Overview of incoming advisories.
2018 results found
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice managing the Public Defender Service, suffered a significant data breach. Attackers breached its IT systems in April 2025 and exfiltrated records dating as far back as 1978. The breach represents a major exposure of highly sensitive legal and personal data spanning nearly five decades. The LAA oversees legal aid funding in England and Wales, meaning the stolen data likely includes sensitive personal and legal information of vulnerable individuals. The scale and historical depth of the breach raises serious concerns about data retention practices and legacy system security. This incident highlights the risks of retaining large volumes of historical data without adequate protection.
View original advisory →A critical remote code execution vulnerability (CVE-2026-105740, CVSS 9.9) in Langflow, an open-source AI application and agentic workflow platform, is being actively exploited by threat actors. Security firm Previdian issued an alert regarding the exploitation activity. Langflow is maintained by DataStax, which was acquired by IBM in February 2025. The vulnerability is classified as an authenticated RCE flaw, indicating attackers need some level of authentication to exploit it. Honeypot data reveals 1,423 exploit attempts have been recorded, demonstrating active and widespread exploitation in the wild. The high CVSS score of 9.9 underscores the severity of the flaw. Organizations using Langflow are strongly advised to patch or mitigate immediately given the active exploitation.
View original advisory →Singapore-based Ahsay Backup has released security updates to address two critical vulnerabilities in AhsayCBS (CVE-2026-105133 and CVE-2026-105134). These flaws have been actively exploited by threat actors to deploy web shells and XMRig cryptocurrency miners on affected systems. The vulnerabilities can be chained together to bypass authentication and execute arbitrary commands. New patches have been issued after initial fixes were found to be incomplete. The exploitation of these flaws highlights the risk of backup software being targeted as an attack vector. Organizations using AhsayCBS are urged to apply the latest security updates immediately.
View original advisory →Palo Alto Networks released security updates addressing a high-severity remote code execution (RCE) vulnerability in PAN-OS software. The flaw, tracked as CVE-2026-0322 with a CVSS score of 8.6, resides in the management interface of PAN-OS. The vulnerability allows authenticated remote attackers to execute arbitrary code. The issue is under active exploitation in the wild, making patching urgent. Palo Alto Networks issued the patches on Wednesday alongside the public disclosure. Organizations using affected PAN-OS versions are urged to apply updates immediately to mitigate risk.
View original advisory →Multiple Atlassian products are affected by a files or directories accessible to external parties vulnerability tracked as CVE-2026-21589. The vulnerability impacts Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. An unauthenticated attacker could exploit this flaw to access specific files within the web application root directory. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in CISA's BOD 26-04 implementation guidance. The vulnerability is rated High criticality and requires prompt patching across all affected Atlassian Data Center products.
View original advisory →Palo Alto Networks has issued security updates addressing a high-severity remote code execution (RCE) zero-day vulnerability in PAN-OS, tracked as CVE-2026-0322. The flaw has been actively exploited in attacks targeting firewalls. The vulnerability poses significant risk to organizations relying on Palo Alto Networks firewall products. Users are urged to apply the released patches immediately to mitigate exposure. The exploitation of this zero-day highlights ongoing threats to network perimeter security devices.
View original advisory →Unit 42 investigated an intrusion campaign exploiting CVE-2024-47575, a critical vulnerability in Fortinet's FortiManager. Attackers leveraged this flaw to compromise over 500 FortiGate firewalls. The campaign deployed PEERSTITCH, a stealthy memory-resident implant compiled for ARM64 architecture. PEERSTITCH is designed to persist in memory, making forensic detection significantly more difficult. The malware targets FortiGate network devices, indicating a focus on network infrastructure compromise. The scale of the attack (500+ firewalls) suggests a well-resourced and organized threat actor. This intrusion highlights the ongoing risk of unpatched network appliances being targeted for espionage or persistent access.
View original advisory →The U.S. Department of Justice disrupted the Famous Chollima threat group, a North Korean state-sponsored operation that places IT workers remotely at foreign companies. The FBI raided laptop farms in Texas used to facilitate these schemes. Two suspects were arrested and 14 individuals were charged in connection with the operation. Nearly 187 laptops were seized as part of the enforcement action. The scheme involves North Korean nationals posing as remote IT workers to gain employment at US companies. The operation generates revenue for the North Korean regime and potentially enables insider threat activities. This is part of a broader US government effort to counter DPRK cyber and financial operations.
View original advisory →Cisco has patched a critical vulnerability in Cisco Secure Email Gateway affecting the Advanced Malware Protection (AMP) feature. The flaw lies in how AMP processes email attachments when the file reputation service is enabled. An unauthenticated remote attacker can exploit this to write arbitrary files to the underlying operating system. Successful exploitation can lead to command execution with root privileges, severely impacting system integrity. Cisco has confirmed active exploitation in the wild and has shared Indicators of Compromise and background information. No public Proof-of-Concept or exploit code is currently known, but NCSC considers it likely that one will emerge shortly. NCSC anticipates increased scanning traffic and exploitation attempts as a result.
View original advisory →Cisco has issued an advisory warning of active exploitation of a critical vulnerability in Cisco Secure Email Gateway. The flaw allows an unauthenticated attacker to write arbitrary files to the appliance's operating system simply by sending a crafted email attachment through the gateway. If the attack succeeds, the attacker can execute commands with root privileges on the affected appliance. The vulnerability requires no login credentials, making it particularly dangerous. Cisco Secure Email Gateway is widely used by organizations to filter inbound and outbound email for spam and malware. The active exploitation status elevates the urgency for organizations to patch or mitigate immediately. The advisory was released on a Wednesday, indicating a mid-cycle emergency disclosure likely due to observed in-the-wild attacks.
