Ionut Arghire

The bug can allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials.

Tracked as CVE-2026-21858 (CVSS score 10), the bug enables remote code execution without authentication.

The maximum-severity code injection flaw can be exploited without authentication for remote code execution.

Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity.

An error in the firmware-upload handler leads to devices starting an unauthenticated root-level Telnet service.

The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands.

Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally.

Using fake accounts and synthetic data to lure the hackers, the researchers gathered information on their servers.

Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to RAT infections.

The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations.

The hacking group Crimson Collective has claimed the theft of personal information pertaining to over 1 million Brightspeed customers.

Hackers have compromised a file transfer system at Sedgwick’s subsidiary that serves government agencies.

With 24 new vulnerabilities known to be exploited by ransomware groups, the list now includes 1,484 software and hardware flaws.

The 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth.

In December, the botnet’s operators focused on weaponizing the flaw to compromise vulnerable Next.js servers.

GreyNoise has observed thousands of requests targeting a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday.

The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets.

The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.

Tracked as CVE-2020-12812, the exploited FortiOS flaw allows threat actors to bypass two-factor authentication.

The ecommerce giant will provide purchase vouchers to the 33.7 million individuals impacted by the incident.