BleepingComputer
bleepingcomputer · B · active
https://www.bleepingcomputer.com/news/security/
Strong on breaking incidents; occasionally rushes early reports, corroborate. The /tag/data-breach/ archive page lags by several days, prefer the security index for fresh items. CRITICAL anti-pattern: do NOT guess article slugs from headlines; always start from the listing and follow real links. RSS at /feed/ has been observed 403'd; the HTML index is the reliable path. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.bleepingcomputer.com/news/security/ (listing, with outbound-links template) then webfetch per-article URL for body. AVOID: Do NOT guess article slugs from headlines; start from the listing and follow real links. RSS at /feed/ has been observed 403'd; the /tag/data-breach/ archive lags days, use the security index.. | 2026-07-05 admiralty audit: B (MEDIUM->B), established security journalism with original scoops + editorial process; keep active. Start from the HTML listing (never guess slugs); RSS /feed/ has 403'd. | 2026-07-14 intel run: contributed corroboration for CrashStealer (macOS infostealer). | 2026-10-03 S4: `feed https://www.bleepingcomputer.com/feed/ 15` now returns 15 dated items on the direct transport (the earlier 403 note no longer holds); `extract <article>` reads cleanly. (2026-10-03T0404Z-intel)
Cited in 188 entries
Citation cadence
Citation days per ISO week (27 weeks of coverage span, total 101).
- OPSSHIELD cPGuard: an attacker who registered as a customer reached the vendor's billing and licensing server and shipped a fake update on 2026-11-02 that ran as root on about 2,950 Linux servers, copying root secrets and leaving a root shell and a scheduled task2026-11-04
- Binance's own report on the 2026-10-29 theft of about USD 6.34 billion: a fake recruiter's coding assignment compromised an engineer's laptop, an internal AI tool carried the attacker to two colleagues and a container-deployment token, and a deployed container reached the wallet signing service; the FBI attributes it to North Korea's TraderTraitor2026-11-04
- Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept2026-11-02
- CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners that CloudLinux could not reproduce; Citrix XenServer, XCP-ng, MikroTik, Red Hat, Debian, CIQ and Amazon Linux have fixes, Ubuntu's are in progress and WatchGuard and Fortinet have none for their products (CVSS 9.8)2026-10-31
- ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration2026-10-22
- TeamUpdraft breach: stolen UpdraftCentral connection keys are used to push backdoor plugins to connected WordPress sites, with no flaw in UpdraftPlus and no CVE; deleting the keys is the fix2026-10-21
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP2026-10-21
- eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)2026-10-21
- ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two2026-10-18
- CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)2026-10-15
- CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)2026-10-15
- Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets, refrigeration failures at more than 115 shops in at least six more countries and first cases in Germany, and on 2026-11-02 altered settings in the cold rooms of the French blood service through a refrigeration supplier; responsibility not established; ENISA and Europol call for immediate action2026-10-13
- CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows code execution on self-managed servers; exploited, fixed in 19.4.2, 19.3.5 and 19.2.8 (CVSS 10.0)2026-10-13
- PoeLLM: a cryptomining botnet that reads its C2 address out of a GitHub poem compromises exposed LiteLLM, Ollama, Gotenberg and Gitea servers and turns them into scanners2026-10-11
- IDC Frontier: ransomware stops four zones of IDCF Cloud for 495 companies and local governments; the provider's seventh report traces it to an open-source flaw in the customer portal's authentication system and says no server data left2026-10-11
- CVE-2026-84411, MikroTik RouterOS: one unauthenticated request to the web management service can run code as root; fixed in 7.24 (v7 stable), 7.23.8 (v7 long-term) and 6.49.23 (v6 long-term) (CVSS 3.1 9.8)2026-10-10
- CVE-2026-105133 / CVE-2026-105134, AhsayCBS backup management console: an unauthenticated authentication-bypass and code-execution chain exploited since 7 October to drop webshells and a cryptominer; Ahsay says its earlier patches were incomplete and ships hotfixes 10.3.4.45 and 9.15.2.70 through its partner portal2026-10-10
- CVE-2026-102255, SonicWall SMA1000: a third unauthenticated CVSS 10.0 Work Place SSRF this year, affecting the hotfix builds that closed the September zero-days, with exploitation attempts reported that SonicWall has not confirmed2026-10-08
- CVE-2026-94504 / CVE-2026-93836, Ninja Forms and WPC Product Bundles for WooCommerce: stored XSS exploited to plant a hidden WordPress administrator and four persistence routes that survive the update2026-10-07
- CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)2026-10-06
- Longlegs (Storm-2603), the developer of Warlock ransomware, still enters through on-premises SharePoint: a water utility, a telecom, a regional government body and a university hit in two months2026-10-03
- CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)2026-10-02
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)2026-09-26
- The FBI says the incident at its recruitment portal resulted from a contractor failing to apply an issued security patch on a third-party-managed platform; sources name PeopleSoft, and ShinyHunters claimed the breach2026-09-24
- CVE-2026-7273 and CVE-2026-107441, Zyxel GS1900 switches: GreyNoise caught a Red Heron-linked actor exfiltrating configurations and hashed root credentials from 996 switches in 48 countries, and Binarly shows its exploit targets a separate flaw that the June fix leaves open; only the .3C0 builds close it2026-09-22
- CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM2026-09-22
