Nine-Day Scanning Surge Targets Unpatched Hikvision Cameras Across Ukraine
GreyNoise logged a sharp nine-day spike in scanning and exploitation attempts against internet-exposed Hikvision cameras in Ukraine, almost all aimed at the four-year-old, maximum-severity CVE-2021-36260 command injection flaw....
Password-Free Login Flaw in Sungrow’s Solar Cloud Platform Could Have Enabled Grid-Wide Disruption
A business-logic flaw in Sungrow's iSolarCloud platform let attackers authenticate into any customer account using only an email address, with no password required and no login alert sent....
SonicWall Fixes Maximum-Severity SMA1000 Flaw Allowing Pre-Login Internal Requests
SonicWall has patched four SMA1000 vulnerabilities, led by a CVSS 10 pre-authentication SSRF flaw that can turn an exposed appliance into a proxy for internal requests. Organizations must...
Pwn2Own Ireland 2026: Researchers Cash In on 32 Zero-Days Across Samsung, Oracle, and AI Platforms
On the opening day of Pwn2Own Ireland 2026, competing research teams chained together 32 previously unknown vulnerabilities across flagship phones, AI services, and smart-home gear, collecting $388,500 in...
Public Exploit Code Raises Urgency Around Critical Atlassian File-Read Flaw
A proof-of-concept exploit is now public for CVE-2026-21589, a critical, unauthenticated file-read flaw affecting Jira, Confluence, Bitbucket, and other self-managed Atlassian Data Center products. In certain Crowd-connected setups...
Apache Struts Updates Close RCE, Memory Exhaustion and Data-Leak Flaws
Apache Struts maintainers have addressed four flaws spanning remote code execution, denial of service and cross-user data exposure. Administrators should move to Struts 7.4.0 or 6.12.0 and verify...
Crafted HEIC Uploads Can Turn WordPress Image Processing Into Server Code Execution
A newly demonstrated exploit chain turns a malicious HEIC upload into code execution through WordPress's server-side image pipeline. Administrators should update libheif, restrict unnecessary modern image formats, and...
AI-Driven Zammad Attack Chained Two Zero-Days to Reach Root in Seconds
An AI-assisted intruder compromised the Dutch Institute for Vulnerability Disclosure by chaining two previously unknown Zammad flaws. The incident moved from session hijacking to root access in seconds...