SectionExploits
Attacks seen in the wild, breaches and campaigns.
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
A campaign exploiting the PHP2Shell flaws and a Check Point zero-day gave attackers root on Security Gateways, then wiped VMware ESXi hosts.…
Check Point patches zero-day root escalation flaw exploited against customers
Check Point has issued emergency hotfixes for CVE-2026-123039, a local privilege escalation flaw in its Gaia OS that attackers have used since…
Hackers Compromise 4,800 GitHub Accounts to Steal Cloud Credentials
A campaign dubbed wfx-loot abused compromised GitHub accounts to inject malicious workflows that harvest CI secrets and cloud credentials from at least…
QNAP warns NAS devices are being breached through Plex2Shell attacks
QNAP says attackers are compromising NAS devices by exploiting a four-flaw chain in Plex Media Server, and users running exposed vulnerable servers…
Queens Public Library Hit by Ransomware, Disrupting Wi-Fi and On-Site Systems
A ransomware attack has encrypted systems at the Queens Public Library, taking down Wi-Fi, on-site computers, and its mobile app while branches…
Zyxel Switch Attacks Traced to Zero-Day, Not Previously Patched Flaw
Attacks initially attributed to a patched Zyxel switch vulnerability were later linked to an actively exploited zero-day tracked as CVE-2026-107441. The out-of-bounds…
Canadian Extradited to US Over Years-Long School Hacking and Cryptomining Scheme
U.S. prosecutors say two Canadian nationals breached supercomputers at universities in New York, Tennessee, North Carolina, and Massachusetts to secretly mine cryptocurrency…
Attackers Actively Exploit Max-Severity Siemens IoT2050 Flaw
VulnCheck says a perfect-10 vulnerability in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited to deploy remote command backdoors, allowing unauthenticated…
Belarusian, Ukrainian Hackers Claim Destructive Breach of Russia’s Statistics Agency
The Cyber Partisans and Silent Crow say they spent months inside Rosstat's network before wiping servers and stealing census, mortality and military…
Polymarket Loses Over $2 Million After Third-Party Script Compromise
A compromised monitoring script from vendor DebugBear let attackers drain trader funds on Polymarket's international platform before the exchange halted trading and…
Volt Typhoon’s ‘Silent Train’ Framework Hides Zero-Day Attacks Behind Disposable Relays
Black Lotus Labs says the Chinese state-sponsored group has spent three years running zero-day attacks through rotating chains of compromised routers and…
PHP2Shell Flaws Draw Mass Scans as Attackers Chase Mirai Deployment
Millions of exploit attempts are targeting newly disclosed PHP2Shell vulnerabilities as attackers try, and mostly fail, to pull vulnerable systems into the…