Help Net Security
helpnetsecurity · C · active
https://www.helpnetsecurity.com/
Tech press; useful for vendor reports and patch summaries. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.helpnetsecurity.com/ (listing) then webfetch per-article URL for body. AVOID: Nothing; WebFetch works on both listing and articles. High daily volume; many items are vendor-report/PR roundups, so triage to vuln/breach/threat items.. | 2026-07-05 admiralty audit: C, reputable security-news aggregator, mostly re-reports vendor/research findings; corroborate before acting. MEDIUM->C, stays active. | 2026-10-10: `extract` of the front page returns raw HTML; the dated article anchors (.../YYYY/MM/DD/slug/) carry the date in the path, and per-article `extract` returns clean markdown. | 2026-10-22 (S3): recipe change: `extract https://www.helpnetsecurity.com/` now returns clean text with titles and dates. | 2026-10-27 (S3): `extract` of the front page returns raw HTML (direct-raw), not clean text; parse article hrefs and dates with a regex, then `extract` per article reads cleanly.
Cited in 47 entries
Citation cadence
Citation days per ISO week (25 weeks of coverage span, total 40).
- Fortinet FortiSandbox GUI authentication bypass (CVE-2026-107656, CVSS 9.6) and FortiSIEM 7.5.0 unauthenticated path traversal to code execution (CVE-2026-106173, CVSS 9.4): both critical, fixed 2026-10-13, neither reported exploited2026-10-23
- CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.72026-10-20
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- Plugin4Shell: a design flaw AIR rates zero-click breaks plugin SHA-pinning in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI2026-09-22
- CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)2026-09-18
- ANNUAL REPORT: Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI-related attacks, failures and assessments2026-09-17
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)2026-09-10
- WeWorm: an AI-assisted zero-click worm demonstrates full WeChat account takeover on Android and iOS from a single unanswered call2026-09-09
- CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped2026-09-03
- Infostealers now specifically monetize hijacked Claude sessions: Anthropic revokes sessions compromised via Vidar, LummaC2, StealC, RedLine, Acreed and AMOS2026-09-01
- CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment2026-08-30
- FakeAgent, malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading2026-07-26
- Romania's national cadastre agency ANCPI hit by a multi-day cyberattack; ByteToBreach claims citizen-data and e-Terra source-code theft plus ransomware2026-07-19
- CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)2026-07-16
- Proofpoint: OAuth client ID spoofing validates stolen Entra ID credentials at scale without writing a successful sign-in log2026-07-15
- Accenture confirms a data-theft incident after '888' advertises 35 GB of internal source code, keys and Azure credentials2026-07-08
- CVE-2026-45659, Microsoft SharePoint Server: authenticated deserialization RCE, now KEV-listed2026-07-02
- Kaspersky GReAT: "StrikeShark" loader deploys Cobalt Strike via "Perfect DLL Hijacking" against government targets2026-06-27
- Klue OAuth-token breach, victim list grows, CRM-API abuse chain detailed2026-06-21
- Operation Endgame expands to SocGholish/TA569, 106 C2 servers down, FakeUpdates loader stripped from 14,971 WordPress sites2026-06-19
- Nightmare/Chaotic Eclipse zero-day wave; the Defender LPE now carries a CVE, a public PoC, and Microsoft's "Exploitation More Likely" rating, with no patch2026-06-19
- ESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer framework2026-06-19
- DragonForce abuses Microsoft Teams TURN relays for C2 and chains four vulnerable drivers (BYOVD)2026-06-17
- CVE-2026-48907, Widget Factory Joomla Content Editor (JCE) before version 2.9.99.5: unauthenticated profile-import → PHP RCE (CVSS v4 10.0)2026-06-17
- PRC UNC6508 ran year-plus espionage through internet-facing REDCap servers and a Google Workspace BCC rule2026-06-16
- CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8 base)2026-06-12
- France's Tchap government messenger breached via account takeover, 73,467 civil servants' metadata scraped, CNIL notified2026-06-10
- CVE-2026-50751: Check Point Security Gateway IKEv1 VPN authentication bypass, actively exploited, actor assessed with medium confidence to use Qilin ransomware2026-06-09
- Luna Moth / Silent Ransom Group (UNC3753): vishing-to-physical-access data-theft extortion against legal and professional services2026-06-06
- Sophos finds an attacker-built, AI-orchestrated EDR-evasion testing lab during incident response2026-06-03
- CVE-2025-48595, Android Framework: actively-exploited integer-overflow privilege escalation2026-06-03
- Carnival Corporation confirms 5.99 M-record ShinyHunters breach, passport + driver's-licence numbers exposed across four cruise brands2026-05-29
- Nx Console / TanStack / DAEMON Tools supply-chain cascade lands three CISA KEV entries2026-05-28
- FBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social engineering fails2026-05-28
- Deleted Google Cloud API keys keep authenticating for up to 23 minutes2026-05-24
- FBI PSA260521, Kali365 OAuth device-code PhaaS bypasses M365 MFA without credential capture2026-05-23
- Operation Saffron dismantles First VPN, 33+ servers seized, user database captured, Switzerland named JIT participant; Phobos RaaS infrastructure link confirmed2026-05-22
- Verizon 2026 DBIR: vulnerability exploitation overtakes stolen credentials as the leading initial access vector for the first time in 19 years2026-05-21
- CVE-2026-41091: exploited Microsoft Defender link-following privilege escalation to SYSTEM, with the CVE-2026-45498 Defender denial of service2026-05-20
- INTERPOL Operation Ramz: 13 MENA countries arrest 201 suspects, seize 53 servers and dismantle a phishing-as-a-service site in Algeria2026-05-19
- Sophos State of Identity Security 2026: Swiss respondents report the highest identity-breach rate of 17 countries, at 89%2026-05-15
- CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), listed by CISA as exploited and chained with the PHP2Shell flaws to reach root, PoC public2026-05-15
- Microsoft May 2026 Patch Tuesday: Netlogon pre-auth RCE on domain controllers (CVE-2026-41089), later reported exploited by Belgium's CCB, leads four critical fixes2026-05-13
- GTIG AI Threat Tracker (May 2026): an AI-developed zero-day 2FA bypass prepared for mass exploitation, AI decoy code in Russia-nexus malware and PROMPTSPY's Gemini agent2026-05-12
- BKA and ZIT shut down the relaunched Crimenetwork darknet marketplace; suspected German operator arrested in Mallorca on a European Arrest Warrant2026-05-12
- DAEMON Tools Lite supply-chain compromise: signed installers deliver a profiler worldwide, with a backdoor and QUIC RAT reserved for a dozen targets in Russia, Belarus and Thailand2026-05-09
- CVE-2026-32202 in Windows Shell: an incomplete fix for an APT28-exploited LNK flaw leaks NTLM hashes when a folder is opened, exploited and re-released in July (CVSS 4.3)2026-05-08