BlueMoon Exploit Kit Breaks Out of Chrome to Deploy Espionage Malware
Four espionage groups used a shared Chrome-to-Windows exploit chain. Build checks show current exposure; campaign artifacts support a separate compromise hunt.
Latest articles
RubyDoc Builds Let Malicious Gems Run Code on Shared Servers
More than 100 malicious gems used RubyDoc documentation builds to execute supplied code. Maintainers should review package and account changes tied to legacy API keys.
Attackers Exploit ScreenConnect Flaw to Run Files Without Host Approval
CISA confirms exploitation of CVE-2026-84869. ScreenConnect clients before 26.6.5 can transfer and run files through active sessions without authorization or host confirmation.
Attackers Exploit GitLab Flaw to Read Server Files Without a Login
An exploited GitLab flaw exposes arbitrary server files through the commits API. Self-managed operators should install 19.1.8, 19.2.6, or 19.3.2 immediately.
BigBear Phishing Bypasses Microsoft 365 MFA at 258 Organizations
CloudSEK found BigBear 2.0 stealing Microsoft 365 session cookies after MFA. Revoke sessions, rotate credentials and require phishing-resistant sign-in.
AOMEI Backup Driver Lets Local Users Rewrite Physical Disks
AOMEI Backupper 8.4.0 exposes physical-disk writes to local users. Without Secure Boot, attackers can plant UEFI code that runs before Windows defenses.
Check Point VPN Flaws Let Remote Attackers Run Code on Gateways and Servers
Two certificate-processing flaws reach gateways and management servers. Fixed takes and LivePatch output give operators a direct protection check.
Cisco Firewall Manager Breaches Led to Credential Theft and Ransomware
Attackers used Cisco Secure FMC flaws to reach root, steal credentials, tunnel into networks, deploy Cyclops Blink, and encrypt selected endpoints with Qilin.
Attackers Exploit Kestra Login Bypass That Reaches Root
Kestra OSS versions through 1.3.20 let unauthenticated requests create workflows and run commands as root inside workers. CISA confirms exploitation.
Google Patches Exploited Chrome Flaw Across Desktop and Android
Chrome 153 fixes exploited V8 out-of-bounds write CVE-2026-87491 across desktop and Android. Fleet owners should verify running builds; Google published no attack indicators.
Attackers Exploit Fortinet Flaw That Lets Crafted Packets Run Code
CISA confirmed exploitation of CVE-2025-25249 across FortiOS, FortiSwitchManager and FortiSASE, with federal remediation due September 12.
CISA Links WatchGuard Firebox Code-Execution Flaw to Ransomware Campaigns
CISA now links CVE-2025-14733 to ransomware. Patch exposed Fireboxes, check WatchGuard's indicators, and rotate locally stored secrets after confirmed activity.
Attackers Exploit NetScaler Flaw to Bypass Authentication
Customer-managed VPN and AAA appliances need branch-specific fixed builds; configuration determines exposure on later NetScaler releases.