Exploit Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
|
24.10.26 |
Plug me if you can: Exploiting USB Printer Drivers in Windows | Windows loads the appropriate kernel driver by interpreting USB Descriptor when a USB device is connected. If the data sent by the device is not properly validated, this can lead to kernel-level vulnerabilities. | Exploit blog | Ethiack |
|
24.10.26 |
Cisco Secure Email & PAN-OS Zero-Days Exploited | Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagged both vulnerabilities as known exploited flaws, adding them to its Known Exploited Vulnerabilities (KEV) catalog. | Exploit blog | SOCRADAR |
|
24.10.26 |
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) | SOPHOS | The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities. | Exploit blog | SOPHOS |
|
17.10.26 |
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | Exploit blog | Calif |
|
17.10.26 |
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks | Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor chained three vulnerabilities to move from an unauthenticated web request to root-level code execution on an ICS VPN appliance running version 22.8R2.4, which was fully patched at the time. | Exploit blog | SOCRADAR |
|
17.10.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Exploit blog | Proofpoint US |
|
17.10.26 |
Vulnerability Discovery and Exploitation Trends in the AI Era | Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation statistics to evaluate the impact of artificial intelligence (AI) on the vulnerability threat landscape. We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
ARMORY CASTLE Exploits BeyondTrust | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack | WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. | Exploit blog | SEQRITE |
|
10.10.26 |
DarkSword/Coruna Open Directory Finding Report | Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. | Exploit blog | Censys |
|
10.10.26 |
Critical N-able N-central Vulnerability and Active Exploitation | UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. | Exploit blog | Huntress |
|
7.10.26 |
CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
|
6.10.26 |
IQUALIF Leak, IUT Breach, SMTP Dump and Struts Exploit | SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French residential data leak, an alleged breach affecting IUT Paris Seine, and an alleged initial access auction for a U.S. manufacturing company. Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638. | Exploit blog | SOCRADAR |
|
6.10.26 |
FortiMail Zero-Day Under Active Exploitation | Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. | Exploit blog | SOCRADAR |
|
3.10.26 |
Swarming Against Citrix 0-Day Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
27.9.26 |
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. | Exploit blog | GTI |
|
26.9.26 |
A spy trojan swaps zero-days for a plain phishing email | The link in the email pointed at an image file. The web server sent back a program. What arrived on two separate customer networks was a one megabyte Windows executable named image.pif, and in both cases somebody double clicked it. | Exploit blog | IntelFusions |
|
26.9.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update. | Exploit blog | greynoise.io |
|
26.9.26 |
Serverless, Not Riskless: Exploiting Unauthenticated API Gateways in AWS | TL;DR – Unauthenticated Amazon Web Services Application Programming Interface (AWS API) Gateway endpoints backed by over-permissioned Lambda functions create a repeatable attack chain from a single HTTP request to credential extraction with no AWS credentials required. | Exploit blog | GUIDESECURITY |
|
26.9.26 |
SalesBleed: 0-Click Data Exfiltration in Agentforce | We found a way to pull sensitive account data out of Salesforce Agentforce without ever logging in, or requiring the victim to click anything. The entry point was a public Web-to-Lead form, the exit was a DNS query. We call it SalesBleed. | Exploit blog | Zenity Labs |
|
26.9.26 |
Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts | Proofpoint researchers identified an active TeamFiltration campaign - tracked as UNK_CondorFiltration, that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing intensively on Chilean organizations. | Exploit blog | PROOFPOINT |
|
18.9.26 |
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed | The originally released PoC had issues that broke exploitation. That PoC has been revised by the author. We have reviewed the revised version of the exploit and have validated that it now functions as expected in our lab. We have added a section at the end of our original article discussing this update and our results. | Exploit blog | LEVELBLUE |
|
18.9.26 |
Novee Exploitability Validation for External Reports | Traditional tooling tells you what might be wrong. Novee’s Exploitability Validation tells you what's actually exploitable, right now, and proves it. | Exploit blog | NOVEE |
|
15.9.26 |
The fake worker threat and the rise of human infiltration | How fake workers exploit trust, business processes and digital identities to gain legitimate access to organizations | Exploit blog | BARRACUDA |
|
12.9.26 |
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE | This research demonstrates post-exploitation techniques that could allow an attacker with root access on a compromised Kubernetes node to misuse an open standard and reference implementation for machine identity known as SPIFFE/SPIRE to impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs). | Exploit blog | Palo Alto |
|
12.9.26 |
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities | Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. | Exploit blog | CISCO TALOS |
|
10.9.26 |
StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited | Attackers are actively exploiting an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution and persistent backdoor installation. | Exploit blog | SOCRADAR |
|
5.9.26 |
Attackers exploit a Chrome flaw, update your browser now | Google has shipped a new Chrome desktop release that closes 12 security holes, and one of them was already being used in attacks before the fix arrived. Hong Kong's HKCERT, relaying Google's advisory, rates the release "Extremely High Risk" on the strength of that single bug. | Exploit blog | INTELFUSIONS |
