AI-Assisted Campaign Compromises 440 PaperCut Servers Worldwide
An automated campaign compromised at least 440 PaperCut servers across 48 countries and used some footholds to reach internal networks. Defenders should patch urgently, restrict exposed management services,...
October Windows Server Updates Disrupt Exchange Mail Flow and Web Access
Microsoft says October 2026 Windows Server security updates can interrupt Exchange webmail, message delivery, and database availability. A registry-based mitigation is available, and administrators are advised to keep...
Plex2Shell Attacks Turn Exposed Media Servers Into Cryptomining Nodes
Attackers are using the public Plex2Shell exploit chain against internet-facing Plex Media Server instances to install an XMRig miner and proxy software. Administrators should update immediately and inspect...
CERT-In Warns That AI Agents Are Shrinking the Gap Between Breach and Damage to Hours
India's national cyber agency CERT-In has issued a critical advisory warning that both criminal groups and AI providers' own automated agents are compressing attack timelines from days to...
New ROMULUS Platform Turns Fake ‘Verification’ Prompts Into a Reusable Malware Delivery Backend
Forescout researchers have identified ROMULUS, a previously undocumented ClickFix delivery platform that tricks users into running malicious commands themselves, then routes them toward either the LegionLoader malware or...
Proxyjacking Campaign Hijacks D-Link, Ubiquiti and SAP Flaws to Build a Residential Proxy Network
Researchers at GreyNoise have uncovered a campaign that exploited old vulnerabilities in D-Link NAS devices, Ubiquiti UniFi Video recorders, and SAP NetWeaver to secretly enroll at least 143...
Anthropic’s Claude AI Cracks a 25-Year-Old Mystery Behind NSA-Linked Encryption Curves
Anthropic says its Claude research model traced the hidden origin of elliptic curve seeds baked into NIST's ECDSA standard back in 2000, resolving a quarter-century of speculation about...
Actively Exploited Collabora RCE Leaves Nextcloud Servers Backdoored
Attackers are exploiting CVE-2026-110447, a critical unauthenticated command-injection flaw in the Collabora Online Built-in CODE Server app for Nextcloud. Administrators must upgrade to richdocumentscode 26.4.303 or later and...