Do Son, Author at Daily CyberSecurity • Page 13 of 697

GST Phishing Campaign Distributes Remcos RAT Malware DPRK IT Workers, APT38 Crypto Forfeiture

GST Phishing Campaign Distributes Remcos RAT Malware

Do Son July 23, 2026

Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase...

Google Enhances iOS to Android Migration Tool Upgraded Google iOS to Android migration tool interface displaying eSIM data transfer options

Google Enhances iOS to Android Migration Tool

Do Son July 23, 2026

Streamlining the Transition from iPhone At the recent Galaxy Unpacked event, Google unveiled a significantly upgraded and...

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms

Do Son July 23, 2026

At a glance Actor / group Suspected Chinese-speaking APT group (low confidence) Activity type Cyberespionage using malicious...

DoNot APT Targets Bangladesh Military With a Fake Officer Biography CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

DoNot APT Targets Bangladesh Military With a Fake Officer Biography

Do Son July 23, 2026

At a glance Actor / group DoNot (APT-C-35); assessed by multiple vendors as India-aligned Activity type Targeted...

GitHub Actions Abuse Powers a Distributed cPanel and WHM Attack Campaign WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

GitHub Actions Abuse Powers a Distributed cPanel and WHM Attack Campaign

Do Son July 23, 2026

At a Glance Actor or group Unattributed threat actor; no group name published Activity type GitHub Actions...

ISC Patches 9 BIND 9 Vulnerabilities, Including a DNSSEC Cache Poisoning Flaw BIND vulnerability advisory chart listing nine DNSSEC flaws including CVE-2026-13321 cache poisoning fixed in BIND 9.20.26 and 9.21.24

BIND vulnerability advisory chart listing nine DNSSEC flaws including CVE-2026-13321 cache poisoning fixed in BIND 9.20.26 and 9.21.24

ISC Patches 9 BIND 9 Vulnerabilities, Including a DNSSEC Cache Poisoning Flaw

Do Son July 23, 2026

TL;DR ISC released BIND 9.20.26 and 9.21.24 on July 22, 2026. The updates fix nine flaws in...

600K Sites at Risk: Ninja Forms Stored XSS Flaw CVE-2026-65048 Hits CVSS 9.3 Ninja Forms vulnerability dashboard showing CVE-2026-65048 unauthenticated stored XSS with a CVSS 9.3 score across 600K WordPress sites

Ninja Forms vulnerability dashboard showing CVE-2026-65048 unauthenticated stored XSS with a CVSS 9.3 score across 600K WordPress sites

600K Sites at Risk: Ninja Forms Stored XSS Flaw CVE-2026-65048 Hits CVSS 9.3

Do Son July 23, 2026

TL;DR Researchers disclosed four flaws in the Ninja Forms WordPress plugin, which runs on more than 600,000...

RefluXFS CVE-2026-64600: XFS Root Privilege Escalation Hits 16.4M Systems RefluXFS CVE-2026-64600 XFS privilege escalation to root diagram showing a reflink direct-I/O race overwriting a protected file across 16.4 million Linux systems

RefluXFS CVE-2026-64600 XFS privilege escalation to root diagram showing a reflink direct-I/O race overwriting a protected file across 16.4 million Linux systems

RefluXFS CVE-2026-64600: XFS Root Privilege Escalation Hits 16.4M Systems

Do Son July 22, 2026

TL;DR Qualys disclosed RefluXFS on July 22, 2026. Tracked as CVE-2026-64600, it is a Linux kernel XFS...

Check Point SmartConsole Auth Bypass CVE-2026-16232 Exploited in the Wild Check Point SmartConsole authentication bypass CVE-2026-16232 exploited in the wild against internet-exposed Management servers

Check Point SmartConsole authentication bypass CVE-2026-16232 exploited in the wild against internet-exposed Management servers

Check Point SmartConsole Auth Bypass CVE-2026-16232 Exploited in the Wild

Do Son July 22, 2026

TL;DR Check Point disclosed a SmartConsole authentication bypass on July 22, 2026. The flaw, CVE-2026-16232, is already...

Exim Directory Traversal Flaw Enables Privilege Escalation, Fixed in 4.99.5 Exim vulnerability diagram showing a directory traversal that escapes the spool area and leads to local privilege escalation

Exim vulnerability diagram showing a directory traversal that escapes the spool area and leads to local privilege escalation

Exim Directory Traversal Flaw Enables Privilege Escalation, Fixed in 4.99.5

Do Son July 22, 2026

TL;DR The Exim team published advisory EXIM-Security-2026-06-22.1 on July 22, 2026. It describes an Exim vulnerability that...

