Tag: Cybersecurity Threat Advisory
Cybersecurity Threat Advisory: Critical PHP2Shell RCE vulnerabilities
PHP recently shipped an out-of-cycle emergency release fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and can allow unauthenticated attackers to run code on vulnerable web servers. The...
Cybersecurity Threat Advisory: Trojanized PuTTY installers target IT admins
Threat actors are using malicious Google Search ads to distribute weaponized PuTTY installers that target IT administrators. These ads direct victims to fake websites that mimic legitimate PuTTY download pages. Once installed, the trojanized software deploys malware that enables remote...
Cybersecurity Threat Advisory: ConnectWise Cloud Backup compromise
ConnectWise Cloud Backup (formerly SkyKick) has confirmed unauthorized access to application credentials used by its backup platform. Attackers reportedly used the compromised credentials to access Microsoft 365 tenants where the application was installed. As a result, they may have gained...
Cybersecurity Threat Advisory: Ivanti Connect Secure zero-day exploited in active attacks
Researchers have identified CVE-2026-104935, a high-severity authentication bypass and remote code execution (RCE) vulnerability affecting Ivanti Connect Secure (ICS) VPN appliances. The vulnerability is being actively exploited in the wild and allows attackers to execute arbitrary commands without credentials or...
Cybersecurity Threat Advisory: Milk Dragon AiTM phishing kit
Security researchers have identified Milk Dragon (also known as NaiLong), a Phishing-as-a-Service (PhaaS) platform being used in large-scale social media fraud campaigns. By impersonating well-known brands and using realistic online shopping experiences, the threat enables attackers to steal payment card...
Cybersecurity Threat Advisory: Critical SonicWall SMA1000 vulnerabilities
Barracuda Managed XDR’s Security Operations Center has observed increased scanning and profiling of internet-exposed SonicWall SMA 1000 Series appliances following the disclosure of four new vulnerabilities, including a critical pre-authentication server-side request forgery (SSRF) flaw (CVE-2026-102255, CVSS 10.0). Although SonicWall...
Cybersecurity Threat Advisory: TrustSink attack targets Microsoft Entra ID
TrustSink is an attack technique that abuses Microsoft Entra ID’s federated trust model. It uses a rogue MFA provider to intercept user credentials during legitimate login attempts. The attack captures plaintext passwords in real time without the user’s knowledge. Attackers...
Cybersecurity Threat Advisory: Citrix NetScaler vulnerabilities
Attackers are actively exploiting two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Citrix confirmed the vulnerabilities, CVE-2026-88771 and CVE-2026-88772, on September 27. Both flaws enable remote code execution, and attackers have used them to deploy web shells and...
Cybersecurity Threat Advisory: Ransomware exploits Confluence servers
Feral Wolf has targeted Russian organizations through exposed Confluence servers, insecure 1C configurations, and compromised contractors, ultimately deploying ransomware. The campaign exploited the Atlassian Confluence vulnerability CVE-2023-22515. What is the threat? Feral Wolf is a financially motivated ransomware group that...
Cybersecurity Threat Advisory: WordPress Click2Shell flaw enables RCE
Researchers have disclosed a WordPress exploit chain known as Click2Shell, which was addressed in WordPress 7.1.1 as part of a security release containing 11 fixes. When combined with vulnerabilities in affected themes, the attack can lead to remote code execution...
