Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. “Active exploitation has been observed targeting the Palo Alto Networks… Read More »Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it… Read More »China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation… Read More »Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge’s sandbox, a security researcher has… Read More »Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android’s usual confirmation screens, and to update them in the background. To… Read More »Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach… Read More »PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Artificial Intelligence (AI) has become one of this decade’s defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns… Read More »Wazuh and AI for Enhanced SOC Workflows
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before… Read More »Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767… Read More »Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate… Read More »American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed