Do Son CVE-2026-16347 lets attackers brute-force MikroTik RouterOS logins for unauthorized system access. Rated CVSS 8.8, with no fix yet. Apply mitigations.
Brute Force
Darktrace exposed a DragonForce RaaS attack on a manufacturer. The multi-phase intrusion used brute force and OpenVAS for recon, then exfiltrated data over SSH to a Russian-based malicious host.
A new macOS backdoor, ChillyHell, bypassed Apple's notarization process for years, remaining undetected while being used for espionage and brute-force attacks.
A dangerous Go package, disguised as a fast SSH brute-force tool, is secretly stealing login credentials and sending them to an attacker via a Telegram bot.
GreyNoise reports a massive brute-force campaign targeting Apache Tomcat Manager interfaces, with hundreds of malicious IPs attempting to compromise services.
A patched Google flaw allowed researchers to extract linked phone numbers without user notification. The vulnerability is now fixed, and no exploits were detected.
Intrinsec exposes BtHoster, a bulletproof hosting provider behind widespread scanning and malware, revealing its network of shell companies and evasion tactics.
RAGFlow is vulnerable to account takeover. This article details the brute-force exploit and the urgent security risk (CVE-2025-48187, No Patch)
Critical vulnerability (CVSS 9.1) in Auth0-PHP SDK! This flaw threatens applications with over 16 million downloads. Update now to avoid brute force attacks.