The latest critical vulnerabilities, ransomware campaigns, malware and nation-state activity — the threats security teams need to know about now.
Four months after patching, a pre-auth SQL injection in Roundcube's virtuser_query plugin is under active exploitation. With 523,000+ …
A narrow but effective Android surveillance tool is targeting logistics workers via fake app store pages, intercepting SMS …
CISA confirms ransomware crews have joined nation-state actors in exploiting JetBrains TeamCity's critical authentication bypass. With ~160 servers …
ClickFix has overtaken conventional phishing as the top enterprise initial-access method by exploiting the one thing security tooling trusts implicitly: an authenticated user pasting into a native binary. …
Microsoft's September 2026 security updates broke File History backups across Windows 10 and 11. While a fix is rolling out, the incident highlights a recurring pattern: patches designed …
The unreserved placeholder domain third-party.com is now serving ClickFix social-engineering attacks disguised as Cloudflare verification. Shield53 explains why documentation hygiene matters and how to harden your environments against …
Group-IB's discovery of RemControl reveals a maturing Android MaaS ecosystem where AI-assisted development, Telegram-based C2 rotation, and Accessibility Service abuse converge into a potent remote-controlled banking threat across …
A newly detailed EDR evasion technique bypasses endpoint detection by manipulating process initialization structures instead of calling monitored Windows APIs. Defenders relying solely on API hooking need layered …
GitLab's incoming email feature embeds privileged access tokens directly into user email addresses, creating a supply chain attack vector that most organizations don't even know exists. Shield53 breaks …
North Korean-linked threat actors have expanded their Go-malware supply chain campaign into HashiCorp's Terraform Registry for the first time. The operation uses sophisticated multi-stage delivery via blockchain C2, …
GitLab's per-user issue email address doubles as an unauthenticated commit and CI/CD execution vector. Anyone who obtains the non-expiring token can push code as you to any project …
CVE-2026-67279 and CVE-2026-86060 combine to let unauthenticated attackers gain full admin control of MikroTik routers with SSH exposed to the internet. Active exploitation predates patches by at least …
Eclypsium's InfraTrust Pulse reveals attackers are pivoting from network devices themselves to the management systems that control them. With Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 chained in the …
Cisco Talos has documented CLOSEDQUORUM, a Windows implant that delegates command decisions to a voting panel of four commercial AI models. While the public sample is non-functional, the …
ShinyHunters claims to have breached the FBI using a PeopleSoft zero-day, building on its history of exploiting CVE-2026-35273. Whether confirmed or not, the incident exposes systemic risks in …
Compromised npm and PyPI packages from MemTensor delivered a cross-platform Go credential stealer with worm-like self-propagation. The attack chain through GitHub Actions exposes a systemic weakness in package …
A maximum-severity flaw in Arista VeloCloud Orchestrator (CVE-2026-93952) is being actively exploited to access privileged internal functionality without credentials. On-prem SD-WAN deployments are at immediate risk, with CISA …
CVE-2026-87899 gives any cPanel account holder root on shared servers — a fundamental isolation failure. Hosting providers must patch immediately or face total server compromise from a single …
The EvilTokens phishing-as-a-service kit weaponized AI to automate post-compromise reconnaissance traditionally requiring skilled operators. Its takedown reveals how AI is democratizing sophisticated social engineering at industrial scale.
A fake LastPass GitHub campaign delivered the Rapuncel infostealer using a Microsoft-signed driver to neutralize 145 security tools. The real story isn't the brand spoofing—it's the weaponization of …
The sentencing of a Ryuk initial access specialist exposes the compartmentalized economics of ransomware-as-a-service and raises serious questions about deterrence when facilitators of $15M+ in damages receive lighter …
F5's critical BIG-IP APM zero-day is under active exploitation with nearly 15,000 internet-exposed instances. Shield53 analyzes the OAuth Authorization Server attack surface, detection signals, and what defenders should …
A critical flaw in Next.js's ImageResponse feature allows server-side code execution when attacker-controlled input reaches SVG generation. With npm audit blind to it and no CVE record published …
A Chinese-speaking threat actor linked to Red Heron is chaining WordPress wp2shell flaws and a Zyxel switch vulnerability to steal government PII and network credentials. Defenders must patch …
Microsoft's takedown of the EvilTokens phishing-as-a-service platform highlights how device code flow abuse bypasses MFA by routing auth through Microsoft's own infrastructure. Defenders must restrict legacy auth patterns …
ShinyHunters claims a PeopleSoft zero-day enabled FBI intrusion and data theft of 2-3TB. Unverified but credible enough to warrant immediate defensive action across all PeopleSoft deployments.
