Ghost CMS SQL Injection Vulnerability Exploited to Hijack 700+ Websites
Attackers are exploiting CVE-2026-26980 to inject malicious JavaScript code for ClickFix campaigns targeting website visitors.
Year: 2026
Chinese Webworm Group Uses Discord and MS Graph for New Backdoors
Researchers identify fresh 2025 activity from China-aligned threat actor deploying EchoCreep and GraphWorm backdoors through…
Security Bulletin Highlights Trust-Based Attack Trends
Weekly threat intelligence report identifies pattern of attackers exploiting trusted infrastructure and legitimate tools.
LiteSpeed cPanel Plugin Vulnerability Being Exploited for Root Access
CVE-2026-48172 allows attackers to execute arbitrary scripts with elevated permissions on affected systems.
CISA warns of session takeover flaws in ABB automation systems
Three vulnerabilities in B&R Automation Runtime could allow attackers to hijack sessions and execute malicious…
CISA Adds Drupal Core SQL Injection Flaw to KEV
Critical vulnerability CVE-2026-9082 affecting all supported Drupal versions is being actively exploited in the wild.
Microsoft Defender vulnerabilities actively exploited in wild attacks
Two flaws in Microsoft Defender allow privilege escalation and denial-of-service, with active exploitation confirmed.
Hitachi Energy GMS600 Affected by OpenSSL Timing Attack Vulnerability
CISA warns of CVE-2022-4304 in industrial grid management systems that could allow attackers to decrypt…
CISA adds Langflow and Trend Micro vulnerabilities to KEV catalog
Two actively exploited vulnerabilities affecting Langflow and Trend Micro Apex One added to mandatory remediation…
GitHub Internal Repositories Breached via Poisoned VS Code Extension
Employee device compromised through malicious Nx Console extension led to access of internal GitHub repositories.