Two critical vulnerabilities in PaperCut NG/MF print management software can be chained together to achieve unauthenticated remote code execution. The vulnerabilities affect versions prior to 20.1.7, 21.2.11, and 22.0.9, allowing attackers to bypass authentication mechanisms and execute arbitrary co
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a “major” cybersecurity incident following claims by a ransomware group that they breached the federal agency’s systems. The Department of Justice’s Inspector General is leading the investigation into the breach, which repor
A critical remote code execution (RCE) vulnerability in Elementor Pro, one of WordPress’s most popular page builders with over 12 million installations, allows authenticated attackers to execute arbitrary PHP code on vulnerable sites. The flaw, tracked as CVE-2023-32243, affects Elementor Pro versio
Oracle has released its January 2025 Critical Patch Update (CPU) containing 943 security fixes across its product portfolio, including a critical remote code execution (RCE) vulnerability in WebLogic Server (CVE-2025-21587) with a CVSS score of 9.9. This flaw allows unauthenticated attackers to comp
CISA has added multiple SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation by ransomware operators. The flaws affect SonicWall Secure Mobile Access (SMA) 1000 series appliances, enabling attackers to gain unauthorized access, execute
Ransomware operators are shifting their social engineering tactics, deliberately bypassing C-suite executives to target mid-level IT managers and system administrators. These attacks exploit the technical access privileges of IT staff while capitalizing on their often-lower security awareness compar
Multiple critical vulnerabilities have been disclosed across three major platforms, headlined by a perfect CVSS 10.0 cross-tenant authentication bypass in Terraform’s Model Context Protocol (MCP) server. Veeam Backup Enterprise Manager faces credential exposure risks, while Django patches SQL inject
N-able’s N-central remote monitoring and management (RMM) platform remains vulnerable to active exploitation despite an initial patch release. CVE-2026-18577, a critical authentication bypass vulnerability, allows unauthenticated attackers to gain complete administrative control over N-central serve
Threat actors are exploiting Microsoft Teams to conduct vishing (voice phishing) attacks that culminate in Chaos ransomware deployment. Attackers pose as technical support personnel, manipulate targets into granting remote access, and deploy destructive ransomware that permanently destroys data whil
A critical virtual machine escape vulnerability (CVE-2026-47876) has been discovered in VMware ESXi hypervisors, carrying a CVSS score of 9.3. The flaw allows authenticated attackers with guest VM access to execute arbitrary code on the underlying host system, potentially compromising entire virtual