Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
Disguising Command-and-Control: How DragonForce Exploits Microsoft Teams Relays
An investigation into the techniques used by the DragonForce ransomware gang, specifically their utilization of a custom 'Backdoor.Turn' malware to tunnel malicious traffic through Microsoft Teams relay infrastructure. Includes verified attack chain details, BYOVD evasion techniques, and Backdoor.Turn capabilities from Symantec research.
New CTP Vulnerability Allows Remote Speaker Control and Device Infection
A newly discovered vulnerability in the CTP protocol enables attackers to compromise speakers via Bluetooth or USB, potentially leading to unauthorized control and further device infection.
CISA Orders Agencies to Patch Critical Check Point VPN Flaw
CISA has mandated that U.S. government agencies patch a critical vulnerability in Check Point security gateways following reports of its exploitation in zero-day attacks by the Qilin ransomware gang.
The 'Sender' Spoofing Vulnerability: Misconfiguration Exploitation
An exploration of widespread email spoofing vulnerabilities stemming from misconfigured SPF, DKIM, and DMARC settings, and how attackers are actively exploiting these gaps in the wild. Ensuring robust and proactive email security posture by effectively managing and enforcing authentication protocols is more critical than ever.
Researcher 'Nightmare-Eclipse' Weaponizes Defender in RoguePlanet PoC
Security researcher 'Nightmare-Eclipse' has released a new proof-of-concept (PoC) exploit dubbed 'RoguePlanet,' which targets a Windows privilege escalation vulnerability by weaponizing Microsoft Defender's quarantine mechanism. This release continues an ongoing feud between the researcher and Microsoft, following allegations of intimidation regarding previous public vulnerability disclosures.
How ShinyHunters Turned a PeopleSoft Zero-Day Into the Biggest University Heist of 2026
Oracle PeopleSoft zero-day CVE-2026-35273 exploited by ShinyHunters against 300+ university instances.
CISA Alerts: Hackers Actively Exploiting SolarWinds Serv-U Flaw (CVE-2026-28318)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are actively exploiting a recently patched high-severity vulnerability in SolarWinds Serv-U to crash file transfer servers. This denial-of-service flaw allows unauthenticated remote attackers to take down Serv-U services using specially crafted POST requests.
Microsoft Patches Exchange Server Zero-Day CVE-2026-42897 Exploited in Active Attacks
Microsoft has patched CVE-2026-42897, a high-severity spoofing vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition that allows remote attackers to execute arbitrary JavaScript in cross-site scripting attacks against Outlook Web Access users.
Cisco SD-WAN Zero-Day (CVE-2026-20245) - Root Privilege Escalation Vulnerability
High-severity unpatched vulnerability in Cisco Catalyst SD-WAN Manager actively exploited for root privilege escalation. CVE-2026-20245 enables attackers to escalate privileges, install backdoors, and manipulate network traffic. Immediate mitigation steps and patch timeline.
"Sender" Email Spoofing Vulnerability: How Exchange Misconfiguration Enables Active Attacks
Detailed analysis of the Sender email spoofing vulnerability exploiting Exchange Server misconfigurations, including active exploitation evidence and remediation guidance.
Check Point links VPN zero-day attacks to Qilin ransomware gang
Israeli cybersecurity company Check Point has released security updates to patch a critical flaw affecting Remote Access VPN and Mobile Access deployments, which was exploited in zero-day attacks linked to the Qilin ransomware gang.
Max Severity Ivanti Sentry Vulnerability Now Exploited in Attacks
Attackers are now targeting CVE-2026-10520, a recently patched maximum-severity flaw in Ivanti Sentry that allows remote code execution with root privileges on Internet-exposed secure mobile gateways.