bleepingcomputer.com resources

bleepingcomputer.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-28.

RCE 35 Supply Chain 14 SSRF 4 SQLi 3 XSS 3 AI 2 API Sec 1 Python 1 Secrets 1

Date Added	Resource	Excerpt
2026-08-28 2026	Over 8300 Gitea servers vulnerable to code execution attacks RCE	Writeup of CVE-2026-60004, a critical code injection vulnerability affecting over 8,300 Gitea servers. Exploitation, requiring only repository write access which can be obtained via Gitea's default open registration, allows authenticated attackers to execute arbitrary shell commands. Salesforce researcher Shai Rod reported the flaw, and Gitea has released version 1.27.1 to address it. The vulnerability has been added to CISA's actively exploited flaws catalog, and U.S. agencies are mandated to patch.
2026-08-28 2026	ServiceNow warns of three max severity security vulnerabilities SQLi	Advisory on three maximum-severity ServiceNow AI Platform vulnerabilities, including CVE-2026-18885 (code injection), CVE-2026-18886 (privilege escalation via code injection), and CVE-2026-74820 (SQL injection). These critical flaws, along with a high-severity sandbox escape (CVE-2026-6876), can be exploited by unauthenticated attackers with low complexity. Previous attacks have chained ServiceNow vulnerabilities, such as CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, for data theft.
2026-08-27 2026	CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs SSRF	Writeup detailing the exploitation of SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 by ransomware gangs. These flaws, including a severe SSRF vulnerability, were actively exploited in zero-day attacks before patching and have been added to CISA's Known Exploited Vulnerabilities catalog. Threat actor UTA0533 deployed malware like KNUCKLEBALL and Sou5, with attacks linked to INC Ransomware affiliates and prior exploitation of CVE-2025-40602 for privilege escalation.
2026-08-27 2026	CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday RCE	Order mandating federal agencies patch Citrix NetScaler RCE flaw, CVE-2026-8452, by August 29. The memory overflow vulnerability, impacting NetScaler ADC and Gateway appliances with Gateway VPN or AAA virtual servers, is actively exploited by attackers for remote code execution as root. This directive follows watchTowr's August disclosure of exploitation capabilities beyond denial-of-service, contrasting with earlier Citrix statements. CISA's inclusion on its Known Exploited Vulnerabilities Catalog highlights the urgency of patching against current threat actor activities.
2026-08-27 2026	Australia arrests alleged TeamPCP hackers behind supply-chain attacks Supply Chain	Writeup on the TeamPCP supply-chain attacks, detailing their targeting of open-source software and developer platforms to steal credentials and source code. Investigations by Flare and Brian Krebs, alongside Australian Federal Police and FBI efforts, linked alleged TeamPCP members to their real-world identities, leading to arrests and charges for computer offenses and data modification. These attacks, impacting Trivy, LiteLLM, and SAP packages, potentially compromised over a thousand organizations globally.
2026-08-26 2026	Critical Avada WordPress theme flaw enables zero-click RCE RCE	Writeup of CVE-2026-18431, a critical vulnerability chain affecting the Avada WordPress theme and Fusion Builder plugin, enabling unauthenticated, zero-click arbitrary PHP code execution. The exploit chains six security issues, including authorization, input-validation, trust-boundary, and file-handling weaknesses, requiring a specific execution order. This flaw, impacting Avada versions up to 7.16 and Fusion Builder up to 3.16, could lead to full website compromise. Researchers at Wordfence discovered the vulnerability using their Argus framework.
2026-08-26 2026	Hackers target Microsoft SharePoint RCE chain with PoC exploit RCE	Library for detecting and defending against a chained attack on Microsoft SharePoint, combining CVE-2026-55040 (JWT authentication bypass) with CVE-2026-63520 (Business Connectivity Services RCE). This chain allows unauthenticated attackers to achieve arbitrary code execution on vulnerable servers, with publicly available proof-of-concept exploits weaponized by threat actors shortly after release. CISA has issued directives for federal agencies to secure their SharePoint instances against these and other actively exploited SharePoint vulnerabilities.
