Hacking and Exploits

Web-Hacking, 0-Day, Malware, Ransomware, Exploit, Vulnerabilities, Privilege-Flaw, Privilege-Escalation, Zero-Day, Exploit, Jailbreak, Penetration-Testing, Trojan, Spyware, Rootkit, Worm, Backdoor, Payload, Obfuscation, DDoS, Phishing, MITM, Spoofing, Brute-force, Port-Scan, SQLi, XSS, CSRF, Path-Traversal, LFI, RFI, Insecure-Deserialization, Buffer-Overflow, CVE, Exploit-Kit, Shellcode, bug bounty, ethical hacking, CTF, capture the flag, offensive security, red team exercise, exploit development, reverse engineering, vulnerability research, credential harvesting, zero-click, hack

Page 5

Automation

Critical GitLab AI Gateway Flaw: What Administrators Need to Do Now

GitLab has pushed an urgent set of security updates after disclosing a critical vulnerability in its AI Gateway that could allow authenticated users to run arbitrary commands on the gateway. Tracked as CVE-2026-90970 and rated CVSS 9.9, the flaw affects self-hosted AI Gateway deployments that support GitLab Duo AI features. While GitLab’s hosted gateways have already been patched, organizations running their own gateways must act immediately to mitigate a high-impact…

Saugata DattaOct 3, 20264 min read245

Cybersecurity

Citrix NetScaler Reboots After Emergency 0-Day Patch: What Teams Need to Know

Citrix released emergency builds to address two actively exploited zero-day vulnerabilities in NetScaler appliances, but some organizations report that the patched appliances are repeatedly rebooting. What began as a rapid mitigation effort to stop remote command execution and DTLS-related attacks has morphed into an availability problem for some deployments—raising the difficult question defenders must balance: is this an operational outage or evidence of ongoing compromise? This post explains what’s known,…

Saugata DattaOct 3, 20264 min read244

Cybersecurity

Debian Patches 1,313 Kernel Flaws: What Administrators Need to Know

Debian has just released a major kernel security update that aggregates fixes for 1,313 CVE entries, a headline figure that has drawn attention across the Linux community. The update — published as DSA-6528-1 and delivered for the Trixie stable release as Linux source package 6.12.111-1 — addresses a range of vulnerabilities that could, in different contexts, lead to privilege escalation, denial of service, or information leaks. While the scale of…

Saugata DattaOct 3, 20264 min read204

Cybersecurity

Antino: A Stealthy Backdoor That Hides in Outlook and OneDrive

A new espionage campaign tracked by Cisco Talos has exposed a sophisticated Windows backdoor, nicknamed Antino, that uses Microsoft 365 services as its covert communications channel. Targeting government and policy organizations across Asia — including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar — the activity centers on highly tailored spear‑phishing lures and a multi-stage infection chain that culminates in a Rust-compiled implant communicating through Outlook and OneDrive. The…

Saugata DattaOct 3, 20265 min read238

Cybersecurity

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Microsoft’s SharePoint platform is facing active exploitation following the public release of a proof-of-concept (PoC) for a critical authentication bypass vulnerability tracked as CVE-2026-55040. Patched in July’s Patch Tuesday, the flaw allows unauthenticated actors to impersonate SharePoint users by forging JSON Web Tokens (JWTs). Since the PoC surfaced, security researchers and telemetry providers have observed real-world attempts that underscore the urgency for administrators to apply updates and audit their environments.…

Saugata DattaAug 13, 20263 min read264

Cybersecurity

Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor

Akira’s latest tactics expand the ransomware playbook: instead of relying solely on kernel drivers or signed binaries to disable protections, an affiliate in a recent intrusion rebooted a compromised host into Safe Mode with Networking to silence endpoint defenses while keeping network access for remote control and exfiltration. The operation began with a successful credential-spraying attack against an exposed SonicWall SSL VPN that lacked MFA, and it unfolded rapidly—domain enumeration,…

Saugata DattaAug 13, 20264 min read271

Cybersecurity

WordPress Imagick RCE (CVE-2026-65640): What Site Owners Need to Know

WordPress has just released a security-focused update — version 7.0.4 — to close a remote code execution flaw that can be triggered when images are processed with the Imagick extension and Ghostscript. The vulnerability, tracked as CVE-2026-65640 and described in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai. While exploitation requires an authenticated Author-level account or higher, the bug’s mechanics mean multi-author sites, membership platforms, and installations with broad contributor…

Saugata DattaAug 13, 20264 min read215

Cybersecurity

Cisco Issues Emergency Fix for Firewall Zero-Day Under Active Attack

Cisco has issued an urgent warning to organizations worldwide following the discovery of a zero-day vulnerability in its core firewall software. Tracked as CVE-2026-20349, the flaw is currently being exploited in the wild, allowing unauthenticated attackers to trigger a denial-of-service (DoS) condition. Because this vulnerability affects the perimeter of the network—the very place designed to keep threats out—security teams are being urged to prioritize patching immediately. The Nature of the…

Saugata DattaAug 13, 20263 min read263

Cybersecurity

Critical Adobe Commerce Flaws Put Online Stores at Risk — Patch Now

Adobe has rolled out an urgent August 2026 security update for Adobe Commerce and Magento Open Source to fix a cluster of authorization and stored cross-site scripting (XSS) flaws that, together, present a significant threat to e-commerce environments. The most severe issue, CVE-2026-71362, is an incorrect-authorization vulnerability rated 9.1 (CVSS) that could allow an unauthenticated attacker to escalate privileges and execute arbitrary code. While Adobe reports no known active exploitation…

Saugata DattaAug 13, 20264 min read260

Cybersecurity

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

A newly disclosed critical flaw in VMware vCenter (CVE-2026-59310) has moved quickly from patch release to active exploitation, according to investigative reporting and telemetry from security firms. The vulnerability—a directory traversal bug that allows an actor with network access to execute arbitrary code—was patched by Broadcom late last month, and forensic evidence collected by QUIRSO indicates attackers were able to chain that weakness into persistent remote access on production appliances…

Saugata DattaAug 12, 20264 min read271

Cloud Computing

Ransomware Strikes Colombian Justice Ministry Ahead of Presidential Transition

Colombia's Ministry of Justice was hit by a ransomware attack on August 2, affecting parts of its IT infrastructure and degrading several public-facing services just days before a national presidential handover. The disruption touched systems used for illicit-drug monitoring and legal processes; while some files were encrypted, the acting minister at the time, Cielo Rusinque, said publicly that there was no evidence of data exfiltration. The incident arrived amid heightened…

Saugata DattaAug 12, 20264 min read204

Cybersecurity

CISA Flags Actively Exploited Adobe ColdFusion Path Traversal (CVE-2026-48282)

Adobe ColdFusion administrators woke up to an urgent warning this week: a critical path traversal vulnerability (CVE-2026-48282) is being actively exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 7, 2026, and issued a binding remediation timeline for federal agencies under BOD 26-04 that requires action by July 10, 2026. Because ColdFusion is frequently internet-facing…

Saugata DattaJul 8, 20264 min read272

Free Tools: IP, DNS, SSL