Researchers found an open server hosting a DoNot APT toolkit targeting Pakistan nuclear, power grid, and ICS networks with Inveigh and Go shells.

Related Posts:

• Lone Hacker Uses BOSSAI Attack Mesh to Breach Taiwan Emergency Services and Universities
• French Blood Bank Cyberattack Hits Plasma Storage
• APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits

The post Exposed Server Reveals DoNot APT Toolkit Targeting Pakistan Nuclear and Energy Sectors appeared first on Daily CyberSecurity.

A proof-of-concept exploit for CVE-2026-97798, a Windows Error Reporting vulnerability, gives a SYSTEM shell. Install the October 2026 update now.

Related Posts:

• QNAP Warns NAS Users as Exploited Plex2Shell Vulnerabilities Hit Plex Media Server
• WP Duplicate Vulnerability CVE-2026-123751 Exploited in the Wild, No Patch Available
• PoC Published for Hugging Face Datasets RCE CVE-2026-57845 (CVSS 8.8) in Library With 38 Million Monthly Downloads

The post PoC Exploit and Technical Details Published for Windows Error Reporting Flaw CVE-2026-97798 appeared first on Daily CyberSecurity.

Technical details and PoC exploit code for the critical Penpot file takeover flaw are now public. Upgrade to version 2.18.0 now.

Related Posts:

• Attackers Exploit SonicWall SonicOS SSLVPN Flaw CVE-2026-19868 in the Wild
• Veeam Releases Kernel Updates to Fix Critical CVE-2026-98432 Flaw Across Backup Appliances
• JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA

The post Penpot File Takeover Flaw Details and PoC Exploit Publicly Disclosed appeared first on Daily CyberSecurity.

Sekoia uncovered an APT29 watering hole campaign mobile exploits operation using Plerdy analytics and watering holes to compromise unpatched phones.

Related Posts:

• Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
• mSecure Security Notification Prompts Password Resets
• Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks

The post APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits appeared first on Daily CyberSecurity.

Morphisec exposes a LuaJIT XLoader infostealer campaign. Learn how the XLoader infostealer abuses JScript and shared-section injection.

Related Posts:

• BITTER PapRAT Malware Targets South Asian Organizations
• Apple Mercenary Spyware Threat Prompts Global Alerts
• Hugging Face Malware Campaign Infects AI GPU Servers

The post LuaJIT XLoader Infostealer Spreads via Fake Orders appeared first on Daily CyberSecurity.

SnappyMail RCE chain disclosed with a public proof-of-concept exploit. The auth bypass hit dev builds only; avoid master builds from Oct 22-Nov 4.

Related Posts:

• Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
• Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
• PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)

The post SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code appeared first on Daily CyberSecurity.

Puppet Server RCE CVE-2026-115731 (CVSS 9.4) now has a public proof-of-concept exploit. Update OpenVox and Puppet Enterprise to patched versions.

Related Posts:

• Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
• SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
• Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder

The post PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4) appeared first on Daily CyberSecurity.

Details and a macOS privilege escalation PoC exploit are public for CVE-2026-112445. Patch macOS now to stop local users from gaining root privileges.

Related Posts:

• Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
• SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
• Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder

The post PoC Exploit Disclosed for macOS Privilege Escalation appeared first on Daily CyberSecurity.

Technical details and a macOS revisiond vulnerability PoC exploit for CVE-2026-112487 are public, allowing root elevation. Update macOS immediately.

Related Posts:

• Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
• cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel
• TeamViewer Client Vulnerability Enables Remote Code Execution

The post PoC Exploit Disclosed for macOS Local Privilege Escalation Vulnerability appeared first on Daily CyberSecurity.

Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.

Related Posts:

• Critical MediaTek Vulnerabilities Patched in Chipsets
• Critical FreePBX Vulnerabilities Patched in User Manager
• Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0

The post Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability appeared first on Daily CyberSecurity.

Exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 now has full details and a public Metasploit module. Apply BT26-05-RS now.

Related Posts:

• Critical MediaTek Vulnerabilities Patched in Chipsets
• Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
• Critical FreePBX Vulnerabilities Patched in User Manager

The post BeyondTrust Remote Support Flaw CVE-2026-102764 Exploited in the Wild as Full Details and Metasploit Exploit Go Public appeared first on Daily CyberSecurity.

Reddit is testing a Reddit mandatory login policy to thwart unauthorized AI scrapers and counteract declining organic search traffic.

Related Posts:

• Trezor Hardware Wallet Implant Found in Reseller Units
• Microsoft 365 Storage Changes Reduce Family Cloud Quotas
• Claude CarPlay Update Adds Hands-Free AI Voice

The post Reddit Mandatory Login Tests Expand to Curb AI Scraping appeared first on Daily CyberSecurity.

GitHub code activity reached historic highs in 2026, with over 7.3 billion monthly commits and 40% of pull requests drafted by AI coding agents.

Related Posts:

• Trezor Hardware Wallet Implant Found in Reseller Units
• Microsoft 365 Storage Changes Reduce Family Cloud Quotas
• Claude CarPlay Update Adds Hands-Free AI Voice

The post GitHub Code Activity Surges Amid AI Agent Adoption appeared first on Daily CyberSecurity.

Group-IB exposes CyberDakait Android malware. The Indian CyberDakait Android malware campaign uses 7 trojans to infect 17,960 phones and steal 7.6M SMS.

Related Posts:

• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
• INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud
• Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026

The post CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices appeared first on Daily CyberSecurity.

Dream researchers uncovered a Chinese-nexus PHP2Shell exploit Fragnesia chain that rooted 25 firewalls and breached a US government Active Directory.

Related Posts:

• GMO Internet Ransom Demand Slashed After Cloud Breach
• UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems appeared first on Daily CyberSecurity.

Details and PoC exploit code are out for critical libheif vulnerabilities GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. Upgrade to 1.23.3 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post Public PoC Exploit Disclosed for Critical libheif RCE Vulnerabilities appeared first on Daily CyberSecurity.

NVIDIA security update fixes NeMo Agent Toolkit vulnerability CVE-2026-65145 (CVSS 10.0) plus TensorRT-LLM and PhysX flaws. Update to 1.9.0 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post NVIDIA NeMo Agent Toolkit Vulnerability CVE-2026-65145 Scores CVSS 10.0 appeared first on Daily CyberSecurity.

A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.

Related Posts:

• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts
• Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer

The post cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers appeared first on Daily CyberSecurity.

Kaspersky uncovered the BlackX UEFI bootkit APT41 campaign bypassing Secure Boot via Baton Drop to spy on Central Asian diplomatic agencies.

Related Posts:

• APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries
• China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia
• Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

The post APT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomatic Agencies appeared first on Daily CyberSecurity.

Apple detailed its new WebKit identity resolution blocking update, cutting off AdTech cross-site tracking across Safari on iOS and macOS.

Related Posts:

• Chrome ClickFix Protection Scans Risky Clipboard Commands
• cURL Vulnerability Reporting Policy Shifts to GitHub
• UK CMA Moves to Unlock iPhone Contactless Payments

The post Apple Blocks WebKit Identity Resolution in Privacy Shift appeared first on Daily CyberSecurity.