2026-08-26 2026	Hackers now exploit critical Gitea flaw in code injection attacks RCE	Vulnerability writeup detailing CVE-2026-60004, a critical code injection flaw in Gitea. This vulnerability, exploitable via the diffpatch API endpoint, allows authenticated users with repository write access, or even unauthenticated attackers on default-configured instances, to execute arbitrary shell commands. Gitea has released version 1.27.1 to patch this issue, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog, mandating remediation for federal agencies.
2026-08-26 2026	Hackers breached over 270 Zimbra servers in ongoing attacks RCE	Writeup on CVE-2026-73570, a high-severity command injection vulnerability affecting Zimbra Collaboration Suite (ZCS). This flaw allows unauthenticated remote code execution by exploiting the SNMP monitoring component when notifications are enabled. Over 270 Zimbra servers have already been compromised in ongoing attacks, with CERT Polska and CISA issuing warnings and mandates for patching. This vulnerability has been frequently exploited by various threat actors, including APT28 and APT29, to steal sensitive data.
2026-08-24 2026	CISA orders urgent patching of actively exploited Zimbra flaw RCE	Writeup of CVE-2026-73570, an actively exploited command injection vulnerability in Zimbra Collaboration Suite (ZCS). This flaw allows unauthenticated attackers to achieve remote code execution by exploiting improper input sanitization in the SNMP monitoring component when notifications are enabled. CISA has ordered urgent patching for U.S. government agencies, and CERT Polska has observed in-the-wild exploitation. The vulnerability affects ZCS version 10.1.20 and earlier, with successful exploitation potentially leading to the execution of arbitrary operating system commands.
2026-08-24 2026	Microsoft warns of max severity Entra ID flaw exploited in attacks RCE	Advisory regarding maximum-severity vulnerabilities in Microsoft Entra ID, Azure Arc, and Exchange Online, including CVE-2026-69836 (untrusted data deserialization for RCE), CVE-2026-65816 and CVE-2026-69555 (privilege escalation on Azure Arc), and CVE-2026-65801 (privilege escalation on Exchange Online). Also notes CVE-2026-65770 for RCE on Azure Managed Instance for Apache Cassandra, and a prior Entra ID privilege escalation flaw CVE-2025-55241.
2026-08-21 2026	Hackers poison arrayref Rust crate to push infostealer malware Supply Chain	Library compromise targeting the Rust `arrayref` crate, alongside `append-only-vec` and `internment`, introduced an infostealer malware via a poisoned `proc-macro1` dependency. Executed during compilation through a `build.rs` script, the malware exfiltrates browser credentials and establishes persistence on Linux, macOS, and Windows systems. This supply-chain attack, with infrastructure overlaps noted with DPRK campaigns, highlights the critical need for rigorous dependency vetting beyond simple prevention scores.
2026-08-20 2026	Critical Elementor Pro bug exposes WordPress sites to RCE attacks RCE	Writeup of CVE-2026-32475, a critical RCE vulnerability in Elementor Pro versions prior to 4.2.2. The flaw arises from the File Upload module's differing handling of empty filename uploads between validation and processing loops, allowing attackers to craft multipart uploads containing malicious PHP payloads. Exploitation requires a published Elementor form with a File Upload field and the multiple file upload option enabled. Attackers can determine the uploaded payload's filename via timing brute-force or autoresponder emails and trigger its execution by requesting its URL, granting arbitrary code execution. Patchstack, who identified the vulnerability, recommends updating Elementor Pro and thoroughly checking the `wp-content/uploads/elementor/forms/` directory for rogue files.
2026-08-20 2026	Critical Zimbra RCE flaw now actively exploited in attacks RCE	Writeup on CVE-2026-73570, a critical command injection vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw, patched in version 10.1.20, has been actively exploited in the wild. CERT Polska has observed malicious activity, including suspicious file creation and service restarts, and advises administrators to check logs for indicators of compromise. Past Zimbra vulnerabilities have been exploited by threat actors like Vivern, APT29, and APT28.
2026-08-19 2026	Critical RCE flaw in Windows IKE Extension now actively exploited RCE	Vulnerability CVE-2026-33824, a critical remote code execution flaw in Windows IKE Extension, is actively exploited by attackers. This "double free" issue allows unauthenticated adversaries to achieve code execution by sending crafted packets via UDP ports 500 or 4500 to unpatched Windows systems. CISA has added this vulnerability to its actively exploited catalog and mandated urgent patching for federal agencies, recommending traffic blocking or firewall rule configuration for those unable to update immediately.
