STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Ji…
A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave…
Attackers used Hermes, an autonomous open source tool, in unrestricted "YOLO mode" to conduct espionage against Thailand's Ministry of Finance.
Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]
Ataques a gateways Wi-Fi estão acontecendo em hotéis e centros de conferências em todo o mundo com o objetivo roubar contas do Microsoft 365, segundo um artigo da empresa de cibersegurança ReliaQuest. De acordo com os pesquisadores, os ataques vêm ocorrendo desde junho deste ano …
A JetBrains divulgou um alerta de segurança urgente para sua plataforma de integração contínua TeamCity, após a descoberta de uma vulnerabilidade crítica que permite que atacantes não autenticados assumam o controle remoto de servidores locais. A falha, identificada como CVE-2026…
Uma operação de publicidade maliciosa denominada SourTrade, que atinge inclusive o Brasil, está utilizando uma técnica inédita para evitar a detecção por sistemas de segurança: em vez de entregar um arquivo malicioso completo pela rede, a campanha faz com que o próprio navegador …
Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. [...]
A evolução do comércio digital para um modelo orientado por agentes autônomos de inteligência artificial tornou o setor o mais visado por cibercriminosos em todo o mundo, segundo o mais recente relatório “State of the Internet” da Akamai. O estudo “Securing the Agentic Storefront…
PleaseFix class of flaws makes it easy to socially engineer agentic browsers and highlights weaknesses in how they handle cross-origin requests.
A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. [...]
A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]
An FBI agent explains how the mulitnational law-enforcement Operation Cronos was successful in disrupting the largest ransomware group of its time.
As attackers shift from password theft to session and token theft to bypass multifactor authentication controls, organizations must move beyond login security and protect authenticated sessions.
The post When the Attackers Bring AI: 2026 Healthcare Threats in Plain View appeared first on Clearwater.
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to …
The Coca-Cola Company has confirmed that hackers stole data from its dairy subsidiary, Fairlife, during a ransomware attack earlier this month. [...]
The ShinyHunters extortion gang has claimed responsibility for a recently disclosed Ernst & Young data breach, saying it obtained credentials for some of the company's systems via a supply-chain attack. [...]
Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens.
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user. SSD Secure Disc…