WordPress's latest critical patch closes an unauthenticated path traversal flaw in template selection logic. While not every affected site is immediately code-executable, the conditions for full RCE are …
Shield53 analyzes the npm package tw-pkgprobe-7731, a sophisticated credential harvesting tool disguised as a Twilio bug-bounty probe. The rapid version evolution and environment-aware payload delivery signal a well-resourced …
CrowdSec's GitHub breach via the TanStack npm supply chain attack exposes how OAuth tokens from departed employees become persistent attack vectors. The real lesson isn't that security firms …
Microsoft's disruption of EvilTokens exposes how AI is being weaponized at every stage of phishing-as-a-service operations. The device code flow abuse vector remains underappreciated by defenders reliant on …
Two critical vulnerabilities in Bifrost's open-source AI gateway demonstrate a systemic issue: AI infrastructure tooling is shipping with authentication disabled by default, putting LLM API keys and gateway …
A critical path traversal vulnerability in Check Point's Security Management Server is being actively exploited, putting enterprise security infrastructure at risk. Shield53 breaks down the exposure, affected components, …
A former Microsoft security researcher has published a zero-day tool that silently blocks Defender signature updates by exhausting disk space. With his previous exploits weaponized in real attacks, …
The EvilTokens takedown exposes how AI-enhanced PhaaS operators weaponized OAuth device-code flows to bypass MFA across 10,000+ organizations. Here's what defenders need to understand about the post-takedown threat …
A researcher's proof-of-concept for blocking Windows Defender signature updates highlights a dangerous blind spot in endpoint security stacks. While DoS flaws lack CVE fanfare, they can pave the …
Arista's on-premises VeloCloud Orchestrator faces active exploitation of CVE-2026-93952, a CVSS 10.0 flaw hitting certificate-based authentication deployments. With patches missing for two release trains, Shield53 analyzes the SD-WAN …
CISA's latest ICS advisory reveals a cross-site scripting flaw in OpenPLC Runtime v3 that could let attackers hijack operator sessions and commandeer physical processes. With v3 end-of-life and …
CISA's ICSA-26-265-02 advisory reveals a high-severity double-free vulnerability in the ubiquitous lwIP TCP/IP stack, affecting versions 2.0.1 through 2.2.1. With a CVSS of 8.8, the flaw threatens critical …
A CVSS 6.5 denial-of-service vulnerability in Siemens WTV676/WTV776 web interfaces could sever remote access to energy-sector devices. While rated Medium, the operational impact of forced protection mode demands …
Shield53 analysis of CVE-2026-18963 (CVSS 9.1), a critical authentication bypass in Siemens Industrial Edge Management that allows unauthenticated attackers to seize user accounts without email verification. OT environments …
A Linux kernel KVM flaw on ARM64 enables guest-to-host memory read/write when nested virtualization is enabled, creating both VM escape and local privilege escalation paths. The bug is …
Microsoft's initial classification of CVE-2026-65660 as a moderate spoofing bug obscured a near-critical RCE chain in SharePoint Server. With full technical details now public, defenders who deferred patching …
A proof-of-concept for a critical Veeam Agent local privilege escalation flaw is now public, enabling any standard user to jump to SYSTEM via a readable log file. Organizations …
A new unpatched Defender zero-day from researcher Abdelhamid Naceri blocks antivirus signature and platform updates on all supported Windows versions. Enterprises relying solely on Defender face a dangerous …
The indexed-btree campaign demonstrates how threat actors pivot tactics within months of ecosystem-wide security changes. By embedding loaders in runtime code instead of lifecycle scripts, attackers bypass npm …
CISA's KEV addition of CVE-2026-7273 comes months after Zyxel's June patch and weeks after GreyNoise detected mass exploitation. Nearly 1,000 switches across 48 countries were already compromised — …
A joint multinational advisory confirms North Korea's WaterPlum group infected 30,000+ devices through fake job interviews, stealing $10.7M from crypto developers. The campaign exploits a trust gap that …
WordPress's Comment2Shell flaw chains a comment sanitization gap into stored XSS, then hijacks admin sessions for full RCE. With comment moderation off by default and block themes everywhere, …
CISA has added three Linux kernel vulnerabilities to its KEV catalog with a same-day remediation deadline, including a 14-year-old race condition enabling container escapes. Shield53 breaks down the …
ShinyHunters' breach of Clop's leak site creates a dangerous new extortion layer for organizations that already paid. Shield53 analyzes what this means for victims and why data destruction …
Cybercriminals are bundling malware into popular film torrents, with early victims in Kenya and Uganda. Shield53 breaks down why this delivery method persists, who's most exposed, and how …
A pre-authenticated CSRF vulnerability in WordPress Core enables remote code execution by forcing admin theme installation. WordPress 7.1.1 patches the flaw, but sites still running 7.1.0 face significant …
Two small Colorado water utilities were compromised by foreign actors who altered OT settings and disabled alarms. The incidents underscore how under-resourced utilities remain prime targets for nation-state …
A fake LastPass Authenticator installer on GitHub abuses a Microsoft-signed kernel driver to silently kill 145 security products before deploying a password stealer. This BYOVD attack exposes a …
North Korea's Contagious Interview campaign has compromised 30,000 devices and stolen $10.71M in cryptocurrency, blending fake recruitment with legitimate IT work. The convergence of WaterPlum and Wagemole operations …
A CVSS 10.0 Cisco ISE auth bypass under active exploitation, zero-click RCE in AI coding agents, and a proof-of-concept using one LLM to compromise another's infrastructure — this …
The TASK#STOMP campaign demonstrates why PowerShell-based implantware remains a top-tier threat: dual C2 redundancy, scheduled task masquerading, and timestomping create persistent access that evades superficial monitoring. Defenders need …
Blackpoint's discovery of ChainScript marks a maturation of blockchain-based C2 from concept to operational reality. By embedding WebSocket endpoints in a Polygon smart contract, attackers gain infrastructure that …
CISA's addition of CVE-2026-7273 to the KEV Catalog confirms active exploitation of a stack-based buffer overflow in Zyxel GS1900 series switches. Network edge devices remain a persistent blind …
A researcher remotely disabled headlights on a moving BYD Shark 6 through an unauthenticated entry point. This isn't a BYD-only problem — it's an industry-wide failure to treat …