2026-08-13 2026	Critical VMware vCenter RCE flaw exploited for reverse SSH access RCE	Writeup on CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter Syslog Server, actively exploited for arbitrary code execution. Attackers leverage this flaw to deploy the open-source `reverse_ssh` framework for persistence and remote access, establishing outbound command-and-control channels. QUIRSO has released a YARA rule to detect `reverse_ssh` client binaries. The campaign has targeted systems across 47 countries, with significant activity observed in Germany, the U.S., Turkey, Iran, and France.
2026-08-05 2026	Hackers run khunt post-exploitation toolkit from Oracle database SQLi	Toolkit for post-exploitation using Oracle database integration, discovered by Huntress. This attack leveraged a SQL injection vulnerability in a Java application to embed the "khunt" toolkit as Java objects within an Oracle database. The toolkit included components like KhuntCmd for OS command execution, KhuntHash for credential theft, and KhuntFS for file management, all triggered via SQL commands to gain SYSTEM-level privileges and potentially exfiltrate sensitive data like registry hives.
2026-07-26 2026	GitHub PyPI add time-absed defenses against supply chain attacks Supply Chain	Library updates from GitHub and PyPI incorporate time-based defenses against supply-chain attacks, including a 72-hour cooldown for Dependabot package updates and a 14-day cutoff for uploading new files to PyPI releases. These measures aim to mitigate risks highlighted by recent incidents such as the 'chalk', 'debug', and GhostAction attacks, preventing attackers from poisoning older, trusted releases or introducing malicious packages during a critical window after initial publication.
2026-07-11 2026	'Ghostcommit' hides prompt injection in images to fool AI agents steal secrets AI	Writeup on Ghostcommit, an attack technique that hides prompt injection within PNG images to bypass AI code reviewers and steal repository secrets. Researchers demonstrated how a malicious instruction embedded in an image file referenced by an AGENTS.md document could trick AI agents like Cursor with Claude Sonnet into exfiltrating sensitive data from .env files. This exploit leverages the current blind spot where AI code reviewers often skip image analysis, unlike proposed multimodal defenders.
2026-06-22 2026	Microsoft fixes AutoGen Studio flaw that enabled code execution RCE	Writeup of AutoJack, a vulnerability chain in Microsoft's AutoGen Studio, detailing how attackers could manipulate AI agents into executing arbitrary commands. The chain exploits weaknesses in WebSocket trust, authentication middleware, and URL parameter handling to enable remote code execution by tricking a browsing agent into loading malicious JavaScript. Microsoft remediated the flaw before its PyPI release, limiting exposure to developers building from source during a specific window.
2026-06-10 2026	The Miasma worm source code briefly leaked on GitHub Supply Chain	Analysis of Miasma, a credential-stealing attack framework that evolved from the Shai-Hulud worm, details its self-propagating supply-chain attacks. This framework, briefly leaked on GitHub, targets developer machines and cloud credentials to compromise repositories, packages, and AI coding tools like Claude and Copilot. It leverages GitHub for command-and-control, employs advanced multi-stage payload obfuscation, and includes a destructive "dead-man switch" that wipes user files if stolen tokens are revoked. The leak is expected to accelerate adoption and evolution of similar attack techniques.
2026-06-10 2026	GitHub announces npm security changes to tackle supply-chain attacks Supply Chain	Library announces security changes in npm v12 to combat supply-chain attacks, mandating explicit approval for execution of pre/postinstall scripts, native module builds, and prepare scripts from Git/local/linked dependencies. It will also require explicit permission for fetching dependencies from Git repositories and remote URLs, disrupting techniques used in attacks like Shai-Hulud and those targeting eslint-config-prettier and Toptal's Picasso packages. Developers can prepare by upgrading to npm 11.16.0 for warnings on upcoming breaking changes.
2026-06-09 2026	New Veeam vulnerability exposes backup servers to RCE attacks RCE	Writeup detailing CVE-2026-44963, a critical remote code execution flaw in Veeam Backup & Replication (VBR) versions 12.3.2.4465 and earlier, which allows authenticated domain users to compromise backup servers. This vulnerability impacts domain-joined installations, a configuration that deviates from Veeam's best practices. The article highlights the history of VBR flaws being exploited by ransomware gangs like Akira, Fog, Frag, FIN7, and Cuba, and notes that reverse-engineering of patches is likely to occur. Veeam has released patches in version 12.3.2.4854.