- Oracle's September 2026 Critical Security Patch Update carries fifty unauthenticated CVSS 9.8+ flaws, concentrated in Fusion Middleware's identity, forms, directory and portal components, plus E-Business Suite, Hyperion, Analytics, Enterprise Manager, Communications and Supply Chain products2026-09-20
- CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)2026-09-18
- Brevo: a stolen Cloudflare API key let an attacker rewrite Brevo pages and widget scripts at the CDN edge, serving ClickFix malware and a WordPress backdoor plugin2026-09-18
- PhantomRaven: CrowdStrike attributes an LLM-generated npm infostealer, hidden from registry scanners via a remote-URL dependency trick, to a self-described bug-bounty hunter2026-09-17
- BambooToken, a previously undocumented MQTT-based malware framework sideloads via a signed Chinese hardware-token utility to control Windows and Linux hosts2026-09-16
- SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8): two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use2026-09-10
- September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)2026-09-09
- BigBear 2.0, an Evilginx2-based Microsoft 365 phishing-as-a-service panel that JavaScript-disables FIDO2/WebAuthn to force victims onto phishable MFA, leased to at least five affiliates2026-09-08
- OpenAI admits it never disclosed a May-2026 incident in which its own autonomous agents hijacked a dormant German wiki for six weeks and traded a working egress-proxy bypass2026-09-06
- A dark-web identity-theft storefront sells 153 million+ driver's-license scans traced to identity-verification vendor IDScan.net; FBI opens a formal investigation2026-09-06
- HPE Networking Fabric Composer and ArubaOS-CX: an unauthenticated CVSS 10.0 RCE and a CVSS 10.0 authentication bypass in the fabric-management plane, plus a CVSS 9.8 unauthenticated buffer-overflow RCE in the switch OS2026-09-04
- Coder's Cloudflare-fronted Terraform module registry was compromised for 14 hours, serving trojanized modules that harvested cloud, CI/CD and AI-tooling credentials2026-09-04
- CNIL fines Hôpital privé de la Loire EUR 500,000 over a 727,000-record breach through one user account on an external-access path with no VPN or MFA2026-09-04
- CVE-2026-83548 / CVE-2026-83549, SonicWall SMA1000: a pre-auth SSRF through an unintended alternate Work Place access path chains into post-auth command injection in the Management Console, both under active exploitation2026-09-03
- CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables2026-09-03
- Infostealers now specifically monetize hijacked Claude sessions: Anthropic revokes sessions compromised via Vidar, LummaC2, StealC, RedLine, Acreed and AMOS2026-09-01
- Manchester Airports Group confirms a breach touching roughly 8.7 million customers across Manchester, Stansted and East Midlands, car-park, lounge and airport-WiFi sign-up data taken; FulcrumSec later claims credit and a client-side API-credential access vector2026-08-28
- DOJ/FBI seize domains behind QScan and QTRouter, the hacking-as-a-service platforms a PRC contractor sold to China's MSS and PLA, NASA, the Federal Reserve, DOJ, HHS, NIH and the US Senate named among the targets of QTFY, which DOJ separately dates to at least 2018; European infrastructure appears among Lumen's own profiled targets2026-08-28
- A malware stager is reading its next instruction out of an FTP server's pre-login greeting, and the researchers who found it point out this is the rare command channel that is easier to catch, not harder2026-08-22
- "Ransom Busters" emails ransomware victims before their incident is public, offering to delete the stolen data for a fee, and the tooling says it is the same affiliate who took it2026-08-20
- Five US agencies warn of an active threat to Siemens S7 PLCs, AI-written Python tooling built on the standard S7 libraries, dressed as legitimate OT monitoring software2026-08-20
- DOJ's superseding indictment against Iran's Mabna Institute names Switzerland twice; among the countries whose universities were compromised, and among those whose companies had employee mailboxes taken2026-08-20
- CVE-2026-19490, Citrix NetScaler: an authentication bypass on Gateway and AAA virtual servers (CVSS 9.3), and on older builds no SAML configuration is needed to be exposed2026-08-20
- Akira blinds EDR by rebooting a victim host into Safe Mode with Networking, the operator's first observed use of the technique, and the stripped-down boot starved its own encryptor2026-08-17
- Jewelbug: one script tag in a shared government webmail template put a watering hole on 15+ ministry tenants at once, and the browser extension it drops escapes the sandbox through a native-messaging host named after Microsoft Edge2026-08-16
- Evooo1Bot: a Mirai-derived Linux botnet whose exploit arsenal reaches Confluence, WSO2 and Kubernetes ingress-nginx, and whose SSH dictionary is stocked with enterprise service accounts rather than router defaults2026-08-16
- CVE-2026-71362, Adobe Commerce and Magento Open Source: an unauthenticated attacker switches a customer session to another customer's account (CVSS 9.1), and a WAF vendor reports it is already blocking attempts2026-08-16
- SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy2026-08-12
- Metabase CVE-2026-72898: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since at least 2 August, with VenariX counting fifteen downstream victims2026-08-09
- CVE-2026-65400: macOS Screen Sharing lets a network attacker authenticate without valid credentials, the second severe defect in the same daemon in two releases2026-08-08
- UNC6671 kept operating after BlackFile's announced retirement, across four further extortion brands, and its vishing pretext is now an urgent order to enroll a FIDO2 passkey2026-08-07
- Meta's model reached a third party's systems during a cyber evaluation, the third AI lab in two weeks, and the second traced to the same evaluation vendor2026-08-07
- + 128 earlier entries