Active Vulnerability Exploitation
Articles on active exploitation of newly disclosed vulnerabilities, including zero-day attacks, memory disclosure bugs, and rapid weaponization of published CVEs by threat actors.
The Supply-Chain Time Bomb AI Cybersecurity Tools Just Uncovered
Dan Lorenc, CEO of Chainguard and leader of the new Athena coalition, warns of a 'messy' summer as AI uncovers thousands of hidden open-source vulnerabilities. A newly formed group of two dozen companies—including BNY, Cisco, Cloudflare, Docker, and PwC—is rushing to coordinate patching before attackers exploit the flood of disclosures.
Russia's Gamaredon APT Is Rewriting the Rules of Cyber Espionage in Ukraine
Russian state-sponsored cyber espionage group Gamaredon has significantly improved its tactics, techniques, and procedures (TTPs), becoming more effective in Ukraine cyber warfare. The group developed new PowerShell downloaders, advanced C2 infrastructure concealment using Cloudflare tunneling and dead drops, and USB-borne malware vectors. ESET tracked 35 spear-phishing campaigns against Ukraine in 2025, with the group collaborating with Turla APT to provide initial access for exploitation frameworks.
How GhostApproval Symlink Hacks Threaten Artificial Intelligence AI Cybersecurity
Six widely-used AI coding agents were found susceptible to a 'systematic vulnerability' that tricks them into accessing sensitive files via manipulated symbolic links, leading to potential remote code execution.
GitHub's Public APIs Become Enterprise Reconnaissance Target via Ghost Account Campaigns
Datadog Security researchers uncovered a sustained campaign using GitHub's public APIs and dormant ghost accounts to profile enterprise software environments, mapping organizations, members, and repositories while blending into normal developer activity patterns.
How AI Cybersecurity Threats Evolved: Mount Royal University Breach Shows Ransomware's New Playbook
Mount Royal University confirms hackers stole data from file storage systems and then deleted copies to disrupt recovery, following a breach claimed by the CMD Organization extortion group demanding 30 BTC ransom.
Zero-Day ColdFusion Flaw Hit by Attackers Hours After Adobe Disclosure
Attackers are exploiting a CVSS 10.0 path-traversal vulnerability in Adobe ColdFusion (CVE-2026-48282) within hours of patch release, prompting CISA to add it to its KEV catalog and issue a federal mandate under BOD 26-04.
Inside ARToken: How Artificial Intelligence Powers the Next Generation of EvilTokens Phishing
A new phishing-as-a-service platform called ARToken appears to operate as an affiliate of the EvilTokens toolkit, revealing extensive capabilities for stealing Microsoft 365 tokens, establishing persistent access via Primary Refresh Tokens, and automating business email compromise operations with artificial intelligence.
When AI Writes Malware: How DeepSeek's Browser Ransomware Blueprint Changed the Threat Landscape
Check Point researchers uncovered a DeepSeek-generated malware sample that can be weaponized into browser-based ransomware with minimal effort, exposing a new frontier in artificial intelligence cybersecurity threats.
From Hackers to Hives: Qihoo 360 Deploys Multi-Agent Swarms to Challenge American AI Dominance
As U.S. export restrictions block international access to Anthropic's Mythos, Chinese cybersecurity veteran Qihoo 360 has unveiled 'Tulongfeng,' an autonomous multi-agent vulnerability-discovery swarm designed to bypass China's trailing LLM capabilities and secure technical parity.
The GitLost Loophole: Turning Public GitHub Issues Into Secret Data Exfiltration Pipelines
A deep dive into the GitLost vulnerability, where researchers at Noma Security demonstrated how prompt injection attacks over GitHub's Agentic Workflows allow unauthenticated actors to retrieve private repository files by opening public issues.
CitrixBleed Strikes Again: Attackers Weaponize NetScaler Memory Leak Within Hours
Attackers wasted little time targeting the latest memory disclosure bug in Citrix NetScaler, exploiting a vulnerability that leaks sensitive data from server memory shortly after researchers published their findings.