Unpatched HTTP/3 DoS in Alibaba XQUIC — 260-Byte Crash
Alibaba XQUIC unpatched HTTP/3 DoS flaw crashes servers with 260 bytes. Zimbra critical XSS patched. GigaWiper destructive backdoor analyzed.
Posts tagged: Supply-Chain
FBI Seizes NetNut — 2M IoT Devices Were Proxy Nodes
FBI dismantles NetNut residential proxy botnet enrolling 2M+ IoT devices. Plus CitrixBleed 2.0 exploited same day and Medtronic 3.8M-record breach.
libssh2 PoC Flips SSH Trust — CVE-2026-55200
CVE-2026-55200 public PoC turns SSH clients into targets. Plus 14.2M credentials exposed at six ISPs and Russian APTs exploiting messaging apps.
Miasma Supply Chain Malware Jumps to Go and GitHub Actions
Miasma malware expands from npm to Go and GitHub Actions. CVE-2026-12569 Windchill RCE hits KEV. CL-STA-1062 espionage targets SE Asia governments.
Cisco Unified CM Exploited — CVE-2026-20230 SSRF
CVE-2026-20230 SSRF in Cisco Unified CM exploited days after PoC. Mistic RAT feeds six ransomware gangs. Klue supply chain breach hits LastPass.
FortiBleed Attribution — Russian IAB, 110M Credentials
Russian IAB behind FortiBleed siphoned 110M VPN credentials since February. FFmpeg PixelSmash RCE hits media servers. Squidbleed leaks cleartext creds.
AryStinger Botnet — 4,300 Routers as Recon Proxies
AryStinger botnet turns 4,300 legacy routers into recon proxies. Gravity SMTP plugin exploit harvests WordPress API keys.
144 Mastra npm Packages Hijacked — CVE-2026-48907
144 Mastra AI npm packages compromised via hijacked contributor account. CVE-2026-48907 Joomla JCE CVSS 10.0 actively exploited.
Ivanti Sentry RCE Exploited — CISA's 3-Day Patch Mandate
Ivanti Sentry RCE under active exploitation with CISA's new 3-day patch mandate. ShinyHunters hit Oracle PeopleSoft CVE-2026-35273.
Microsoft's Record 206-Patch Tuesday — 3 Exploited Zero-Days
Microsoft patches 206 flaws with 3 exploited zero-days including CVE-2026-42897. Ivanti Sentry CVSS 10.0 RCE and Langflow CVE-2026-5027 also exploited.