,000 DDoS attack commands across 113 countries in three weeks, exploiting Apache Hadoop YARN RPC flaws and deploying multi-vector persistence mechanisms across enterprise and IoT systems.Mon, 28 Sep 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-28-kia-dealer-portal-flaws-remote-vehicle-takeover/https://blog.cybercult.biz/posts/2026-09-28-kia-dealer-portal-flaws-remote-vehicle-takeover/Critical authorization vulnerabilities in Kia's dealer web portal allowed remote attackers to track, unlock, and start millions of connected vehicles using only a license plate, exposing owner personal data and enabling silent account takeover without physical access.Mon, 28 Sep 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-27-zimbra-postjournal-rce-flaw-exploited/https://blog.cybercult.biz/posts/2026-09-27-zimbra-postjournal-rce-flaw-exploited/A critical command injection flaw in Zimbra Collaboration's postjournal service, tracked as CVE-2026-45519, is being actively exploited in the wild via crafted SMTP email headers to drop web shells and achieve unauthenticated remote code execution.Sun, 27 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-27-nvidia-container-toolkit-flaw-host-takeover/https://blog.cybercult.biz/posts/2026-09-27-nvidia-container-toolkit-flaw-host-takeover/A critical Time-of-Check Time-of-Use flaw (CVE-2026-0132) in the NVIDIA Container Toolkit allows attackers to escape container isolation via crafted images, granting root-level file access and arbitrary host command execution via runtime Unix sockets.Sun, 27 Sep 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-26-hpe-aruba-access-points-rce-flaws/https://blog.cybercult.biz/posts/2026-09-26-hpe-aruba-access-points-rce-flaws/HPE Aruba Networking released security patches for three critical vulnerabilities (CVE-2026-42505, CVE-2026-42506, and CVE-2026-42507) in the CLI service of its access points, allowing unauthenticated attackers to achieve remote code execution via crafted UDP port 8211 packets.Sat, 26 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-26-cups-rce-vulnerabilities-linux-systems/https://blog.cybercult.biz/posts/2026-09-26-cups-rce-vulnerabilities-linux-systems/A four-vulnerability exploit chain in OpenPrinting CUPS allows remote unauthenticated attackers to execute arbitrary commands under lp privileges by sending crafted UDP packets to exposed cups-browsed daemons on Linux systems.Sat, 26 Sep 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-25-storm-0501-hybrid-cloud-ransomware-attacks/https://blog.cybercult.biz/posts/2026-09-25-storm-0501-hybrid-cloud-ransomware-attacks/Microsoft disclosed a sophisticated campaign by ransomware operator Storm-0501 pivoting from on-premises Active Directory to Microsoft Entra ID, weaponizing AADInternals for backdoor federation and deploying Embargo ransomware alongside cloud data destruction.Fri, 25 Sep 2026 17:00:00 GMTRansomwarehttps://blog.cybercult.biz/posts/2026-09-25-progress-patches-critical-whatsup-gold-rce/https://blog.cybercult.biz/posts/2026-09-25-progress-patches-critical-whatsup-gold-rce/Progress Software released urgent updates for WhatsUp Gold resolving multiple critical flaws, including unauthenticated remote code execution bugs CVE-2026-8785 and CVE-2026-46909 in NmAPI.exe that allow system takeover.Fri, 25 Sep 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-24-rackspace-sciencelogic-sl1-zero-day/https://blog.cybercult.biz/posts/2026-09-24-rackspace-sciencelogic-sl1-zero-day/Cloud hosting provider Rackspace confirmed threat actors exploited a zero-day remote code execution vulnerability (CVE-2026-9537) in a bundled third-party utility within the ScienceLogic SL1 monitoring platform to breach internal servers and steal customer infrastructure data.Thu, 24 Sep 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-24-moneygram-cyberattack-causes-global-outage/https://blog.cybercult.biz/posts/2026-09-24-moneygram-cyberattack-causes-global-outage/Money transfer giant MoneyGram has confirmed that a cyberattack caused a multi-day worldwide service outage, forcing the firm to take core transaction processing networks offline and initiate incident response across its global transfer ecosystem.Thu, 24 Sep 2026 05:00:00 GMTData Breachhttps://blog.cybercult.biz/posts/2026-09-23-infostealers-bypass-chrome-app-bound-encryption/https://blog.cybercult.biz/posts/2026-09-23-infostealers-bypass-chrome-app-bound-encryption/Multiple infostealer malware syndicates including Lumma and StealC have developed working bypasses against Google Chrome's App-Bound Encryption feature, subverting Windows SYSTEM service protections to extract decrypted session cookies and credential databases under standard user privileges.Wed, 