Sophos X-Ops

The Claude AI Trap: Sophos Uncovers Undocumented Backdoor Hiding in Fake “Pro” Lure Claude AI Malware DonutLoader Backdoor

Claude AI Malware DonutLoader Backdoor

The Claude AI Trap: Sophos Uncovers Undocumented Backdoor Hiding in Fake “Pro” Lure

Do Son May 11, 2026

As the popularity of generative AI tools soars, cybercriminals are increasingly capitalizing on the hype to deploy...

Cyber Retaliation Escalates: Iranian Hacktivists Target Critical Infrastructure Following Military Strikes Iranian Hacktivists Operation Epic Fury Cyber New Generation Warfare Russian Hybrid Escalation Plex data breach Water Systems Cybersecurity - Threat Actor Naming Standard

Iranian Hacktivists Operation Epic Fury Cyber New Generation Warfare Russian Hybrid Escalation Plex data breach Water Systems Cybersecurity - Threat Actor Naming Standard

Cyber Retaliation Escalates: Iranian Hacktivists Target Critical Infrastructure Following Military Strikes

Do Son March 4, 2026

Sophos X-Ops Counter Threat Unit (CTU) researchers have observed a surge in Iranian hacktivist activity across Telegram,...

Trojanized PDF Editor: “TamperedChef” Campaign Bypasses Windows SmartScreen TamperedChef Malvertising AppSuite PDF Editor

TamperedChef Malvertising AppSuite PDF Editor

Trojanized PDF Editor: “TamperedChef” Campaign Bypasses Windows SmartScreen

Do Son January 20, 2026

A sophisticated new malvertising campaign dubbed TamperedChef has been serving up more than just productivity tools to...

Sophos Unmasks Sakura RAT: Hackers Hacking Hackers with Backdoored Malware! Sakura RAT, Hacker Malware

Sakura RAT, Hacker Malware

Sophos Unmasks Sakura RAT: Hackers Hacking Hackers with Backdoored Malware!

Do Son June 5, 2025

In a recent deep dive, Sophos X-Ops uncovered a sophisticated campaign that’s not targeting enterprises or governments,...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-72898CVSS 10.0
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator...
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-20349CVSS 8.6
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software...
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-68820CVSS 7.0
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-63077CVSS 9.8
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CISA KEV📅 Added to KEV: Aug 5, 2026
CVE-2026-34486CVSS 7.5
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of...
CISA KEV📅 Added to KEV: Aug 4, 2026
CVE-2026-9198CVSS 9.8
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network...
CISA KEV📅 Added to KEV: Aug 4, 2026
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects...
CISA KEV📅 Added to KEV: Aug 4, 2026
CVE-2026-18577
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
Admin intelCISA KEV📅 Added to KEV: Aug 3, 2026📅 Updated: Aug 3, 2026