Alert

Attackers are misusing MikroTik routers through their Secure Shell (SSH) service, which can be accessed from the internet, to take full control without logging in, as per CERT Polska’s warning released on September 5. Successful attacks started on at least September 2. The Hacker News review on September 6 found …

Over 14,000 Dahua security cameras connected to the internet have been hacked in a 35-day online attack that affected devices around the world. This shows the rising danger of unsafe and unprotected surveillance systems. Researchers at Hunt.io found the operation by looking into a public directory with 2,616 files related …

Google has updated the Chrome browser to fix a serious security issue in the V8 engine and 11 other flaws. The security flaw, called CVE-2026-85046, is a type confusion. Researcher Salvatore Gulizia, known as “Serotav,” told Google about it. The update makes Chrome version 152.0.7977.82/.83 for Windows and macOS, and …

SonicWall unveiled advisory SNWLID-2026-0016 on September 1, 2026. It states that two SMA1000 flaws are being actively exploited. The main issue, CVE-2026-83548, is a pre-authentication SSRF with a top score of 10.0 CVSS. The second issue, CVE-2026-83549, allows remote code execution after authentication. Why It Matters SMA1000 devices act as …

Almost 22,000 Microsoft Exchange servers are online and still vulnerable to a flaw that lets attackers access all user mailboxes. Tracked as CVE-2026-62911 and reported by Orange Tsai from DEVCORE Research Team, this security flaw impacts Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) software. “Authentication bypass …

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed two flaws in PaperCut NG and PaperCut MF in its Known Exploited Vulnerabilities (KEV) Catalog. They warn that hackers are using these flaws in real attacks. The flaws with PaperCut, known as CVE-2026-81578 and CVE-2026-82078, can be linked together. This …

The researchers discovered Fire Ant’s new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. According to incident response company Sygnia, The threat actor moved from attacking VMware hypervisors to breaking …

Many serious security flaws have been found in WordPress plugins and themes, such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These issues could let hackers bypass login, take over accounts, and run any code. The vulnerabilities, according to Wordfence and Patchstack, are listed below: CVE-2026-76581 (CVSS score: 9.8): …

ServiceNow issued security updates for three new serious AI Platform problems that can be used in code injection, SQL injection, and privilege escalation attacks. The ServiceNow AI Platform, which was once called the Now Platform, is a strong Platform-as-a-Service (PaaS). It helps add AI to important business tasks and supports …

Threat actors have already compromised more than 270 Zimbra instances in attacks that let them run code remotely. These attacks focus on a serious flaw in the Zimbra Collaboration Suite (ZCS). Synacor fixed the security flaw (called CVE-2026-73570). This flaw lets attackers run code from far away by using a …