23 Sep 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-23-necro-trojan-android-sdk-supply-chain/https://blog.cybercult.biz/posts/2026-09-23-necro-trojan-android-sdk-supply-chain/A new variant of the Necro Trojan infected over 11 million Android devices via compromised advertising SDKs in Google Play applications, using steganographic payload delivery and dynamic DEX class loading to execute background ad fraud, proxy tunneling, and unauthorized subscriptions.Wed, 23 Sep 2026 05:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-09-22-cisa-orders-patch-zyxel-switch-flaw/https://blog.cybercult.biz/posts/2026-09-22-cisa-orders-patch-zyxel-switch-flaw/CISA has ordered federal agencies to urgently patch an actively exploited stack-based buffer overflow flaw (CVE-2026-7273) in Zyxel GS1900 series switches, which unauthenticated threat actors are weaponizing to execute arbitrary OS commands and exfiltrate credentials from enterprise networks.Tue, 22 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-22-broadcom-patches-critical-vmware-vcenter-rce/https://blog.cybercult.biz/posts/2026-09-22-broadcom-patches-critical-vmware-vcenter-rce/Broadcom has issued security updates addressing a maximum-severity heap overflow vulnerability (CVE-2026-38812) in VMware vCenter Server's DCE/RPC protocol implementation, enabling unauthenticated remote adversaries to achieve arbitrary code execution on core enterprise virtualization infrastructure.Tue, 22 Sep 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-21-akira-fog-ransomware-exploit-veeam-rce/https://blog.cybercult.biz/posts/2026-09-21-akira-fog-ransomware-exploit-veeam-rce/Ransomware operators deploying Akira and Fog are actively exploiting a critical deserialization vulnerability (CVE-2026-40711) in Veeam Backup & Replication to achieve remote code execution and disable enterprise disaster recovery systems.Mon, 21 Sep 2026 17:00:00 GMTRansomwarehttps://blog.cybercult.biz/posts/2026-09-21-ivanti-csa-zero-day-cve-2026-8963/https://blog.cybercult.biz/posts/2026-09-21-ivanti-csa-zero-day-cve-2026-8963/Ivanti warned that threat actors are actively exploiting a critical path traversal zero-day (CVE-2026-8963) in Cloud Services Appliance 4.6, chaining it with command injection to achieve remote code execution and full administrative takeover.Mon, 21 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-20-brevo-supply-chain-attack-injected-clickfix/https://blog.cybercult.biz/posts/2026-09-20-brevo-supply-chain-attack-injected-clickfix/Threat actors abused a hardcoded Cloudflare API key to deploy a rogue Cloudflare Worker across Brevo infrastructure, stripping CSP headers and injecting ClickFix infostealer scripts into customer forms and SDK widgets.Sun, 20 Sep 2026 17:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-09-20-mikrotik-routeros-mikrotrick-exploit-chain/https://blog.cybercult.biz/posts/2026-09-20-mikrotik-routeros-mikrotrick-exploit-chain/MikroTik released emergency updates for RouterOS addressing the 'MikroTrick' exploit chain (CVE-2026-67276 and CVE-2026-86060), where remote unauthenticated threat actors bypass SSH authentication and elevate privileges to hijack exposed network routers.Sun, 20 Sep 2026 05:00:00 GMTInfrastructurehttps://blog.cybercult.biz/posts/2026-09-19-waterplum-apt-compromises-developer-devices/https://blog.cybercult.biz/posts/2026-09-19-waterplum-apt-compromises-developer-devices/A joint multinational advisory from the FBI, Japan NPA, Germany BfV, and Australia ACSC revealed North Korean state actor WaterPlum compromised over 30,000 developer devices across 100 countries using weaponized coding tests and BeaverTail malware to harvest $10.7M in cryptocurrency.Sat, 19 Sep 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-19-citrix-netscaler-auth-bypass-flaw/https://blog.cybercult.biz/posts/2026-09-19-citrix-netscaler-auth-bypass-flaw/Citrix warned of an actively exploited authentication bypass flaw (CVE-2026-19490, CVSS 9.3) in NetScaler ADC and Gateway appliances, where unauthenticated remote attackers abuse SAML endpoints to forge sessions and bypass enterprise perimeter access controls.Sat, 19 Sep 2026 05:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-18-cisa-flags-exploited-linux-kernel-ebtables-flaw/https://blog.cybercult.biz/posts/2026-09-18-cisa-flags-exploited-linux-kernel-ebtables-flaw/CISA has added a high-severity Linux kernel flaw (CVE-2026-53266) to its Known Exploited Vulnerabilities catalog following active in-the-wild exploitation, where an ebtables SNAT out-of-bounds write corrupts file-backed page-cache memory to grant unprivileged local attackers root access.Fri, 18 