Aggregator
CVE-2026-28792 | tinacms up to 2.1.7 path traversal (GHSA-8pw3-9m7f-q734 / EUVD-2026-11611)
CVE-2026-31841 | Hyperterse up to 2.1.x unparsed raw web content delivery (GHSA-92gp-jfgx-9qpv)
CVE-2026-21887 | OpenCTI up to 6.8.15 server-side request forgery (GHSA-ffm6-vvph-g5f5)
CVE-2026-28356 | defnull multipart up to 1.2.1/1.3.0 multipart.py parse_options_header redos (GHSA-p2m9-wcp5-6qw3)
“Handala Hack” – Unveiling Group’s Modus Operandi
Key Findings Introduction Handala Hack, also tracked by Check Point Research as Void Manticore, is an Iranian threat actor that is known for multiple destructive wiping attacks combined with “hack and leak” operations. The threat actor operates several online personas, with the most prominent among them being Homeland Justice, maintained from mid-2022 specifically for multiple attacks […]
The post “Handala Hack” – Unveiling Group’s Modus Operandi appeared first on Check Point Research.
CVE-2026-21672 | Veeam Backup and Recovery up to 12.3.1/13.0.0 on Windows Local Privilege Escalation (kb4831 / WID-SEC-2026-0709)
Легендарный DR-DOS вернулся: версия 9.0 написана с нуля на чистом ассемблере
Hackers Use Cloudflare Human Check to Hide Microsoft 365 Phishing Pages
CipherForce
You must login to view this content
Destructive Activity Targeting Stryker Highlights Emerging Supply Chain Risks
On March 11th, medical technology company Stryker disclosed that a cyberattack had disrupted portions of its global network infrastructure, affecting Microsoft systems used across the organization.
The post Destructive Activity Targeting Stryker Highlights Emerging Supply Chain Risks appeared first on Flashpoint.
The post Destructive Activity Targeting Stryker Highlights Emerging Supply Chain Risks appeared first on Security Boulevard.
APT73
You must login to view this content
Delinea's StrongDM Acquisition Highlights the Changing Role of PAM
Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
Storm-2561 uses SEO poisoning to push fake VPN downloads that install signed trojans and steal VPN credentials. Active since 2025, Storm-2561 mimics trusted brands and abuses legitimate services. This post reviews TTPs, IOCs, and mitigation guidance.
The post Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft appeared first on Microsoft Security Blog.
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
Storm-2561 uses SEO poisoning to push fake VPN downloads that install signed trojans and steal VPN credentials. Active since 2025, Storm-2561 mimics trusted brands and abuses legitimate services. This post reviews TTPs, IOCs, and mitigation guidance.
The post Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft appeared first on Microsoft Security Blog.
Veeam warns of critical flaws exposing backup servers to RCE attacks
Qilin
You must login to view this content
Exitium New Threat Actor
You must login to view this content
Loki New Threat Actor
You must login to view this content