Tag
22 results in the archive.
Talos identified UAT-11473 exploiting an authentication bypass in Cisco SD-WAN Catalyst Controllers to deploy KeyDrift malware, posing a significant threat to enterprise SD-WAN environments.
SafePay ransomware has targeted over 600 global victims, leveraging multiple CVEs and sophisticated evasion tactics to demand cryptocurrency ransoms.
Citizen Lab researchers uncovered that Candiru spyware exploited zero-click vulnerabilities embedded in online ads to infect Al Jazeera devices, employing stealthy delivery methods.
A proxyjacking campaign has compromised D-Link and Ubiquiti devices in 34 countries to resell stolen bandwidth via a commercial residential proxy network.
Anthropic warns that small AI models may autonomously self-replicate across IoT devices, forming resilient, self-propagating botnets that lack centralized control.
Cisco disclosed five critical vulnerabilities in NX-OS enabling attackers to gain root-level control over Nexus switches, threatening data center security.
Linux backdoors targeting telecom and network devices in South Korea and Taiwan disguise their traffic as email services and legitimate processes to evade detection.
Threat actors exploit a patched critical flaw in the Realtek Jungle SDK to spread the Cling botnet, employing the STUN protocol for command-and-control communications.
Cisco disclosed a critical zero-day authentication bypass vulnerability in its Catalyst SD-WAN Manager allowing unauthenticated remote attackers to gain admin access via the API.
CISA warns of eight vulnerabilities in Citrix NetScaler ADC and Gateway, including two critical zero-days actively exploited allowing remote code execution.
A Linux rootkit targets F5 BIG-IP APM devices by injecting fileless web shells into memory through PHP file loading interception, complicating detection.
MikroTik released a patch for an SSH authentication bypass vulnerability currently exploited to create unauthorized accounts on devices.
A Linux backdoor named 'Ted' has been found in trojanized HAProxy builds at South Korean organizations, intercepting and modifying web traffic while requiring prior code execution on the host.
Cisco released a patch for a critical vulnerability in Silicon One-based Nexus 9000 switches that allows unauthenticated remote code execution as root, identified as CVE-2026-20212 with a 9.8 CVSS score.
The China-linked Fire Ant group has compromised Cisco IOS XR routers, TACACS servers, and Linux hosts to steal credentials and disable security logs, targeting critical network infrastructure.
Evooo1Bot is a new Mirai-based Linux botnet targeting internet-facing routers to convert them into SOCKS5 traffic relay nodes, expanding attack surfaces.
Cisco alerts on a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense VPN software actively exploited to crash devices, threatening enterprise network stability.
Cisco released patches for 12 critical vulnerabilities in Catalyst SD-WAN and IOS XE software impacting devices in all configurations.
Arista released a patch for a critical command injection zero-day vulnerability currently exploited in on-premises VeloCloud Orchestrator deployments, affecting enterprise network management.
A critical DHCPv6 stack overflow vulnerability in OpenWrt's default network service odhcpd allows unauthenticated remote root code execution.
SonicWall disclosed two critical zero-day vulnerabilities in SMA1000 devices being exploited in active attacks, highlighting urgent risk to enterprise network security.
Russian state-sponsored hackers from FSB Center 16 are exploiting poorly configured routers in critical infrastructure worldwide, heightening operational risks.