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-18-cisco-ise-max-severity-zero-day-bypass/https://blog.cybercult.biz/posts/2026-09-18-cisco-ise-max-severity-zero-day-bypass/Cisco issued emergency updates for a maximum-severity authentication bypass zero-day flaw (CVE-2026-76460, CVSS 10.0) in Identity Services Engine that allows unauthenticated remote attackers to obtain root privileges via crafted API requests, which is actively exploited in attacks.Fri, 18 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-17-google-patches-exploited-pixel-modem-zero-day/https://blog.cybercult.biz/posts/2026-09-17-google-patches-exploited-pixel-modem-zero-day/Google addressed a high-severity zero-day vulnerability (CVE-2026-58704) in the cellular modem of Pixel devices that allows unauthenticated proximal attackers to escalate privileges without user interaction, which is actively exploited in targeted attacks.Thu, 17 Sep 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-17-connectwise-screenconnect-remote-code-execution/https://blog.cybercult.biz/posts/2026-09-17-connectwise-screenconnect-remote-code-execution/ConnectWise addressed a critical vulnerability (CVE-2026-84869) in ScreenConnect that allows unauthorized attackers to transfer and execute arbitrary files during active remote sessions, which is now actively exploited in worm-like attacks.Thu, 17 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-16-cisco-patches-exploited-secure-email-gateway-zero-day/https://blog.cybercult.biz/posts/2026-09-16-cisco-patches-exploited-secure-email-gateway-zero-day/Cisco issued emergency updates for an actively exploited zero-day vulnerability, CVE-2026-76461, in AsyncOS for Cisco Secure Email Gateway that allows unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted email parsing.Wed, 16 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-15-red-heron-exploits-gitea-rce-flaw/https://blog.cybercult.biz/posts/2026-09-15-red-heron-exploits-gitea-rce-flaw/Suspected China-aligned threat actor Red Heron exploited a critical Gitea remote code execution vulnerability (CVE-2026-60004) to compromise 13 organizations across six countries, deploying the JITTERLY implant and SIXZUT LD_PRELOAD rootkit for long-term persistence.Tue, 15 Sep 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-14-attackers-abuse-passkey-lures-hijack-microsoft-cloud/https://blog.cybercult.biz/posts/2026-09-14-attackers-abuse-passkey-lures-hijack-microsoft-cloud/Threat actors Storm-3032 and Storm-3121 are deploying targeted voice and SMS phishing lures themed around passkey enrollment to guide enterprise targets through AitM and OAuth device-code flows, registering rogue MFA methods in Entra ID to harvest data via Microsoft Graph APIs.Mon, 14 Sep 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-13-unc3569-exploits-sogou-input-grayrabbit/https://blog.cybercult.biz/posts/2026-09-13-unc3569-exploits-sogou-input-grayrabbit/China-linked threat group UNC3569 weaponized a custom URI scheme flaw in Sogou Input Method to deploy the GRAYRABBIT backdoor. The attack abused an unvalidated protocol handler and an un-sandboxed legacy Chromium engine to execute arbitrary code.Sun, 13 Sep 2026 17:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-13-threat-clusters-abused-claude-for-exploitation/https://blog.cybercult.biz/posts/2026-09-13-threat-clusters-abused-claude-for-exploitation/Anthropic revealed that extortion collective ShinyHunters, Russian APT Midnight Blizzard, and Chinese group GTG-10007 weaponized Claude agents to mass-harvest secrets from 1.8M Android apps, automate malware obfuscation loops, and orchestrate rapid cloud intrusions.Sun, 13 Sep 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-12-check-point-vpn-remote-code-execution-flaws/https://blog.cybercult.biz/posts/2026-09-12-check-point-vpn-remote-code-execution-flaws/The Dutch NCSC has issued an urgent advisory warning of imminent exploitation targeting two CVSS 9.8 vulnerabilities in Check Point VPN gateways and management servers, enabling unauthenticated remote code execution via malformed certificates.Sat, 12 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-12-jfrog-artifactory-flaws-chained-backdoor-malware/https://blog.cybercult.biz/posts/2026-09-12-jfrog-artifactory-flaws-chained-backdoor-malware/Threat actors are actively chaining JFrog Artifactory vulnerabilities CVE-2026-42018 and CVE-2026-42016 alongside CVE-2026-82329 to bypass authentication, forge administrative tokens, and deploy custom Rust backdoors on self-hosted instances.Sat, 12 Sep 2026 05:00:00 GMTSupply Chainhttps://blog.cybercult.biz/posts/2026-09-11-gitlab-critical-path-traversal-flaw/https://blog.cybercult.biz/posts/2026-09-11-gitlab-critical-path-traversal-flaw/GitLab issued emergency updates for a