2026-05-28 2026	New Gogs zero-day flaw lets hackers get remote code execution RCE	Library for analyzing Gogs zero-day RCE vulnerabilities, including an unpatched argument injection flaw enabling remote code execution via specially crafted pull requests and malicious branch names. This critical vulnerability, affecting Gogs 0.14.2 and 0.15.0+dev, allows authenticated attackers to compromise servers, access private repositories, and extract credentials. The flaw resembles previously patched argument injection issues like CVE-2024-39933 and CVE-2024-39932, but targets a different code path.
2026-05-27 2026	Glassworm botnet disrupted after resilient C2 infrastructure takedown Supply Chain	Analysis of Glassworm botnet disruption details its resilient C2 infrastructure, which leveraged Solana blockchain transactions, BitTorrent DHT, Google Calendar, and direct server connections. Researchers from CrowdStrike, Google, and The Shadowserver Foundation simultaneously took down these four channels, preventing infected machines from receiving new instructions or payloads. The report highlights Glassworm's targeting of developers through malicious OpenVSX and VS Code extensions, as well as npm packages, and provides YARA rules to identify infections.
2026-05-14 2026	OpenAI confirms security breach in TanStack supply chain attack Supply Chain	Library impacting hundreds of npm and PyPI packages, the TanStack supply chain attack, also known as Mini Shai-Hulud, led to OpenAI confirming a breach on two employee devices. While no customer data or production systems were compromised, attackers exfiltrated limited credentials from internal repositories, prompting OpenAI to rotate code-signing certificates for its applications. The campaign utilized compromised GitHub Actions workflows and CI/CD configurations to inject malicious code and publish trojanized package versions, targeting developer and cloud credentials, including GitHub tokens and AWS credentials, and establishing persistence via modified code hooks.
2026-05-14 2026	18-year-old NGINX vulnerability allows DoS potential RCE RCE	Library for detecting CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module, which can lead to denial of service and, under specific conditions like disabled ASLR, remote code execution. This flaw, affecting versions 0.6.27 through 1.30.0, arises from inconsistent state handling during URI processing when 'rewrite' and 'set' directives are used together. The library would likely target this vulnerability and potentially the three other memory corruption issues (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934) discovered alongside it.
2026-05-13 2026	New critical Exim mailer flaw allows remote code execution RCE	Writeup of CVE-2026-45185, a critical user-after-free vulnerability in Exim mail transfer agent versions 4.97 through 4.99.2 compiled with GnuTLS. This flaw allows unauthenticated remote code execution by exploiting a TLS shutdown issue during BDAT chunked SMTP traffic. XBOW's AI-assisted research aided in developing a proof-of-concept exploit, highlighting the evolving landscape of vulnerability discovery and exploitation.
2026-05-12 2026	Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator RCE	Writeup detailing critical RCE vulnerabilities in Fortinet products. CVE-2026-44277, an Improper Access Control flaw in FortiAuthenticator, and CVE-2026-26083, a missing authorization weakness in FortiSandbox, allow unauthenticated attackers to execute unauthorized code via crafted requests. These flaws, while not reported as exploited in the wild, follow a pattern of actively exploited Fortinet vulnerabilities, including previous issues in FortiClient EMS.
2026-05-12 2026	Instructure confirms hackers used Canvas flaw to deface portals XSS	Writeup on ShinyHunters exploiting cross-site scripting (XSS) vulnerabilities in Instructure's Canvas LMS. Attackers used these flaws to gain authenticated admin sessions, deface login portals with extortion messages, and exfiltrate over 3.6 terabytes of data. The attacks targeted the Free-for-Teacher environment, leading to temporary downtime and account closures.
2026-05-08 2026	DAEMON Tools devs confirm breach release malware-free version Supply Chain	Writeup of DAEMON Tools supply chain attack confirming trojanized installers for version 12.5.1 (free). Hackers used digitally signed installers to backdoor systems, deploying an information stealer and a lightweight backdoor, with QUIC RAT malware observed in at least one instance. Disc Soft Limited released a malware-free version, 12.6, addressing the vulnerability.
