Help Net Security
helpnetsecurity · C · active
https://www.helpnetsecurity.com/
Tech press; useful for vendor reports and patch summaries. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.helpnetsecurity.com/ (listing) then webfetch per-article URL for body. AVOID: Nothing; WebFetch works on both listing and articles. High daily volume; many items are vendor-report/PR roundups, so triage to vuln/breach/threat items.. | 2026-07-05 admiralty audit: C, reputable security-news aggregator, mostly re-reports vendor/research findings; corroborate before acting. MEDIUM->C, stays active.
Cited in 43 entries
Citation cadence
Citation days per ISO week (20 weeks of coverage span, total 34).
- CVE-2026-87886, Acronis Backup plugin for cPanel/WHM and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)2026-09-18
- ANNUAL REPORT; Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI agents weaponized inside real intrusions and red-team engagements2026-09-17
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)2026-09-10
- WeWorm: an AI-assisted zero-click worm demonstrates full WeChat account takeover on Android and iOS from a single unanswered call2026-09-09
- CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped2026-09-03
- Infostealers now specifically monetize hijacked Claude sessions: Anthropic revokes sessions compromised via Vidar, LummaC2, StealC, RedLine, Acreed and AMOS2026-09-01
- CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment2026-08-30
- FakeAgent, malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading2026-07-26
- Romania's national cadastre agency ANCPI hit by a multi-day cyberattack; ByteToBreach claims citizen-data and e-Terra source-code theft plus ransomware2026-07-19
- CVE-2026-46817, Oracle E-Business Suite (Payments): unauthenticated RCE now CISA KEV-listed after quiet in-the-wild exploitation (CVSS 9.8)2026-07-16
- Proofpoint: OAuth client ID spoofing validates stolen Entra ID credentials at scale without writing a successful sign-in log2026-07-15
- Accenture confirms a data-theft incident after '888' advertises 35 GB of internal source code, keys and Azure credentials2026-07-08
- CVE-2026-45659, Microsoft SharePoint Server: authenticated deserialization RCE, now KEV-listed2026-07-02
- Kaspersky GReAT: "StrikeShark" loader deploys Cobalt Strike via "Perfect DLL Hijacking" against government targets2026-06-27
- Klue OAuth-token breach, victim list grows, CRM-API abuse chain detailed2026-06-21
- Operation Endgame expands to SocGholish/TA569, 106 C2 servers down, FakeUpdates loader stripped from 14,971 WordPress sites2026-06-19
- Nightmare/Chaotic Eclipse zero-day wave; the Defender LPE now carries a CVE, a public PoC, and Microsoft's "Exploitation More Likely" rating, with no patch2026-06-19
- ESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer framework2026-06-19
- DragonForce abuses Microsoft Teams TURN relays for C2 and chains four vulnerable drivers (BYOVD)2026-06-17
- CVE-2026-48907, Widget Factory Joomla Content Editor (JCE) before version 2.9.99.5: unauthenticated profile-import → PHP RCE (CVSS v4 10.0)2026-06-17
- PRC UNC6508 ran year-plus espionage through internet-facing REDCap servers and a Google Workspace BCC rule2026-06-16
- CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8)2026-06-12
- France's Tchap government messenger breached via account takeover, 73,467 civil servants' metadata scraped, CNIL notified2026-06-10
- CVE-2026-50751, Check Point Security Gateway: IKEv1 VPN authentication bypass, actively exploited by a Qilin affiliate2026-06-09
- Check Point IKEv1 VPN Authentication Bypass (CVE-2026-50751)2026-06-09
- Luna Moth / Silent Ransom Group (UNC3753): vishing-to-physical-access data-theft extortion against legal and professional services2026-06-06
- Sophos finds an attacker-built, AI-orchestrated EDR-evasion testing lab during incident response2026-06-03
- CVE-2025-48595, Android Framework: actively-exploited integer-overflow privilege escalation2026-06-03
- Carnival Corporation confirms 5.99 M-record ShinyHunters breach, passport + driver's-licence numbers exposed across four cruise brands2026-05-29
- Nx Console / TanStack / DAEMON Tools supply-chain cascade lands three CISA KEV entries2026-05-28
- FBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social engineering fails2026-05-28
- Deleted Google Cloud API keys keep authenticating for up to 23 minutes2026-05-24
- FBI PSA260521, Kali365 OAuth device-code PhaaS bypasses M365 MFA without credential capture2026-05-23
- Operation Saffron dismantles First VPN, 33+ servers seized, user database captured, Switzerland named JIT participant; Phobos RaaS infrastructure link confirmed2026-05-22
- Verizon 2026 DBIR: vulnerability exploitation overtakes credentials as primary breach vector for the first time in 19 years2026-05-21
- INTERPOL Operation Ramz, 13-country MENA cybercrime sweep: 201 arrests, 53 servers seized, Algerian PhaaS server takedown2026-05-19
- Sophos 2026 State of Identity Security: Switzerland records highest identity-breach incidence globally; energy and federal government hardest-hit sectors2026-05-15
- CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), PoC public2026-05-15
- CVE-2026-41089 / CVE-2026-41096 / CVE-2026-41103 / CVE-2026-42898; Microsoft May 2026 Patch Tuesday (120+ CVEs, no zero-days)2026-05-13
- GTIG AI Threat Tracker (May 2026): First Confirmed AI-Generated Zero-Day Exploit ITW and the Behavioural Class of AI-Augmented Malware2026-05-12
- BKA and ZIT dismantle relaunched Crimenetwork darknet marketplace; German operator arrested in Mallorca on European Arrest Warrant2026-05-12
- DAEMON Tools Lite supply chain, QUIC RAT deployed via signed installer; EU governments among targeted victims2026-05-09
- CVE-2026-43284 / CVE-2026-43500, Linux "Dirty Frag": deterministic LPE chain via page-cache write primitives in xfrm-ESP and RxRPC, active exploitation confirmed2026-05-09