3+ day, 44+ min ago   (325+ words) A likely Russian-speaking threat actor used hundreds of AI agents to automate exploitation of PaperCut NG/MF vulnerabilities, compromising at least 440 servers linked to 395 organizations across 48 countries. GreyNoise said the actor moved from an empty operational workspace to remote code…...

2+ week, 5+ day ago   (419+ words) A critical security vulnerability in the Pods WordPress plugin could allow unauthenticated attackers to seize administrator-level control of affected websites. The flaw, tracked as CVE-2026-19598, impacts all Pods versions through 3.3.9 and has received a CVSS score of 9.8, making it critical....

3+ week, 4+ day ago   (415+ words) Checkpoint first observed the campaign in mid-May 2026 and found that it blends ransomware activity with targeted data theft, enabling operators to decide whether to encrypt victims’ files, silently collect documents, or do both. The campaign begins with a ClickFix social-engineering…...

1+ mon, 1+ day ago   (448+ words) Sandworm-linked threat actors are using fake job interviews to trick IT professionals into installing a trojanized WireGuard VPN client. Ukraine’s CERT-UA attributes the activity to UAC-0145, a subcluster of UAC-0002, also known as Sandworm, APT44, and Seashell Blizzard. The campaign has…...

1+ mon, 3+ day ago   (395+ words) A maximum-severity, unauthenticated SQL injection zero-day in the popular open-source analytics platform Metabase has been actively exploited in the wild, letting attackers seize administrator privileges and steal credentials for every database connected to compromised instances. Metabase disclosed that its Cloud…...

1+ mon, 3+ day ago   (345+ words) Researchers have uncovered operational artifacts linked to a suspected Kimsuky campaign that expose how the threat actor tested malware, handled infected-host data, and used public code repositories as command-and-control infrastructure. The findings are part of an ongoing activity cluster tracked…...

1+ mon, 1+ week ago   (478+ words) CareCloud, Inc., a New Jersey-based healthcare technology provider, has confirmed a data security incident affecting at least 345,000 to 350,000 individuals after unauthorized actors accessed one of its AWS-hosted electronic health record environments. The breach, disclosed in an updated notice dated July…...

1+ mon, 1+ week ago   (347+ words) Researchers from Unit 42 uncovered the activity after the attacker’s AI agent mistakenly launched a public file server from its working directory, revealing sensitive assets including exploit scripts, API keys, configuration files, and attack logs. The exposure provides one of the…...

1+ mon, 2+ week ago   (425+ words) A critical supply chain attack targeting the WordPress ecosystem has exposed approximately 20,000 websites to full administrative compromise after a widely used plugin was found to contain a deliberately injected backdoor. Chloe Chamberland at Wordfence disclosed that the vulnerability, tracked as…...

1+ mon, 2+ week ago   (470+ words) Since Q1 2026, researchers at XLab have been tracking an aggressively evolving IoT botnet family dubbed “Dysphoria,” whose bot population is estimated at over 200,000 infected devices worldwide. In just a few months, Dysphoria has rolled through multiple variants and architectural changes, demonstrating…...