2026-05-07 2026	Ivanti warns of new EPMM flaw exploited in zero-day attacks RCE	Writeup of CVE-2026-6973, a critical Improper Input Validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM) exploited in zero-day attacks. This flaw allows remote attackers with administrative privileges to execute arbitrary code on EPMM versions 12.8.0.0 and earlier. Ivanti recommends patching to EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1, and rotating admin credentials. Four other high-severity EPMM vulnerabilities (CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821) were also patched.
2026-05-06 2026	Palo Alto Networks warns of firewall RCE zero-day exploited in attacks RCE	Writeup of CVE-2026-0300, a critical PAN-OS zero-day exploited in attacks. This buffer overflow vulnerability affects the User-ID Authentication Portal on Internet-exposed PA-Series and VM-Series firewalls, allowing unauthenticated attackers to achieve root-level remote code execution. Palo Alto Networks recommends restricting access to trusted zones or disabling the portal until a patch is released, with initial fixes expected May 13, 2026.
2026-05-05 2026	DAEMON Tools trojanized in supply-chain attack to deploy backdoor Supply Chain	Writeup detailing a supply-chain attack that trojanized DAEMON Tools installers, versions 12.5.0.2421 through 12.5.0.2434, delivering a backdoor to thousands of systems globally since April 8. The attack compromised DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe, leading to initial infections and targeted deployments of a lightweight backdoor and, in one instance, the QUIC RAT, to high-value targets in retail, scientific, government, and manufacturing sectors across Russia, Belarus, and Thailand.
2026-05-04 2026	Weaver E-cology critical bug exploited in attacks since March RCE	Library for Weaver E-cology office automation addressing CVE-2026-22679, a critical unauthenticated remote code execution flaw in versions prior to March 12. Exploited since March, the vulnerability stems from an exposed debug API endpoint allowing attackers to execute system commands via improperly validated user parameters. Attackers leveraged this for discovery commands like `whoami`, `ipconfig`, and `tasklist`, and attempted PowerShell-based payload downloads. The vendor's fix removes the debug endpoint entirely, making upgrades essential.
2026-04-29 2026	Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining RCE	Library for securing the Qinglong open-source task scheduler, addressing CVE-2026-3965 and CVE-2026-4047. These vulnerabilities, stemming from authentication bypass and path traversal flaws in versions 2.20.1 and older, allow for remote code execution. Attackers have been exploiting these issues to deploy cryptominers, disguised by the process name '.fullgc,' on developer servers by injecting shell commands into `config.sh` and downloading binaries from `file.551911.xyz`.
2026-04-29 2026	GitHub fixes RCE flaw that gave access to millions of private repos RCE Supply Chain	Writeup of CVE-2026-3854, a critical RCE vulnerability affecting GitHub.com and GitHub Enterprise Server, allowing attackers with push access to gain read/write access to millions of private repositories. The flaw stems from unsanitized user-supplied options during 'git push' operations, enabling arbitrary code execution and potential server compromise. Administrators of GitHub Enterprise Server instances are urged to upgrade immediately, as a significant percentage remain vulnerable.
2026-04-28 2026	Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw SQLi	Library for securing LiteLLM, an open-source LLM gateway, against the CVE-2026-42208 pre-authentication SQL injection vulnerability. Attackers exploit this flaw in the API key verification step to access and modify sensitive data, including API keys, credentials, and environment secrets. The vulnerability allows unauthorized access to the proxy and managed credentials, with active exploitation observed targeting specific tables containing secrets from providers like OpenAI and Anthropic. A fix is available in LiteLLM version 1.83.7.
2026-04-24 2026	Over 10000 Zimbra servers vulnerable to ongoing XSS attacks XSS	Writeup of CVE-2025-48700, an ongoing XSS vulnerability impacting over 10,000 Zimbra Collaboration Suite instances. Exploitable by unauthenticated attackers, this flaw allows arbitrary JavaScript execution, enabling sensitive information access. Patched in June 2025, it has been actively abused in the wild, leading to CISA's inclusion in its Known Exploited Vulnerabilities Catalog and an order for Federal Civilian Executive Branch agencies to secure affected servers. Previous Zimbra vulnerabilities have also been exploited by APT28 and Russian Winter Vivern.
