VulnHub

A serious vulnerability in SAP Commerce Cloud was quickly targeted by attackers just days after a patch was released to fix the issue. This flaw poses significant risks to organizations using the platform, as it could allow unauthorized access or manipulation of data. The rapid exploitation of this vulnerability emphasizes the need for companies to ensure they apply updates promptly and monitor their systems for any signs of intrusion. Cybersecurity experts recommend that users remain vigilant and implement additional security measures where possible to safeguard their environments. This incident serves as a reminder of the importance of proactive cybersecurity practices in protecting sensitive business information.

A serious vulnerability has been discovered in the User Profile Builder plugin for WordPress, affecting around 40,000 websites. This flaw allows unauthenticated attackers to gain access to administrator accounts, potentially giving them control over the entire site. The issue is particularly concerning because it does not require any prior authentication, making it easier for malicious actors to exploit. Website owners using this plugin should take immediate action to secure their sites and prevent unauthorized access. Without quick remediation, these sites remain at risk of being compromised, which can lead to data breaches and other security incidents.

Hackers are exploiting a recently patched vulnerability in macOS, known as CVE-2026-65400, which allows unauthorized access to the macOS Screen Sharing feature. This flaw enables attackers to bypass authentication and gain root access to affected systems, leading to the installation of cryptominers without user consent. The Netherlands’ National Cyber Security Centre has issued a warning about this active exploitation, emphasizing the need for users to update their systems. Apple has released patches for macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1) to address this issue, urging all macOS users to upgrade promptly to protect their devices. Failure to do so could leave systems vulnerable to further attacks and unauthorized resource usage.

Researchers from SSD Secure Disclosure have identified a serious vulnerability in Unisoc modem firmware that allows attackers to gain full access to the Android kernel through a VoLTE video call. This exploit chain, disclosed on August 17, 2026, is a continuation of a previous discovery from March 2026, which involved remote code execution. Currently, there is no fix available from Unisoc, leaving devices that use this firmware at risk. The implications of this vulnerability are significant, as it can potentially allow attackers to control affected devices completely. Users with devices running Unisoc chipsets should be particularly cautious, as they are directly impacted by this security issue.

Researchers have discovered a new Linux botnet called Evooo1Bot, which builds upon the Mirai botnet's source code. This botnet can exploit known vulnerabilities to convert internet-facing devices into SOCKS5 proxies. The malware not only incorporates the DDoS capabilities of Mirai but also adds several new features that enhance its functionality. This poses a significant risk as it can affect various edge devices that are often less secure and can be used for malicious activities like distributed denial-of-service attacks. Users and companies with exposed devices need to take immediate action to protect their systems from this emerging threat.

A recent cybersecurity concern involves attackers purchasing expired domain names and using them to distribute malware. This tactic allows them to exploit the trust users have in familiar web addresses, potentially leading to security breaches and data theft. Companies and individuals who own domains should monitor their registrations closely to avoid falling victim to this scheme. Additionally, organizations need to educate users about the risks associated with clicking on links from unknown or expired domains. The implications of this practice are significant as it not only affects the victims directly but also undermines overall internet security trust. Staying vigilant and proactive in domain management is essential to mitigate these risks.

Attackers are increasingly purchasing expired domain names to take advantage of their established online reputation and traffic. These domains, referred to as dropcatch domains, can be exploited for malicious purposes, including distributing malware, conducting scams, and setting up command-and-control (C2) infrastructure. Each day, around 65,000 domain names that have lapsed are re-registered by new owners, which presents a significant risk. This trend poses dangers to users and organizations as they may unwittingly interact with these compromised domains, leading to potential security breaches. Awareness of this tactic is crucial for internet users and companies to mitigate risks associated with these expired domains.

The online gaming industry is facing a growing problem with identity fraud as it attracts both millions of legitimate players and skilled fraudsters. Recently, two men were charged for exploiting vulnerabilities within this sector. Their actions underline the risks that gamers face, including unauthorized account access and financial theft. As fraudsters become more sophisticated, it’s crucial for gaming companies and players alike to implement stricter security measures. This includes better identity verification processes and increased awareness about phishing scams, which can help protect users from falling victim to these scams.

Hackers are increasingly buying expired domains to take advantage of their existing traffic and credibility to misdirect users toward scams and malware. According to Infoblox, a firm that specializes in DNS threat intelligence, these domains—known as dropcatch domains—can be quickly registered after they expire. In the first half of 2026 alone, cybercriminals purchased over 50,400 of these domains, allowing them to exploit unsuspecting users. This practice poses significant risks as it can lead to increased phishing attacks and the spread of malicious software. Users and businesses need to be aware of these tactics to protect themselves from falling victim to these scams.

Researchers have confirmed that the cyber extortion group ExfilSquad has accessed and stolen sensitive data from at least 13 different organizations. This data has been published by the group through torrents, making it publicly available. The nature of the stolen information remains unspecified, but the breach underscores significant security vulnerabilities within these organizations. As the leaked data could potentially be used for further attacks or identity theft, companies need to assess their security measures and respond swiftly to mitigate any potential fallout. This incident serves as a reminder of the ongoing risks posed by cybercriminals who exploit weaknesses in security protocols.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its catalog of exploited vulnerabilities. These include a heap inspection flaw in Cisco Secure Firewall (CVE-2026-20349), a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (CVE-2026-68820), and a critical SQL injection vulnerability in Metabase (CVE-2026-72898). These flaws could allow attackers to exploit systems running affected software, potentially leading to unauthorized access or data breaches. Organizations using these products need to take immediate action to protect their systems. Awareness and prompt updates are essential to mitigate the risks associated with these vulnerabilities.

Researchers have identified a serious SQL injection vulnerability in GeoServer, a popular open-source server for sharing geospatial data. This flaw could enable attackers to execute remote code on affected systems, posing a significant risk to organizations that rely on GeoServer for managing geographic information. The vulnerability is currently unpatched, making it particularly concerning as hackers may exploit it in the wild. Organizations using GeoServer should address this issue promptly to prevent potential breaches and protect sensitive geospatial data. The urgency for users to secure their installations cannot be overstated, given the potential for widespread exploitation.