A critical flaw in Forminator Forms (CVE-2026-15748) can let unauthenticated attackers upload arbitrary files and potentially execute PHP code, leading to full site compromise on vulnerable WordPress sites. Wordfence also disclosed an authentication bypass in User Profile Builder (CVE-2026-15826) that can let attackers log in as user ID 1 and take…
A hacker attack on two Berlin Senate administrations has caused major disruptions, cutting off internet and external email access and making home office work impossible. Authorities have activated a crisis team and are investigating possible data exfiltration and a severe cyber incident in the Berlin state network. #BerlinSenate #Landesnetz #BSI #LKA
Microsoft Threat Intelligence uncovered a multistage intrusion campaign targeting hospitality and hotel organizations in Europe and Asia, especially Japan, using photo-themed ZIP archives and fake image shortcut files to launch an attack chain with PowerShell, a Node.js implant, persistence, and C&C activity. The campaign also abused Calendly and Google redirect links for phishing and yielded extensive IoCs, including domains, IPs, and related artifacts linked to infrastructure such as photo-26653[.]cfd and zloapobikahy23[.]bond. #Microsoft #Calendly #Google #Nodejs #PowerShell #photo-26653cfd #zloapobikahy23bond
Ransom Busters is a deceptive ransomware affiliate that directly contacts victims, claims to have accessed ransomware group servers, and demands $20,000 to $60,000 to delete stolen data. GuidePoint also linked the broader ransomware landscape to UNC6671, rising extortion brands, and increasingly industrialized tactics such as phishing, AitM operations, and pre-encryption access…
StopAndProtect is a large-scale operation that combines file encryption, data theft, and multiple spreading and control components while abusing thousands of hacked WordPress sites for infrastructure. OPSEC failures exposed victim logs, screenshots, source code, and evidence that the campaign affected thousands of IPs across regions, with most activity seen in the US, Russia, and India. #StopAndProtect #WordPress #ClickFix #SilentEncryptor #SilentDataCollector
PayUp, using financial software, was targeted by the direwolf ransomware group, resulting in disruption and data encryption demands. The incident affected financial operations in #countryname
InfoFlo CRM, a software provided in the US, reported a ransomware incident attributed to the direwolf threat actor. The attack resulted in unauthorized access and disruption of services, impacting the United States #UnitedStates
Photon Health, Inc. in the US was targeted by the direwolf ransomware crew, causing disruption to healthcare operations. The incident resulted in encryption and potential data exposure, impacting services across #UnitedStates
This article explains how malware uses blockchain dead drop resolvers to fetch command-and-control pointers at runtime from smart contracts on EVM chains, Solana, and TON instead of hardcoding them. It highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns. #ChainDrop #TroyDen #DeadLock #CLEARSHORT #JADESNOW #GlassWorm #SalatStealer #TONResolver #Ethereum #Polygon #BNBSmartChain #Solana #TON
A privacy issue in Moonshot AI’s Kimi Work desktop client causes feedback submissions to automatically upload the five most recently updated agent sessions, along with diagnostic logs, without clearly disclosing this to users. The uploaded session data can include raw execution records and other sensitive information from unrelated work, highlighting a…
Medusa ransomware-as-a-service is expanding quickly by paying access brokers and exploiting newly disclosed software flaws, including Fortra GoAnywhere and BeyondTrust vulnerabilities. The U.S. government says the group has surpassed 500 victims and has frequently targeted the Healthcare and Public Health sector, while also reusing legitimate tools to evade detection. #Medusa #FortraGoAnywhere #BeyondTrust #Storm-1175
Attackers are actively scanning and exploiting critical flaws in MLflow and FUXA, with MLflow abuse targeting cloud metadata services to steal credentials and secrets. FUXA is also seeing malicious internet-wide scanning against a path traversal issue that could let an attacker overwrite files and potentially achieve remote code execution. #MLflow #FUXA…
Varonis Threat Labs disclosed CoSnitch, a set of three flaws in Microsoft Copilot Personal that could let a crafted link trigger silent prompt execution and exfiltrate data from connected apps in a victim’s authenticated session. The research also showed a separate memory-poisoning path through web summarization, and Microsoft shipped patches for…
nyklawfirm.com nyk.ae in the United Arab Emirates reported a ransomware attack attributed to incransom, involving encrypted files and disruption of normal operations. The incident impacted United Arab Emirates #UnitedArabEmirates
Coltrane Systems in the United States reported a ransomware incident attributed to the threat actor “play,” involving unauthorized encryption and disruption of operations. The attack impacted systems in the United States #UnitedStates