2026-04-24 2026	Hackers exploit file upload bug in Breeze Cache WordPress plugin RCE	Library for detecting and preventing arbitrary file uploads, specifically addressing CVE-2026-3844 in the Breeze Cache WordPress plugin. This critical vulnerability, with a severity score of 9.8, allows unauthenticated attackers to achieve remote code execution (RCE) by exploiting a missing file-type validation in the ‘fetch_gravatar_from_remote’ function when the “Host Files Locally - Gravatars” add-on is enabled. Versions up to 2.4.4 are affected.
2026-04-23 2026	New Checkmarx supply-chain breach affects KICS analysis tool Supply Chain	Library compromise affects Checkmarx KICS, its Docker images, and VS Code extensions, with attackers injecting a hidden 'MCP addon' to steal credentials including GitHub tokens, AWS, Azure, and Google Cloud credentials, npm tokens, SSH keys, Claude configs, and environment variables, exfiltrating them to audit.checkmarx[.]cx. Affected users should block access to malicious domains, use pinned SHAs, revert to safe versions like DockerHub KICS v2.1.20, and rotate secrets.
2026-04-22 2026	Microsoft releases emergency patches for critical ASP.NET flaw API Sec	Library updates address critical ASP.NET Core privilege escalation vulnerability (CVE-2026-40372) in Data Protection cryptographic APIs. This flaw allows unauthenticated attackers to forge authentication cookies, potentially gaining SYSTEM privileges, disclosing files, and modifying data. The regression impacts Microsoft.AspNetCore.DataProtection NuGet packages from 10.0.0-10.0.6. Updates to 10.0.7 are recommended, followed by key ring rotation for full remediation. Previously, Microsoft patched an HTTP request smuggling bug (CVE-2025-55315) in the Kestrel web server.
2026-04-22 2026	New npm supply-chain attack self-spreads to steal auth tokens Supply Chain	Library for detecting and defending against npm supply-chain attacks. This worm-like malware self-propagates by injecting malicious code into packages, stealing developer credentials, API keys, cloud service secrets, cryptocurrency wallets (MetaMask, Exodus), and targeting AI agent tooling and database operations. It can also exfiltrate data from CI/CD systems, registries, and LLM platforms, and has been observed targeting PyPI packages with .pth-based payloads. Socket and StepSecurity offer indicators of compromise and remediation guidance, advising immediate removal of affected packages and rotation of all exposed secrets.
2026-04-21 2026	Actively exploited Apache ActiveMQ flaw impacts 6400 servers RCE	Writeup on CVE-2026-34197, a code injection vulnerability in Apache ActiveMQ Classic, impacting over 6,400 exposed servers. Discovered by Horizon3 researcher Naveen Sunkavally, the flaw allows authenticated actors to execute arbitrary code due to improper input validation. Patched in versions 6.2.3 and 5.19.4, this actively exploited vulnerability has been a repeated target, with CISA urging federal agencies to secure their systems. Exploitation indicators include suspicious broker connections with VM transport and the brokerConfig=xbean:http:// parameter. Previous exploited ActiveMQ flaws include CVE-2016-3088 and CVE-2023-46604.
2026-04-19 2026	LiteLLM PyPI Package Compromised in TeamPCP Supply Chain Attack Python	Library compromised in a supply-chain attack, where malicious versions of the LiteLLM Python package (1.82.7 and 1.82.8) were uploaded to PyPI by the TeamPCP hacking group. These versions deployed an infostealer that harvested sensitive data including SSH keys, cloud credentials, Kubernetes secrets, and cryptocurrency wallet data. The payload also attempted lateral movement and installed a persistent systemd backdoor, exfiltrating data to attacker-controlled infrastructure. Organizations are advised to rotate credentials and inspect systems for persistence artifacts.
2026-04-18 2026	Critical flaw in Protobuf library enables JavaScript code execution RCE	Library vulnerability GHSA-xq3m-2v4x-88gg, a critical RCE flaw in protobuf.js, arises from unsafe dynamic code generation. Attackers can inject arbitrary JavaScript code by supplying malicious schemas, leading to code execution on servers or developer machines. Endor Labs identified the issue, impacting versions 8.0.0/7.5.4 and lower, with patches available in 8.0.1 and 7.5.5. Mitigation involves upgrading, auditing dependencies, and treating schema loading as untrusted input.
