Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.243 voci in archivio · mostrate 701–725 .
Foxconn Confirms Cyberattack: Nitrogen Ransomware Gang Claims 8TB Stolen From North American Plants
Foxconn has confirmed a ransomware attack on its North American factories after the Nitrogen gang claimed to have stolen 8TB of data including technical drawings and network topology maps tied to AMD, Intel, and Google projects.
CISA Adds CVE-2026-32202 to KEV Catalog as APT28 Actively Exploits Zero-Click Windows Shell Flaw
CISA has added CVE-2026-32202, a zero-click Windows Shell authentication coercion flaw, to its KEV catalog following confirmed active exploitation by Russia’s APT28 group. The April 2026 Patch Tuesday update remediates the vulnerability; FC…
PoC Exploit Released for Android Zero-Click CVE-2026-0073 — Silent ADB Shell Access on Android 14–16
A public PoC exploit for CVE-2026-0073 enables any network-local attacker to gain a full ADB shell on unpatched Android 14–16 devices with zero user interaction, exploiting a cryptographic type confusion bug in Android’s adbd daemon. Google…
Critical Palo Alto PAN-OS Vulnerability CVE-2026-0300 Actively Exploited — Unauthenticated Root RCE on Firewalls
Palo Alto Networks is warning of a critical CVE-2026-0300 buffer overflow in PAN-OS Captive Portal that enables unauthenticated root-level remote code execution on PA-Series and VM-Series firewalls. Active exploitation is confirmed; patches…
Microsoft Patch Tuesday May 2026: 120 Vulnerabilities Fixed, Including 29 Critical RCE Flaws
Microsoft’s May 2026 Patch Tuesday delivers fixes for 120 vulnerabilities including 29 Critical-rated remote code execution flaws across Windows, SharePoint, Dynamics 365, and Office. No active zero-days are reported, but the breadth of cri…
GhostLock: New Attack Technique Locks Enterprise Files Like Ransomware — Without Any Encryption
GhostLock is a newly disclosed attack technique that uses standard Windows file-locking behavior to paralyze enterprise SMB file shares without encrypting a single byte. Requiring only a standard domain user account, it evades every convent…
ShinyHunters Breaches Canvas LMS: Student Data from 9,000 Schools Exposed in Extortion Campaign
ShinyHunters has breached Instructure’s Canvas LMS by exploiting the Free-For-Teacher account program, exposing data from an estimated 285 million users across 9,000 schools including Harvard, MIT, and Oxford. Instructure confirmed exposure…
Operation SilentCanvas: Hackers Hide PowerShell Malware in Fake JPEG to Deploy Trojanized ScreenConnect Backdoor
Operation SilentCanvas is a new Windows attack campaign that hides a PowerShell script inside a fake JPEG file to deploy a trojanized ScreenConnect backdoor. The multi-stage infection chain includes a fileless UAC bypass, AMSI evasion, on-h…
Hackers Deploy AI-Generated Zero-Day Exploit to Bypass 2FA — Google GTIG Q2 2026 Report
Google’s Threat Intelligence Group reveals that cybercriminals have used AI to develop a working zero-day exploit targeting a web administration platform’s 2FA logic. The Q2 2026 report also documents PROMPTSPY Android malware powered by Ge…
Let’s Encrypt Halts All Certificate Issuance After Cross-Signed Root Certificate Incident
Let’s Encrypt temporarily suspended all certificate issuance on May 8, 2026, after engineers identified a critical issue with a cross-signed certificate linking its Generation X root to its upcoming Generation Y root infrastructure. Service…
Microsoft Patches Three Critical Information Disclosure Vulnerabilities in Microsoft 365 Copilot and Edge
Microsoft has disclosed and fully remediated three critical information disclosure vulnerabilities — CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111 — affecting Microsoft 365 Copilot and Copilot Chat in Microsoft Edge. All three flaws we…
TCLBANKER Banking Trojan Spreads Through Self-Replicating WhatsApp and Outlook Worm Modules
A highly sophisticated Brazilian banking trojan called TCLBANKER (campaign REF3076) has been uncovered by Elastic Security Labs. The malware uses a legitimate signed Logitech installer via DLL side-loading, monitors 59 financial websites, s…
Three Critical cPanel and WHM Vulnerabilities Enable Code Execution, File Reads, and DoS Attacks