Public PoC Exploit Exposes CVE-2026-44421 FreeRDP Heap Buffer Overflow to Remote Code Execution FreeRDP heap buffer overflow vulnerability CVE-2026-44421 CVE-2026-44422 CVE-2026-40033 diagram

FreeRDP heap buffer overflow vulnerability CVE-2026-44421 CVE-2026-44422 CVE-2026-40033 diagram

Public PoC Exploit Exposes CVE-2026-44421 FreeRDP Heap Buffer Overflow to Remote Code Execution

Do Son July 22, 2026

FreeRDP developers recently patched a critical flaw affecting numerous workstations worldwide. Security researchers publicly disclosed the details...

Spirals Ransomware Encrypts a South Asian IT Network in Under 24 Hours Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals Ransomware Encrypts a South Asian IT Network in Under 24 Hours

Do Son July 22, 2026

At a glance Malware family Spirals (new Rust-based ransomware, named by its operators) Threat actor Unknown. No...

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe

Do Son July 22, 2026

At a glance Actor / group UAT-11795 (suspected Russian-speaking, financially motivated) Activity type Credential and cryptocurrency theft...

Public PoC Exploit Released for fastjson 1.2.83 Remote Code Execution Flaw fastjson RCE vulnerability in versions 1.2.68 to 1.2.83 with public PoC exploit code

fastjson RCE vulnerability in versions 1.2.68 to 1.2.83 with public PoC exploit code

Public PoC Exploit Released for fastjson 1.2.83 Remote Code Execution Flaw

Do Son July 22, 2026

TL;DR Researcher Kirill Firsov disclosed a fastjson RCE on July 19, 2026. It affects fastjson 1.2.68 through...

FreePBX Vulnerabilities Enable Unauthenticated RCE and Administrator Takeover FreePBX vulnerabilities enabling unauthenticated RCE and administrator takeover in UCP and missedcall

FreePBX vulnerabilities enabling unauthenticated RCE and administrator takeover in UCP and missedcall

FreePBX Vulnerabilities Enable Unauthenticated RCE and Administrator Takeover

Do Son July 22, 2026

TL;DR Two new FreePBX vulnerabilities each carry a CVSS score of 9.3. One gives unauthenticated remote code...

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files

Do Son July 22, 2026

A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos,...

CVE-2026-60206 (CVSS 9.9): Takeover Flaw Hits Oracle WebLogic Server Oracle WebLogic Server vulnerability chart highlighting CVE-2026-60206 with a CVSS 9.9 score enabling unauthenticated server takeover

Oracle WebLogic Server vulnerability chart highlighting CVE-2026-60206 with a CVSS 9.9 score enabling unauthenticated server takeover

CVE-2026-60206 (CVSS 9.9): Takeover Flaw Hits Oracle WebLogic Server

Do Son July 22, 2026

TL;DR Oracle patched 11 flaws in the WebLogic Server Core component this July. Most allow a full...

IRGC Claims Strike on AWS Bahrain Data Center AWS Bahrain data center region ME-South-1 marked unavailable after claimed Iranian cruise missile strike

AWS Bahrain data center region ME-South-1 marked unavailable after claimed Iranian cruise missile strike

IRGC Claims Strike on AWS Bahrain Data Center

Do Son July 22, 2026

Iran’s Islamic Revolutionary Guard Corps has issued a statement of striking military significance. According to the IRGC,...

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor

Do Son July 22, 2026

At a Glance Actor or group Unnamed China-linked espionage group (per Symantec’s 2022 attribution) Activity type Suspected...

Firefox Native Containers Arrive in Version 153 Firefox native containers in Firefox 153 showing color-coded container tabs for work, banking and shopping

Firefox native containers in Firefox 153 showing color-coded container tabs for work, banking and shopping

Firefox Native Containers Arrive in Version 153

Do Son July 22, 2026

Mozilla has published Firefox 153.0 as a stable release, and the update finally delivers containers as a...

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks Gafgyt botnet Langflow DDoS attack infection chain diagram

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks

Do Son July 22, 2026

At a Glance Malware family Gafgyt / BASHLITE variant (DDoS bot) Threat actor Unattributed; banner references handle...

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases

Do Son July 22, 2026

At a Glance Malware family OkoBot framework (TookPS lineage; 20+ payloads and implants) Threat actor Unattributed; suspected...

Critical Alert 3 Active Exploits Detected Today