Critical UniFi OS bug lets hackers gain root without authentication
Attackers can chain three already fixed vulnerabilities in the Ubiquiti UniFi OS server to execute remote code with root privileges and without authentication. [...]
Ameaças Cibernéticas
1630 notíciasCritical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a case of…
Silent Ransom Group Uses Fast Flux Botnet to Hide Law Firm Leak Sites
Cybersecurity firm Resecurity reports Silent Ransom Group is using a fast flux botnet to hide data leak sites while targeting law firms with theft and vishing.
⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
Monday again. The weekend was meant to be quiet. It wasn't. Last week had poisoned packages, a broken AI helper, and a worm tearing through repos. The ugly part: basic tricks still worked. A chatbot got fooled. A bot token got leaked inside the malware. The same old mistakes sho…
Check Point links VPN zero-day attacks to Qilin ransomware gang
Israeli cybersecurity company Check Point has released security updates to patch a critical flaw affecting Remote Access VPN and Mobile Access deployments, which was exploited in zero-day attacks. [...]
AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload
Phishing has always been a numbers game. AI has turned it into a volume machine. Attackers can now create convincing emails, fake login pages, and tailored lures in minutes. Every polished message adds another case for Tier 1 to review, another link to inspect, and another alert…
The Hardest Fork
Mythos is real. I know a big chunk of the industry thinks it's a marketing stunt, and I get why. I get it. But I've seen the findings, and they're bad. These aren't "whoops, this line right here is wrong, and that's RCE." They're novel combinations of a few dozen issues out of th…
Malware Android usa falsos leitores de PDF para espionar vítimas
Um spyware para Android chamado Asin está mirando usuários por meio de aplicativos falsos que prometem notícias, leitura de PDF e mapas de conflitos. A campanha foi identificada pela ESET e vem sendo observada em diferentes ondas desde o início de 2025. Os operadores criaram site…
CISA alerta para falha explorada ativamente no SolarWinds Serv-U
A CISA alertou que uma vulnerabilidade crítica no SolarWinds Serv-U está sendo explorada ativamente em ataques. A falha, rastreada como CVE-2026-28318, afeta o software de transferência de arquivos usado por empresas para operações como FTP, SFTP e compartilhamento seguro de dado…
Chrome corrige 429 vulnerabilidades e amplia pressão sobre equipes de cibersegurança
O Chrome 149 recebeu correções para 429 vulnerabilidades, o maior volume já registrado em uma única versão do navegador. O número chama atenção não apenas pelo tamanho do pacote, mas pelo que representa para equipes de segurança responsáveis por manter ambientes corporativos atua…
VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as well as two other malware families codenamed PLENET (aka GRIMBOLT) and AGENTPSD to target Linux systems. The activity has been attributed by Volexity to a thre…
UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign
Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Go…
Over 20,000 Instagram accounts stolen in Meta AI support hack
Meta has revealed that over 20,000 Instagram users had their accounts hijacked in a recent incident where attackers used Meta's AI-powered support system to reset passwords. [...]
Número de contas maliciosas quase dobrou, diz Anthropic
A Anthropic publicou, no último dia 3, uma análise que mapeia 832 contas associadas a atividades maliciosas ao longo de um ano, entre março de 2025 e março de 2026, segundo relatório assinado pelos pesquisadores Kyla Guru, Alex Moix e Jacob Klein. O estudo revelou que o percentua…
C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures. [...]
Containers Linux: CISA alerta para exploração ativa
A agência de cibersegurança dos Estados Unidos (CISA) reportou a exploração ativa de uma falha no kernel Linux que permite a invasores escapar de containers e assumir o controle dos sistemas hospedeiros, conforme comunicado da própria agência publicado no último dia 5. A vulnerab…
Silent Ransom Group targets law firms with fake IT support calls
The Silent Ransom Group extortion gang is actively targeting U.S. law firms and professional services organizations in social engineering attacks that often lead to data theft within hours of initial contact, according to a new report by cybersecurity firm Mandiant. [...]
Derrubada do XSS criou quatro plataformas de cibercrime
O ecossistema do cibercrime de língua russa, antes centralizado no fórum XSS (desarticulado pela Europol em julho de 2025), fragmentou-se em quatro plataformas concorrentes, segundo relatório da Flashpoint divulgado no dia 3 deste mês. O fórum original, que por mais de 20 anos fo…
New Pink Extortion Group Targets Microsoft 365 Cloud Data Via Vishing Scams
Cybersecurity researchers are warning businesses about Pink Extortion Group, a threat actor that uses voice phishing to bypass multi-factor authentication and steal files from cloud environments.
Critical Everest Forms Pro flaw exploited to take over WordPress sites
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin, which lets them take complete control of a WordPress website. [...]