maximum-severity path traversal vulnerability, tracked as CVE-2026-85706, that allows unauthenticated remote attackers to read arbitrary files and sensitive secrets from exposed self-managed instances.Fri, 11 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-11-cisco-fmc-flaws-exploited-attacks/https://blog.cybercult.biz/posts/2026-09-11-cisco-fmc-flaws-exploited-attacks/Cisco and CISA confirmed active in-the-wild exploitation of Cisco Secure FMC vulnerabilities CVE-2026-20079 and CVE-2026-20316, enabling root command execution and lateral network compromise by threat actors deploying Qilin ransomware.Fri, 11 Sep 2026 05:00:00 GMTInfrastructurehttps://blog.cybercult.biz/posts/2026-09-10-researcher-drops-shieldcrash-poc-bypassing-microsoft-defender-patch/https://blog.cybercult.biz/posts/2026-09-10-researcher-drops-shieldcrash-poc-bypassing-microsoft-defender-patch/Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept zero-day exploit demonstrating an arbitrary file read as SYSTEM that bypasses Microsoft's recent patch for Defender flaw CVE-2026-69414.Thu, 10 Sep 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-10-f5-big-ip-poisonedrefresh-linux-rootkit/https://blog.cybercult.biz/posts/2026-09-10-f5-big-ip-poisonedrefresh-linux-rootkit/Security researchers uncovered a sophisticated in-memory Linux rootkit dubbed PoisonedRefresh deployed against F5 BIG-IP APM appliances, abusing Apache hooks and memory-resident web shells to evade detection and survive firmware updates.Thu, 10 Sep 2026 05:00:00 GMTThreat Intelligencehttps://blog.cybercult.biz/posts/2026-09-09-cpanel-emailtrack-privilege-escalation/https://blog.cybercult.biz/posts/2026-09-09-cpanel-emailtrack-privilege-escalation/cPanel has patched a high-severity SQL injection vulnerability tracked as CVE-2026-67401 in its EmailTrack module, enabling authenticated shared hosting tenants with basic mail privileges to write arbitrary files and execute code as root.Wed, 09 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-09-microsoft-patches-exploited-windows-zero-days/https://blog.cybercult.biz/posts/2026-09-09-microsoft-patches-exploited-windows-zero-days/Microsoft released its September 2026 security updates addressing 974 flaws, headlined by two actively exploited zero-day privilege escalation vulnerabilities in the Windows ALPC mechanism and Windows Update Stack tracked as CVE-2026-85880 and CVE-2026-81963.Wed, 09 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-08-sap-patches-critical-overpass-kernel-flaw/https://blog.cybercult.biz/posts/2026-09-08-sap-patches-critical-overpass-kernel-flaw/SAP released emergency security updates addressing a maximum-severity memory corruption flaw dubbed OVERPASS in the SAP Kernel. Tracked as CVE-2026-44756 with a CVSS 10.0 score, the vulnerability allows unauthenticated remote attackers to execute arbitrary code across exposed enterprise systems.Tue, 08 Sep 2026 17:00:00 GMTVulnerabilityhttps://blog.cybercult.biz/posts/2026-09-08-n-able-patches-exploited-n-central-rce/https://blog.cybercult.biz/posts/2026-09-08-n-able-patches-exploited-n-central-rce/N-able issued an emergency hotfix for a maximum-severity unauthenticated remote code execution flaw in its N-central RMM platform, tracked as CVE-2026-86218, following conflicting disclosures of active in-the-wild exploitation.Tue, 08 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-07-sonicwall-sma-1000-zero-day-chain/https://blog.cybercult.biz/posts/2026-09-07-sonicwall-sma-1000-zero-day-chain/SonicWall issued emergency hotfixes for two actively exploited zero-day flaws in SMA 1000 VPN appliances that attackers chained together to achieve unauthenticated remote code execution.Mon, 07 Sep 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-07-magento-stylesmuggler-zero-day/https://blog.cybercult.biz/posts/2026-09-07-magento-stylesmuggler-zero-day/E-commerce security firm Sansec disclosed an unpatched zero-day vulnerability dubbed StyleSmuggler impacting Magento Open Source and Adobe Commerce deployments.Mon, 07 Sep 2026 05:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-04-google-patches-actively-exploited-c/https://blog.cybercult.biz/posts/2026-09-04-google-patches-actively-exploited-c/Google addressed an actively exploited zero-day flaw in Chrome's V8 JavaScript engine that allowed arbitrary code execution within the browser sandbox.Fri, 04 Sep 2026 17:00:00 GMTZero-Dayhttps://blog.cybercult.biz/posts/2026-09-04-coder-registry-compromise/https://blog.cybercult.biz/posts/2026-09-04-coder-registry-compromise/Threat actors compromised Coder's Cloudflare account to inject rogue endpoints serving credential-harvesting Terraform modules to engineers.Fri, 04 Sep 2026 05:00:00 GMTSupply Chain