The wp2shell exploit framework is actively targeting WordPress installations through malicious file upload vulnerabilities, enabling attackers to establish persistent web shells on compromised servers. Visitors to infected sites face risks including malware distribution, credential theft, and browse
Multiple AsyncAPI npm packages were compromised when attackers exploited GitHub Actions workflows to inject Miasma RAT malware. The supply chain attack affected several widely-used packages, exposing thousands of downstream users to remote access trojans. The threat actors leveraged compromised GitH
A critical zero-day vulnerability in Windows’ LegacyHive component is being actively exploited in the wild, allowing attackers to escalate privileges and gain SYSTEM-level access. With no official Microsoft patch available, security researcher collective 0patch has released free, unofficial micropat
The Qilin ransomware group is actively exploiting CVE-2024-21893, a critical authentication bypass vulnerability in Palo Alto Networks’ GlobalProtect VPN gateway. This flaw allows attackers with network access to execute arbitrary code with root privileges on vulnerable firewalls. Organizations runn
Threat actors are actively exploiting a critical vulnerability in Palo Alto Networks’ PAN-OS to deploy Qilin ransomware across enterprise networks. The vulnerability enables unauthenticated remote code execution on internet-facing management interfaces, allowing attackers to establish persistent acc
Two critical vulnerabilities in WordPress Core (CVE-2026-60137 and CVE-2026-63030) are being actively exploited in the wild through a campaign dubbed “WP2Shell.” These flaws allow unauthenticated attackers to achieve remote code execution and complete site takeover on millions of WordPress installat
A massive malware distribution campaign dubbed “FakeGit” has weaponized approximately 7,600 GitHub repositories to deliver SmartLoader malware. Attackers are exploiting GitHub’s trusted reputation by creating fake repositories that masquerade as legitimate software projects, tricking developers and
A critical remote code execution (RCE) vulnerability (CVE-2026-63030) in WordPress core is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations, affecting versions prior to the emergency security release. Mass
A sophisticated Windows exploitation technique leveraging bind links allows attackers to bypass critical security controls including Endpoint Detection and Response (EDR) systems, Anti-Malware Scan Interface (AMSI), AppLocker, and Sysmon monitoring. By manipulating Windows’ native bind link function
HOLLOWGRAPH represents a sophisticated cyber espionage campaign that abuses Microsoft 365 calendar functionality as command-and-control (C2) infrastructure. Threat actors exploit legitimate calendar sharing features to establish covert communication channels, encoding commands within calendar events