Latest Exploit news

Maximum severity Flowmon bug has a public exploit, patch now

Proof-of-concept exploit code has been released for a top-severity security vulnerability in Progress Flowmon, a tool for monitoring network performance and visibility.
- Bill Toulas
- April 24, 2024
- 04:08 PM
- 0
Microsoft: APT28 hackers exploit Windows flaw reported by NSA

Microsoft warns that the Russian APT28 threat group exploits a Windows Print Spooler vulnerability to escalate privileges and steal credentials and data using a previously unknown hacking tool called GooseEgg.
- Sergiu Gatlan
- April 22, 2024
- 01:22 PM
- 0
Exploit released for Palo Alto PAN-OS bug used in attacks, patch now

Exploit code is now available for a maximum severity and actively exploited vulnerability in Palo Alto Networks' PAN-OS firewall software.
- Sergiu Gatlan
- April 16, 2024
- 02:36 PM
- 0
Hackers earn $1,132,500 for 29 zero-days at Pwn2Own Vancouver

Pwn2Own Vancouver 2024 has ended with security researchers collecting $1,132,500 after demoing 29 zero-days (and some bug collisions).
- Sergiu Gatlan
- March 22, 2024
- 01:13 AM
- 0
Exploit released for Fortinet RCE bug used in attacks, patch now

Security researchers have released a proof-of-concept (PoC) exploit for a critical vulnerability in Fortinet's FortiClient Enterprise Management Server (EMS) software, which is now actively exploited in attacks.
- Sergiu Gatlan
- March 21, 2024
- 11:17 AM
- 0
Windows 11, Tesla, and Ubuntu Linux hacked at Pwn2Own Vancouver

On the first day of Pwn2Own Vancouver 2024, contestants demoed 19 zero-day vulnerabilities in Windows 11, Tesla, Ubuntu Linux and other devices and software to win $732,500 and a Tesla Model 3 car.
- Sergiu Gatlan
- March 21, 2024
- 03:07 AM
- 2
Exploit available for new critical TeamCity auth bypass bug, patch now

A critical vulnerability (CVE-2024-27198) in the TeamCity On-Premises CI/CD solution from JetBrains can let a remote unauthenticated attacker take control of the server with administrative permissions.
- Ionut Ilascu
- March 04, 2024
- 05:42 PM
- 0
ScreenConnect critical bug now under attack as exploit code emerges

Both technical details and proof-of-concept exploits are available for the two vulnerabilities ConnectWise disclosed earlier this week for ScreenConnect, its remote desktop and access software.
- Bill Toulas
- February 21, 2024
- 12:18 PM
- 1
Exploit released for Android local elevation flaw impacting 7 OEMs

A proof-of-concept (PoC) exploit for a local privilege elevation flaw impacting at least seven Android original equipment manufacturers (OEMs) is now publicly available on GitHub. However, as the exploit requires local access, its release will mostly be helpful to researchers.
- Bill Toulas
- January 31, 2024
- 02:15 PM
- 2
Exploits released for critical Jenkins RCE flaw, patch now

Multiple proof-of-concept (PoC) exploits for a critical Jenkins vulnerability allowing unauthenticated attackers to read arbitrary files have been made publicly available, with some researchers reporting attackers actively exploiting the flaws in attacks.
- Bill Toulas
- January 28, 2024
- 10:17 AM
- 0
Pwn2Own Automotive: $1.3M for 49 zero-days, Tesla hacked twice

The first edition of Pwn2Own Automotive has ended with competitors earning $1,323,750 for hacking Tesla twice and demoing 49 zero-day bugs in multiple electric car systems between January 24 and January 26.
- Sergiu Gatlan
- January 26, 2024
- 07:32 AM
- 0
Tesla hacked again, 24 more zero-days exploited at Pwn2Own Tokyo

Security researchers hacked the Tesla infotainment system and demoed a total of 24 zero-days on the second day of the Pwn2Own Automotive 2024 hacking competition.
- Sergiu Gatlan
- January 25, 2024
- 10:49 AM
- 2
Tesla hacked, 24 zero-days demoed at Pwn2Own Automotive 2024

Security researchers hacked a Tesla Modem and collected awards of $722,500 on the first day of Pwn2Own Automotive 2024 for three bug collisions and 24 unique zero-day exploits.
- Sergiu Gatlan
- January 24, 2024
- 08:36 AM
- 2
Exploit released for Fortra GoAnywhere MFT auth bypass bug

Exploit code is now available for a critical authentication bypass vulnerability in Fortra's GoAnywhere MFT (Managed File Transfer) software that allows attackers to create new admin users on unpatched instances via the administration portal.
- Sergiu Gatlan
- January 23, 2024
- 06:16 PM
- 0
Counter-Strike 2 HTML injection bug exposes players’ IP addresses

Valve has reportedly fixed an HTML injection flaw in CS2 that was heavily abused today to inject images into games and obtain other players' IP addresses.
- Lawrence Abrams
- December 11, 2023
- 03:05 PM
- 3
Privilege elevation exploits used in over 50% of insider attacks

Elevation of privilege flaws are the most common vulnerability leveraged by corporate insiders when conducting unauthorized activities on networks, whether for malicious purposes or by downloading risky tools in a dangerous manner.
- Bill Toulas
- December 08, 2023
- 12:19 PM
- 0
Exploit for CrushFTP RCE chain released, patch now

A proof-of-concept exploit was publicly released for a critical remote code execution vulnerability in the CrushFTP enterprise suite, allowing unauthenticated attackers to access files on the server, execute code, and obtain plain-text passwords.
- Bill Toulas
- November 18, 2023
- 10:06 AM
- 0
New Samsung data breach impacts UK store customers

Samsung Electronics is notifying some of its customers of a data breach that exposed their personal information to an unauthorized individual.
- Ionut Ilascu
- November 15, 2023
- 06:07 PM
- 1
Atlassian warns of exploit for Confluence data wiping bug, get patching

Atlassian warned admins that a public exploit is now available for a critical Confluence security flaw that can be used in data destruction attacks targeting Internet-exposed and unpatched instances.
- Sergiu Gatlan
- November 02, 2023
- 05:46 PM
- 0
Exploit released for critical Cisco IOS XE flaw, many hosts still hacked

Public exploit code is now available for the critical Cisco IOS XE vulnerability tracked as CVE-2023-20198 that was leveraged as a zero-day to hack tens of thousands of devices.
- Ionut Ilascu
- October 30, 2023
- 11:09 PM
- 0