2026-04-16 2026	Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face RCE	Writeup detailing the exploitation of Marimo CVE-2026-39987, which allows remote code execution and deployment of NKAbuse malware. Attackers leverage Hugging Face Spaces, posing as legitimate AI tools, to host dropper scripts and malware binaries. The payload, a variant of NKAbuse, functions as a remote access trojan with capabilities for shell command execution and data exfiltration, including credential theft from environment variables and Redis servers. Exploitation has increased in volume and tactics, with affected users urged to upgrade Marimo to version 0.23.0 or later, or block external access to the `/terminal/ws` endpoint.
2026-04-14 2026	Microsoft April 2026 Patch Tuesday fixes 167 flaws 2 zero-days RCE	Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days https://ift.tt/nLAl5mZ
2026-04-13 2026	OpenAI rotates macOS certs after Axios attack hit code-signing workflow Supply Chain	Library for securing applications against supply chain attacks, exemplified by OpenAI's response to a malicious Axios package compromising its GitHub Actions workflow. This incident, linked to UNC1069, led to the rotation of macOS code-signing certificates used for ChatGPT Desktop, Codex, and Atlas to prevent potential misuse of the signing key for distributing malware. OpenAI's investigation found no evidence of compromised certificates or user data, but users must update macOS applications to versions signed with new certificates before May 8, 2026, to avoid functionality loss.
2026-04-12 2026	Critical Marimo pre-auth RCE flaw now under active exploitation RCE	Writeup detailing CVE-2026-39987, a critical pre-authentication RCE vulnerability in Marimo versions 0.20.4 and earlier. Exploitable via the unauthenticated WebSocket endpoint '/terminal/ws', attackers can gain an interactive shell with the Marimo process's privileges. Active exploitation observed within hours of disclosure, with attackers exfiltrating credentials and SSH keys. Sysdig researchers noted a methodical operator targeting high-value information. Mitigation includes upgrading to version 0.23.0, restricting external access, or disabling the '/terminal/ws' endpoint.
2026-04-11 2026	10,000+ Docker Hub Images Leaking Credentials Secrets	Analysis of 10,000+ Docker Hub images reveals widespread credential and authentication key leaks affecting over 100 organizations, including a Fortune 500 company and a national bank. Researchers at Flare identified exposed secrets like OpenAI, HuggingFace, and Gemini API keys, GitHub tokens, and database credentials within container images and manifests. Common vulnerabilities stem from `.env` files and hardcoded secrets in application files, impacting cloud environments, CI/CD systems, and Git repositories. While some developers revoked keys within 48 hours, 75% of exposed secrets remained unrevoked, posing ongoing risks.
2026-04-10 2026	Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor Supply Chain	Library for analyzing supply chain attacks, specifically detailing a compromise at CPUID that distributed malware via trojanized versions of CPU-Z and HWMonitor. The attack involved DLL sideloading using a malicious CRYPTBASE.dll and delivered the STX RAT infostealer. This incident highlights a pattern targeting widely used utilities, similar to a prior FileZilla compromise.
2026-04-10 2026	Dangerous runC Flaws Allow Hackers to Escape Docker Containers RCE	Vulnerabilities in runC, CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, allow attackers with custom mount configurations to escape Docker and Kubernetes containers by exploiting bind-mounts and symlink race conditions to gain root privileges on the host system. Fixes are available in later runC versions, and mitigations include user namespaces and rootless containers.
2026-04-10 2026	Max Severity Flowise RCE Vulnerability Now Exploited in Attacks RCE	Library for securing Flowise, an open-source platform for LLM apps. It addresses CVE-2025-59528, a critical RCE vulnerability allowing arbitrary JavaScript code injection via the CustomMCP node. Developers should upgrade to version 3.0.6 or later to mitigate this threat, which has already been observed in active exploitation. Other Flowise vulnerabilities, CVE-2025-8943 and CVE-2025-26319, have also seen in-the-wild exploitation.
2026-04-08 2026	13-year-old bug in ActiveMQ lets hackers remotely execute commands RCE	Writeup detailing CVE-2026-34197, a 13-year-old remote code execution vulnerability in Apache ActiveMQ Classic affecting versions before 5.19.4 and 6.2.3. Discovered using Claude AI, the flaw allows attackers to execute arbitrary commands by exploiting the Jolokia management API to load external configurations, often chaining with CVE-2024-32114 for unauthenticated access. This issue underscores ActiveMQ's history as a target for attackers, with previous RCEs like CVE-2016-3088 and CVE-2023-46604 appearing on CISA's KEV list.