cPanel has disclosed three critical security vulnerabilities — CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203 — affecting its widely deployed cPanel & WHM web hosting control panel and WP Squared platform. The flaws, patched on May 8, 2…
InstallFix: Hackers Use Fake Claude AI Installer Pages and Google Ads to Deploy RedLine Stealer Malware
A malware campaign called InstallFix is using paid Google Ads to push fake Claude AI installation pages to the top of search results, tricking users into running malicious commands that deploy a multi-stage attack chain linked to RedLine St…
CallPhantom: 28 Fake Android Apps with 7.3 Million Downloads Sold Fabricated Call History Data on Google Play
Security researchers at ESET uncovered the CallPhantom campaign — 28 fraudulent Android apps on Google Play that accumulated over 7.3 million downloads by falsely promising access to any phone number call history. The apps delivered entirel…
Five Critical Redis Vulnerabilities Enable Remote Code Execution Across All Editions — Patch Now
Redis has disclosed five high-severity vulnerabilities (CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, CVE-2026-23631) affecting Redis Cloud, Redis Software, and all open-source community editions. The flaws include use-aft…
WatchGuard Agent Vulnerabilities Allow Attackers to Escalate to Full SYSTEM Privileges on Windows
WatchGuard has released urgent security updates patching four high-severity vulnerabilities in the WatchGuard Agent for Windows, including chained CVE-2026-6787 and CVE-2026-6788 flaws (CVSS 8.5) that grant NT AUTHORITY\SYSTEM access, and n…
NVIDIA GeForce NOW Data Breach at GFN.AM: Personal Data of Users Exposed in 54-Day Unauthorized Access Incident
A data breach at GFN.AM, an authorized NVIDIA GeForce NOW cloud gaming provider, has exposed personal information including email addresses, phone numbers, dates of birth, and full names of registered users. The unauthorized access began on…
AI Supply Chain Attack: 575+ Malicious Skills on Hugging Face and ClawHub Deliver Trojans, Cryptominers, and AMOS Stealer
Threat actors have uploaded 575+ malicious AI skills to ClawHub’s OpenClaw ecosystem and abused Hugging Face repositories to deliver trojans, cryptominers, and AMOS Stealer. The campaign uses indirect prompt injection to weaponize AI agents…
ZiChatBot: OceanLotus APT Uses Zulip Chat APIs as Covert Command and Control in PyPI Supply Chain Attack
A newly discovered malware called ZiChatBot abuses Zulip REST APIs for command and control, hiding malicious traffic as legitimate chat communications. Linked to the OceanLotus (APT32) threat group, the campaign spread through three malicio…
Critical Next.js and React Server Components Vulnerabilities: SSRF, DoS, and Middleware Bypass Patched
Vercel has released a sweeping set of security advisories for Next.js addressing more than a dozen vulnerabilities including denial-of-service, SSRF via WebSocket upgrades, and middleware bypass flaws. All teams running Next.js App Router o…
UAT-8302: China-Nexus APT Uses Custom Malware and Open-Source Tools to Steal Data From Government Agencies
Cisco Talos has detailed UAT-8302, a China-nexus APT group conducting long-term espionage campaigns against government agencies in southeastern Europe. The group blends custom backdoors like NetDraft and CloudSorcerer with open-source tools…
New Ivanti EPMM Zero-Day CVE-2026-6973 Actively Exploited — Patch Immediately
Ivanti has confirmed active exploitation of CVE-2026-6973, a new zero-day vulnerability in its on-premises Endpoint Manager Mobile (EPMM) product. The flaw requires admin authentication and is part of a May 2026 security advisory covering m…
Dirty Frag: New Linux Kernel Vulnerability Chains Two Flaws to Grant Root Privileges — Public PoC Released
A newly disclosed Linux kernel vulnerability dubbed Dirty Frag chains two page-cache write flaws to achieve full root access on virtually all major Linux distributions. A public PoC exploit is already in the wild following an embargo break…
Massive 2.45 Billion-Request DDoS Attack Uses 1.2 Million IPs to Defeat Rate Limiting in “Low and Slow” Campaign
DataDome researchers have documented a record-scale DDoS attack that delivered 2.45 billion malicious requests over five hours using 1.2 million unique IP addresses across 16,402 ASNs. Each source averaged just one request per nine seconds…