VulnHub

Researchers have identified a serious three-stage attack method known as the 'SearchLeak' attack, which allows attackers to steal data with just one click. This vulnerability is linked to AI prompt-injection issues that utilize hidden URLs and other variables to exploit systems. Although the attack has been patched, it raises concerns about the security of AI applications and the potential for similar vulnerabilities to emerge. Companies using AI tools should remain vigilant and ensure that they are updated to protect against these types of attacks. The incident serves as a reminder of the ongoing security challenges in the rapidly evolving field of artificial intelligence.

The WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack that targeted Awesome Motive's content distribution network (CDN). This breach raises concerns for users of these plugins, as attackers could potentially exploit vulnerabilities to access sensitive data or deploy malicious code. The incident highlights the risks associated with third-party services, where a single point of failure can affect multiple applications and their users. Website owners using these plugins should monitor their sites for unusual activity and stay updated on any further developments from Awesome Motive regarding security measures and fixes. The implications of such an attack can be significant, affecting user trust and the overall security posture of affected sites.

A threat actor has been exploiting a vulnerability in Marimo notebooks, specifically CVE-2026-39987, to gain unauthorized access. After taking control of a publicly accessible notebook, the attacker utilized a large language model (LLM) agent to carry out further actions. They extracted cloud credentials from the compromised system, which could potentially lead to additional breaches or data leaks. This incident raises concerns for organizations using Marimo products, as it demonstrates how quickly attackers can adapt and use advanced tools for post-exploitation activities. Companies must remain vigilant and ensure their systems are secured against such vulnerabilities.

According to ESET's 2026 APT Activity Report, Chinese-backed advanced persistent threats (APTs) are capitalizing on the instability caused by ongoing conflicts in Iran to target maritime and energy companies. This surge in cyber-attacks indicates that attackers are exploiting geopolitical tensions to carry out their operations. The report highlights that these APTs are not only focusing on regional targets but are also continuing their activities against organizations globally. This situation raises concerns for companies in the maritime and energy sectors, as they may face increased risks of data breaches and operational disruptions due to these cyber threats. Understanding these tactics is crucial for organizations to bolster their cybersecurity defenses and protect sensitive information.

Hackers are exploiting a vulnerability in FortiClient Enterprise Management Server (EMS), identified as CVE-2026-35616, which allows them to bypass authentication. This flaw is being used to deliver a credential-stealing malware known as EKZ. Organizations using FortiClient EMS are at risk, as attackers can gain unauthorized access to sensitive information through this exploit. The situation is concerning since the malware targets credentials, potentially leading to further data breaches. Companies should prioritize patching this vulnerability to protect their systems and data from compromise.

A serious vulnerability has been found in Gogs, a widely used open-source Git service that allows users to host their own repositories. This flaw, which has a CVSS score of 9.4, enables any authenticated user to execute arbitrary code, potentially giving them full control over the server. This means that individuals with valid access can exploit this weakness to run malicious commands, posing a significant risk to the integrity and security of the affected systems. Currently, there is no CVE identifier linked to this vulnerability, which may complicate tracking and response efforts. Users of Gogs should be particularly vigilant and consider implementing immediate security measures to mitigate potential exploitation.

A new cyber campaign has emerged, targeting cryptocurrency firms through deceptive recruitment tactics and custom malware designed for macOS systems. Researchers from Wiz have identified this threat actor, known as JINX-0164, which employs social engineering to lure victims into downloading malicious software. The malware is tailored to exploit continuous integration and continuous deployment (CI/CD) infrastructures, increasing the risk of digital asset theft for affected organizations. As cryptocurrency firms often handle significant amounts of valuable digital assets, these attacks could lead to substantial financial losses and damage to their reputations. Companies in the crypto space need to be vigilant and enhance their security measures to protect against these sophisticated threats.

The FBI has issued a warning about a new tactic employed by the Silent Ransom Group (SRG), an extortion gang that is now targeting law firms in the U.S. The group is reportedly conducting in-person data theft attacks, posing a significant risk to sensitive client information held by these firms. This shift to physical attacks raises concerns about the security measures law firms have in place to protect their data. The FBI urges these organizations to enhance their security practices and be vigilant against potential threats. This development highlights the evolving nature of cybercrime, as attackers explore new methods to exploit vulnerabilities in various sectors.

Hackers have taken advantage of a zero-day vulnerability in the KnowledgeDeliver learning management system (LMS) to install a malicious web shell known as Godzilla. This security flaw allows attackers to gain unauthorized access to systems running this LMS, potentially compromising sensitive data and disrupting services. Organizations using KnowledgeDeliver should be particularly vigilant, as the exploitation of this vulnerability could lead to significant operational and data security issues. The presence of a web shell means that attackers can execute commands remotely, making it crucial for affected users to take immediate action to secure their systems. Companies must prioritize patching and monitoring their environments to mitigate the risks associated with this exploit.