CARBONATO Turns Exposed Docker Hosts Into an AI-Assisted Credential Theft Network
CARBONATO exploits exposed Docker APIs to deploy privileged containers, persist via SSH, and use AI agent GH0ST to steal AI API keys.
CyberWorldOps
Latest news
More news
Page 28 / 91 · 822 articles
Active Roundcube Attacks Put Pre-Login SQL Injection at the Top of Patch Queues
Attackers exploit CVE-2026-48842, a pre-auth Roundcube SQL injection. Learn affected versions 1.6.x, 1.7.x and how to patch now.
CISA Adds Two Exploited Flaws to KEV and Gives Federal Agencies Three Days to Patch
CISA added CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to KEV with Sept 27 patch deadline amid active exploitation.
Malicious Graphics Files Put Siemens Desigo CC Clients at Risk of Code Execution
CVE-2026-34223 lets malicious Desigo CC graphics execute scripts, write files to clients, risking workstation compromise and lateral movement.
ClickFix Turns Legitimate Websites and System Tools Into a Malware Delivery Chain
ClickFix tricks users into running malicious commands via fake Cloudflare checks, using 17,000+ infected sites, blockchain redirects and OS-specific lures.
Phone Spoofing Helped Intruders Breach Astrana Health Servers
Astrana Health disclosed a breach where attackers spoofed its main number to impersonate staff and gain server access, possibly stealing confidential data.
Exploited TeamCity RCE Puts Build Servers in the Ransomware Crosshairs
Critical TeamCity flaw CVE-2026-63077 allows pre-auth RCE and is exploited in ransomware attacks. Learn affected versions, risks, and patch guidance.
CISA Withdraws Critical Mendix Runtime Alert After Siemens Finds No Vulnerability
Siemens found the reported Mendix Runtime behavior was expected, not a vulnerability. CISA withdrew the alert and rejected CVE-2026-7891.
Roundcube Servers Face Active Attacks Through Pre-Login Database Injection
Roundcube CVE-2026-48842 is under active exploit, enabling pre-login SQL injection via virtuser_query. Patch to 1.6.16 or 1.7.1 immediately.