N-able’s N-central remote monitoring and management (RMM) platform suffered a critical security vulnerability that attackers exploited even after the vendor’s initial patch proved insufficient. Threat actors leveraged the flaw to establish persistent tunnels into managed service provider (MSP) netwo
Water treatment facilities in Georgia and Michigan have been compromised in cyberattacks linked to escalating US-Iran tensions. Attackers targeted industrial control systems (ICS), potentially gaining access to operational technology that manages water treatment processes. These incidents follow a p
SonicWall Secure Mobile Access (SMA) appliances are under active attack via a critical zero-click remote code execution vulnerability that grants attackers root-level access without authentication. The flaw, affecting internet-facing VPN gateways used by thousands of organizations, allows complete d
N-able’s N-central remote monitoring and management (RMM) platform remains vulnerable to active exploitation despite an initial patch release. CVE-2026-18577, a critical authentication bypass vulnerability, allows unauthenticated attackers to gain complete administrative control over N-central serve
Google Chrome is implementing enhanced security controls to automatically block extensions that hijack New Tab pages, a common tactic used by malicious actors to redirect user traffic and inject unwanted content. This browser-level protection will activate by default, significantly reducing the atta
Ruby on Rails has released emergency security patches addressing a critical Remote Code Execution (RCE) vulnerability in Active Storage. The flaw, tracked as CVE-2024-47887, affects multiple Rails versions and could allow attackers to execute arbitrary code on vulnerable servers. All Rails applicati
Adobe has released emergency patches for CVE-2026-48449, a critical remote code execution (RCE) vulnerability in Campaign Classic with a maximum CVSS score of 10.0. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems without user interaction. Organizations runni
Threat actors successfully compromised Adform’s advertising script infrastructure, injecting malicious code that swaps cryptocurrency wallet addresses on customer websites. The supply chain attack affected numerous publishers and e-commerce platforms globally, redirecting legitimate cryptocurrency t
Adobe has disclosed a critical remote code execution (RCE) vulnerability in Adobe Campaign Classic, assigned a maximum CVSS score of 10.0. Tracked as CVE-2024-36204, this pre-authentication flaw allows attackers to execute arbitrary code without any user interaction. All organizations running affect
Arch Linux has temporarily suspended the Arch User Repository (AUR) package adoption feature after attackers exploited the process to inject malicious code into orphaned packages. Multiple threat actors systematically adopted abandoned packages and pushed compromised commits, putting thousands of us