| 27.8.26 | TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure | The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework. | Exploit blog | Trend Micro |
| 27.8.26 | Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render | Security Joes researchers, led by Red Team Lead Anna Breeva, discovered a new email spoofing technique that abuses Unicode bidirectional (Bidi) controls together with SMTPUTF8 to make an attacker-controlled email address visually appear to belong to a trusted domain. | Exploit blog | Security Joes |
| 22.8.26 | Death By 20,000 PoCs | VulnCheck researchers curated 20K+ public exploits and vulnerability analyses in 2025. As of mid-August 2026, we’ve already reviewed 17,800+ PoCs and write-ups, putting us 87% of the way to 2025’s numbers with another 4.5 months left to go in the year. | Exploit blog | VULNCHECK |
| 22.8.26 | Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation | This blog continues the series exploring NTDS.dit credential theft, building on our earlier work. In this analysis, we examine the underlying methodologies used in these attacks and how Trellix Helix identifies them. We will highlight the Advanced Correlation Engine (ACE)'s capability to consolidate telemetry from policy, network, and endpoint sources. | Exploit blog | TRELLIX |
|
8.8.26 |
CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates | Real-world case studies and observations demonstrate an increase in attacks on trusted relationships and adversarial use of AI. | Exploit blog | CROWDSTRIKE |
|
1.8.26 |
Fastjson RCE (≤1.2.83): Active Exploitation Detected — Detection & Mitigation | A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a vulnerable server by sending it specially crafted JSON — no user privileges, no victim interaction, and no third-party libraries required. ThreatBook TDP® (Threat Detection Platform) has already captured this vulnerability being exploited in the wild, so if you run an affected version without SafeMode enabled, treat remediation as urgent. | Exploit blog | THREATBOOK |
|
1.8.26 |
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Financ | Disclosure note: This research was conducted jointly by Hunt.io and Bob Diachenko, security researcher and journalist. Thailand's national CERT and NCSA were notified on July 15, 2026, and acknowledged receipt the same day. Publication was held for the standard 7-day disclosure window. | Exploit blog | HUNT.IO |
|
1.8.26 |
XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens | Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads. | Exploit blog | GROUP-IB |
| 25.6.26 | Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager | In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. | Exploit blog | GTI |
| 19.6.26 | From SQLi to RCE – Exploiting LangGraph’s Checkpointer | AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? | Exploit blog | CHECKPOINT |
| 13.6.26 | ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit | Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. | Exploit blog | GTI |
| 13.6.26 | Borrowed Trust – Systematic Exploitation of Abandoned Cloud DNS Delegations to serve Thai Gambling SEO Content | Cyble's latest analysis exposes 163 organizations compromised via abandoned DNS delegations in a Thai gambling SEO poisoning campaign. | Exploit blog | Cyble |
| 13.6.26 | From SQLi to RCE – Exploiting LangGraph’s Checkpointer | AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? | Exploit blog | CHECKPOINT |
| 30.5.26 | While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Google Threat Intelligence Group (GTIG) analyzed a dozen current PhaaS offerings in the Chinese underground, all of them mature services and many likely tied intricately to the broader criminal ecosystem in that region. | Exploit blog | GTI | |
| 16.5.26 | Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities | Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. | Exploit blog | CISCO TALOS |
| 11.4.26 | Adobe Reader zero-day vulnerability in active exploitation | On April 7, 2026, a security researcher described an Adobe Reader zero-day vulnerability that has been exploited since at least December 2025. The vulnerability allows threat actors to execute privileged Acrobat APIs via specially crafted malicious PDF files that execute obfuscated JavaScript when opened. Exploitation allows attackers to steal sensitive user and system data and to potentially launch additional attacks and remotely execute code. | Exploit blog | SOPHOS |
| 8.3.26 | Look What You Made Us Patch: 2025 Zero-Days in Review | Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025. Although that volume of zero-days is lower than the record high observed in 2023 (100), it is higher than 2024’s count (78) and remained within the 60–100 range established over the previous four years, indicating a trend toward stabilization at these levels. | Exploit blog | GTI |
| 1.2.26 | PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups | PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities. | Exploit blog | Trend Micro |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? | While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. | Exploit blog | Project Zero |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave | With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. As per the AOSP documentation, the mediacodec SELinux context is intended to be a constrained (a.k.a sandboxed) context where non-secure software decoders are utilized. Nevertheless, using my DriverCartographer tool, I discovered an interesting device driver, /dev/bigwave that was accessible from the mediacodec SELinux context. | Exploit blog | Project Zero |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby | Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. | Exploit blog | Project Zero |
| 10.1.26 | CISA Known Exploited Vulnerabilities Surged 20% in 2025 | CISA’s Known Exploited Vulnerabilities (KEV) catalog grew by 20% in 2025, including 24 vulnerabilities exploited by ransomware groups. | Exploit blog |