2026-04-07 2026	Hackers exploit critical flaw in Ninja Forms WordPress plugin RCE	Writeup detailing CVE-2026-0740, a critical 9.8 severity vulnerability in Ninja Forms File Uploads for WordPress versions up to 3.3.26. The flaw allows unauthenticated arbitrary file uploads, including PHP scripts, through a lack of destination filename validation and supports path traversal, enabling remote code execution. The vulnerability was discovered by Sélim Lanouar and reported to Wordfence, who provided temporary firewall mitigations before the vendor released a full fix in version 3.3.27.
2026-04-02 2026	Hackers exploiting critical F5 BIG-IP flaw in attacks patch now RCE	Advisory regarding CVE-2025-53521, a critical remote code execution flaw in F5 BIG-IP APM systems that attackers are actively exploiting to deploy webshells. This vulnerability, previously classified as denial-of-service, allows unprivileged attackers to achieve RCE when access policies are configured on a virtual server. F5 strongly recommends patching and reviewing systems for signs of compromise. CISA has added it to its list of actively exploited flaws, urging federal agencies to secure their BIG-IP APM deployments.
2026-03-18 2026	CISA orders feds to patch Zimbra XSS flaw exploited in attacks XSS	Writeup of CVE-2025-66376, a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite's Classic UI. Exploitable via malicious HTML emails, this flaw allows remote unauthenticated attackers to execute arbitrary JavaScript, potentially hijacking sessions and stealing data. CISA mandated federal agencies patch this actively exploited flaw, which has seen prior exploitation of Zimbra vulnerabilities by groups like Winter Vivern.
2026-02-20 2026	Microsoft says bug causes Copilot to summarize confidential emails AI	Advisory regarding a Microsoft 365 Copilot bug where confidential emails were summarized, bypassing data loss prevention policies. This issue, tracked under CW1226324 and detected January 21, affected the Copilot "work tab" chat feature, incorrectly processing emails in Sent Items and Drafts, even those with confidentiality labels. Microsoft confirmed a code error as the root cause and began rolling out a fix in early February, with remediation continuing for complex service environments.
2026-02-04 2026	CISA warns of five-year-old GitLab flaw exploited in attacks SSRF	Writeup on CVE-2021-39935, a GitLab SSRF vulnerability actively exploited by threat actors. CISA has ordered U.S. federal agencies to patch this five-year-old flaw, which allows unauthenticated external users to access the CI Lint API and perform server-side requests. This vulnerability impacts multiple GitLab versions prior to December 2021 updates and affects organizations using GitLab's DevSecOps platform.
2025-10-21 2025	CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw SSRF	Writeup of CVE-2025-61884, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Oracle E-Business Suite, now confirmed by CISA as actively exploited. This flaw in the Oracle Configurator runtime component was leveraged in July attacks, with exploits leaked by ShinyHunters and potentially used by the Clop ransomware gang. Oracle has released patches and recommended federal agencies apply them by November 10, 2025, to mitigate unauthorized data access risks.
2025-04-09 2025	Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials SSRF	Library for detecting and mitigating Server-Side Request Forgery (SSRF) vulnerabilities that target EC2 Metadata. This resource highlights a campaign exploiting IMDSv1 to steal AWS IAM credentials, enabling privilege escalation and access to services like S3. It details attacker techniques, including rotating query parameters and subpaths, and emphasizes the importance of migrating to IMDSv2. The article also notes the broader trend of older CVEs, such as CVE-2017-9841 and CVE-2023-1389, remaining highly exploited.
2024-11-04 2024	Microsoft SharePoint RCE bug exploited to breach corporate network RCE	Writeup detailing the exploitation of CVE-2024-38094, a Microsoft SharePoint RCE vulnerability, for initial network access. Attackers deployed a webshell, leveraged Horoung Antivirus to disable defenses, and used tools like Impacket, Mimikatz, FRP, everything.exe, Certify.exe, and kerbrute for lateral movement, credential harvesting, persistence, and network scanning. The exploit involved a batch script for antivirus installation and manipulation of system logging.