View original advisory →Ledger, a prominent hardware cryptocurrency wallet manufacturer, has instructed resellers and distributors across multiple Asian countries to suspend sales and remove products from shelves. The affected regions include Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. The action comes as Ledger investigates a supply chain attack involving suspected device tampering. This type of attack can involve malicious actors physically modifying hardware wallets before they reach end users, potentially allowing theft of cryptocurrency private keys or funds. Supply chain attacks on hardware devices are particularly dangerous as end users typically trust devices purchased through official channels. The investigation is ongoing and the full scope of the tampering has not yet been disclosed.
View original advisory →Attackers exploited a critical vulnerability in the Collabora Online - Built-in CODE Server, an optional app for Nextcloud, to plant web shells on affected servers. The web shells allow attackers to execute arbitrary commands with the privileges of the web server account. At least three Nextcloud administrators reported the issue on GitHub, with the first confirmed attack occurring on September 10. A web shell is a small malicious file that executes commands sent via web requests. The attack vector is the optional Collabora Online integration, which is widely used for document editing within Nextcloud. The incident highlights risks associated with third-party integrations in self-hosted cloud platforms. Server administrators running Collabora's CODE app are strongly advised to patch or disable the component immediately.
View original advisory →Cisco has released patches for a newly discovered zero-day vulnerability in its Secure Email Gateway (SEG) product. The flaw allows remote unauthenticated attackers to execute arbitrary commands with root privileges, making it critically severe. The vulnerability was actively exploited in the wild at the time of disclosure. No authentication is required to exploit the flaw, significantly lowering the barrier for attackers. Cisco's patch addresses the issue and customers are urged to update immediately. This is described as 'another' zero-day, suggesting prior vulnerabilities in the same product have been exploited. The impact is broad given the widespread enterprise use of Cisco's email security appliances.
View original advisory →Microsoft, Health-ISAC, Japan Cybercrime Control Center (JC3), and private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs jointly disrupted three phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. Since January 2026, the threat actors behind these kits have been responsible for over 1 billion scam messages. The operation represents a significant cross-sector and international collaboration to take down large-scale phishing infrastructure. These phishing kits were used to conduct widespread scam campaigns targeting a broad range of victims. The disruption highlights the growing trend of coordinated public-private partnerships in combating cybercrime.
View original advisory →CISA has issued an urgent warning to security administrators to immediately patch a critical vulnerability in Ivanti Connect Secure (ICS) that has been actively exploited as a zero-day since at least October 1st. The flaw poses significant risk to organizations using the affected product. CISA's advisory underscores the severity of the exploitation activity and the need for rapid remediation. The vulnerability allows threat actors to compromise systems running Ivanti Connect Secure without prior authentication or user interaction. Organizations are urged to apply available patches without delay to prevent potential breaches.
View original advisory →CISA has issued an urgent advisory for organizations to update their Ivanti Connect Secure (ICS) appliances due to an actively exploited authentication bypass vulnerability tracked as CVE-2026-104935 with a CVSS score of 8.6. The flaw allows attackers to bypass authentication on affected ICS deployments. Honeypot data has recorded 105 exploit attempts against this vulnerability, indicating active threat actor interest. CISA is urging immediate patching to the latest version of Ivanti Connect Secure. The vulnerability poses significant risk to organizations using ICS for remote access and VPN connectivity.
View original advisory →A new Android malware named Hirudo has been discovered that targets banking users by replacing legitimate banking applications with modified, malicious versions. These trojanized apps disable security checks that would normally detect fraudulent activity. The malware is designed to steal bank account credentials from victims. By substituting genuine apps with look-alike versions, Hirudo can evade standard mobile security mechanisms. This technique represents an advanced approach to banking fraud on Android devices. The malware's method of app replacement makes it particularly difficult for users to detect the compromise. Security researchers have flagged this as a significant threat to mobile banking security.
View original advisory →Security firm XBOW used OpenAI's publicly available GPT-5.6 Sol model to construct a full-chain Chrome exploit within six days. The attack chained three previously unknown Google Chrome vulnerabilities into a single exploit capable of executing arbitrary code on a Windows machine when a user visits a malicious web page. The exploit required no additional user interaction beyond loading the page. Google confirmed all three bugs, patched them, and paid XBOW its top bug bounty reward of $250,000. This research demonstrates a significant advancement in AI-assisted vulnerability discovery and exploit development. The use of AI agents to automate exploit chaining raises serious concerns about the democratization of advanced offensive security capabilities and the accelerating pace at which zero-day exploits can be developed.
View original advisory →A new Android banking trojan named Hirudo has been identified by Dutch mobile security firm ThreatFabric. The malware operates by replacing legitimate banking applications with purpose-built patched versions that are designed to bypass the apps' built-in security mechanisms from within. This technique represents a significant escalation in financial fraud tactics on the Android platform. Researchers found that Hirudo targets at least eight Indonesian banking apps. By patching the legitimate apps, the trojan can circumvent integrity checks and other security measures that would normally detect tampering. This approach allows attackers to intercept credentials and financial data while evading detection by the apps' own security layers.
View original advisory →An AI-powered pentesting agent autonomously discovered a critical authentication bypass vulnerability on a major insurance company's production website during an authorized security assessment. The flaw allowed users to specify where their one-time passcode (OTP) was sent during the login process, effectively enabling authentication bypass. The vulnerability was described as simple in nature but proving it on a live production system presented significant challenges. This case highlights the growing capability of AI agents in identifying security vulnerabilities during penetration testing engagements. The finding raises important questions about AI-driven security testing and responsible disclosure in production environments.
View original advisory →