Ransomware Campaigns Exploit SharePoint Flaw to Run Server Code
CISA now links CVE-2026-45659 to ransomware. Check exact SharePoint builds, then investigate whether low-privilege access reached the farm before patching.
Reader edition
The Feed
Windows Plug and Play Gives Crafted Devices SYSTEM Access
Researchers chain signed Windows device installers into SYSTEM execution through emulated USB hardware or an ordinary RDP session.
Fake Web3 Interview Steals Wallet Keys Through Signed Windows App
A signed ClickOnce app delivered two stealers and an hVNC RAT after a fake Web3 interview. Hunt per-user ClickOnce records, then rotate every secret reachable from affected hosts.
Attackers Exploit Windows Driver to Gain SYSTEM Privileges
Microsoft's August updates fix an AFD.sys race used in attacks; defenders must verify fixed builds and investigate pre-patch privilege escalation.
Stolen AI API Key Leaves One Company With Nearly $1 Million Bill
Unit 42 says stolen AI API keys can reach gray-market proxy services within minutes, turning one exposed credential into catastrophic usage charges.
NetScaler SAML Flaw Lets Remote Attackers Run Code as Root
Public research turns a patched NetScaler memory overflow into a root-code-execution risk for SAML deployments, making build verification urgent.
RingCentral Breach Exposes 1.6 Million Account Records
Customer contact data is public after a social-engineering breach; defenders should harden support and identity checks against targeted impersonation.
WordPress Image Upload Flaw Lets Authors Run Server Code
CVE-2026-65640 reaches Ghostscript on sites using Imagick; WordPress 7.0.4 and exact backports move content checks ahead of image processing.
Microsoft Fixes LegacyHive Flaw That Gives Local Attackers Admin Rights
August Windows updates fix a public registry-hive privilege escalation; defenders can hunt its staging files, virtual paths, and unusual DLL loads.
Attackers Exploit Cisco VPN Requests to Reload Firewalls
Exposed ASA and FTD remote-access services need release-specific hot fixes; Cisco offers no workaround for the exploited denial-of-service flaw.
Two SharePoint Flaws Chain Into Unauthenticated Server Code Execution
Rapid7 joined a SharePoint identity bypass to unsafe .NET type creation. August's cumulative updates complete Microsoft's two-cycle fix.
Gunra Steals Cloud Data and Deletes Backups Before Encryption
Government agencies traced Gunra from exploited edge devices through credential theft, cloud exfiltration, backup deletion, and cross-platform ransomware.
CISA Confirms Exploitation of LoadMaster Command Injection
CISA confirms exploitation of a pre-authentication LoadMaster command-injection flaw. API-enabled appliances need a fixed release and an exposure review.