Explore

Rapid Read Rapid Read
Critical FortiClient EMS Vulnerability Exploited in New Cyber Attacks

Critical FortiClient EMS Vulnerability Exploited in New Cyber Attacks

A critical vulnerability in FortiClient Endpoint Management Server (EMS), identified as CVE-2026-35616, has been exploited in recent cyber attacks to deploy information-stealing malware. The flaw, which allows remote code execution without authentication, was patched by Fortinet in April. However, unpatched systems are being targeted by a campaign deploying the EKZ Infostealer, disguised as a fake Fortinet endpoint patch. Attackers have used FortiClient's management pathways to execute malicious PowerShell commands, mimicking legitimate operations. The malware targets browsers like Chrome, Microsoft Edge, and Firefox to steal credentials, cookies, and autofill data, which are then exfiltrated over HTTP.
Trendline Trendline
Critical FortiClient EMS Vulnerability Exploited in New Malware Attacks

Critical FortiClient EMS Vulnerability Exploited in New Malware Attacks

Critical FortiClient EMS Vulnerability Exploited in New Malware Attacks
Trendline Trendline
Carnival Corp Discloses Data Breach Affecting Personal Information

Carnival Corp Discloses Data Breach Affecting Personal Information

Carnival Corp Discloses Data Breach Affecting Personal Information
Rapid Read Rapid Read
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day

CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent call for federal agencies to patch a critical vulnerability in the LiteSpeed user-end plugin for cPanel. The vulnerability, identified as CVE-2026-48172, is a privilege escalation issue that allows attackers to execute arbitrary scripts with root privileges. LiteSpeed has already addressed the flaw in version 2.4.5 of the plugin, but it has been actively exploited as a zero-day vulnerability. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and is urging agencies to patch or remove the vulnerable plugin versions by May 29, in accordance with Binding Operational Directive 22-01.
Trendline Trendline
Carnival Corporation Discloses Cybersecurity Breach Affecting Millions

Carnival Corporation Discloses Cybersecurity Breach Affecting Millions

Carnival Corporation Discloses Cybersecurity Breach Affecting Millions
Rapid Read Rapid Read
Gitea Vulnerability Exposes 30,000 Deployments to Potential Attacks

Gitea Vulnerability Exposes 30,000 Deployments to Potential Attacks

A significant security vulnerability has been identified in Gitea, an open-source, self-hosted Git service, which could have allowed unauthorized attackers to access private container images from over 30,000 deployments. The flaw, tracked as CVE-2026-27771, is an access control issue affecting Gitea’s built-in container registry. This vulnerability, which also impacts Forgejo and potentially other Gitea-derived forks, allowed unauthenticated users to pull private images as if they were public. The issue persisted in Gitea’s code for approximately four years before being patched in version 1.26.2. According to AI pentesting firm NoScope, a Shodan search revealed over 34,000 internet-facing Gitea instances, with about 93% likely vulnerable. The flaw could expose sensitive information such as source code and production infrastructure details, posing a significant risk to affected organizations.
Rapid Read Rapid Read
Hackers Exploit KnowledgeDeliver Zero-Day Vulnerability, Deploy Web Shells

Hackers Exploit KnowledgeDeliver Zero-Day Vulnerability, Deploy Web Shells

Hackers have exploited a zero-day vulnerability in the KnowledgeDeliver learning management system (LMS), as reported by Google-owned Mandiant. This system, developed by Digital Knowledge, is primarily used in Japan for enterprise and educational e-learning. The vulnerability, identified as CVE-2026-5426 with a CVSS score of 7.5, arises from the use of a standardized 'web.config' file containing hardcoded 'machineKey' values. These keys are crucial for data encryption and signing within the ASP.NET framework. The exploitation allowed threat actors to perform ViewState deserialization attacks, leading to remote code execution. The attackers deployed Godzilla web shells, also known as Bluebeam, which enabled them to execute additional commands and payloads on compromised systems. The attack involved modifying access permissions and injecting malicious scripts into application JavaScript files, ultimately leading to the installation of a Cobalt Strike backdoor.
Trendline Trendline
Hackers Exploit KnowledgeDeliver Zero-Day Vulnerability, Threatening Enterprise Security

Hackers Exploit KnowledgeDeliver Zero-Day Vulnerability, Threatening Enterprise Security

Hackers Exploit KnowledgeDeliver Zero-Day Vulnerability, Threatening Enterprise Security
Trendline Trendline
GitHub Actions Exploited by Megalodon Attack, Affecting 5,500 Repositories

GitHub Actions Exploited by Megalodon Attack, Affecting 5,500 Repositories

GitHub Actions Exploited by Megalodon Attack, Affecting 5,500 Repositories
Rapid Read Rapid Read
7-Eleven Data Breach Affects Over 185,000 Individuals

7-Eleven Data Breach Affects Over 185,000 Individuals

A data breach at 7-Eleven has potentially impacted over 185,000 individuals, according to a report by HaveIBeenPwned. The breach, which occurred in April, involved the theft of personal information such as names, addresses, and email addresses from systems containing franchise documents. The extortion group ShinyHunters claimed responsibility, demanding a ransom and later selling the data on a Russian hacking forum. The breach highlights vulnerabilities in 7-Eleven's data security, particularly concerning Salesforce records.
Rapid Read Rapid Read
Iranian Hackers Blamed for Los Angeles Transit System Breach

Iranian Hackers Blamed for Los Angeles Transit System Breach

Security researchers have attributed a March cyberattack on the Los Angeles County Metropolitan Transportation Authority (LACMTA) to Iranian-backed hackers. The group, known as Ababil of Minab, claimed responsibility for the breach, which involved stealing and deleting data from the transit system's networks. The hackers are believed to be linked to Iran's Ministry of Intelligence and State Security. This incident is part of a broader pattern of increased cyber activities by Iranian-linked groups targeting U.S. infrastructure.
Trendline Trendline
7-Eleven Data Breach Impacts Over 185,000 Individuals

7-Eleven Data Breach Impacts Over 185,000 Individuals

7-Eleven Data Breach Impacts Over 185,000 Individuals