Collaborate Disseminate
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally.
The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score:… Continue reading Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift. While earlier discourse focused on how quickly organizations could stand up agents and how much productivity they could promise, a strin… Continue reading Zero Trust for AI Agents Starts With Fixing Zero Visibility
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site.
The cross-site request… Continue reading Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The … Continue reading SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend after it received threat intelligence about an imminent cyber attack.
“Kiteworks received credible threat intellig… Continue reading Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign.
The affected GitHub Actions are listed below –
Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain.
The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for A… Continue reading PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry.
The routine version looks like this. An attacker lands on a low-… Continue reading The SOC Doesn’t Need to Start Over with Every Alert
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets.
“At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limit… Continue reading Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.
The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the … Continue reading Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild