Telerik UI Padding Oracle Chained to Unauthenticated RCE
September 8, 2026
TantoSec released a PoC exploit chaining Telerik UI padding oracle to unauthenticated RCE two months after Progress Software shipped a
Application Security
Telerik UI Padding Oracle Chained to Unauthenticated RCE
TantoSec released a PoC exploit chaining Telerik UI padding oracle to unauthenticated RCE two months after Progress Software shipped a patch.
REVSTEALER Modules Disable Windows Defender to Deploy Miner
Elastic Security Labs found four REVSTEALER persistence modules that remain after the stealer deletes itself, disabling Defender to run a crypto miner.
Five Critical WordPress Flaws Enable Site Takeover and RCE
Five critical vulnerabilities in WPMU DEV Dashboard, Avada Theme, TranslatePress, Pods, and GiveWP allow authentication bypass, privilege escalation, and RCE.
Anthropic Warns Infostealer Malware Hijacking Claude Sessions
Anthropic warns Vidar, Lumma, StealC, RedLine, and AMOS malware are stealing Claude session tokens, enabling attackers to drain user credits fraudulently.
PaperCut Zero-Days Under Active Exploit Despite Two Patches
CVE-2026-81578 and CVE-2026-82078 allow unauthenticated RCE on PaperCut NG/MF versions 24-26; WatchTowr found patch bypasses forcing second emergency patch.
McKesson Breach: ShinyHunters Demands $55M for 284M Records
ShinyHunters demands $55 million for 284 million McKesson records containing PHI, prescriptions, and billing data; threatens release by September 1.
Hasbro Data Breach Exposed 436+ Employee Records
Hasbro disclosed breach affecting 436+ Massachusetts employees, exposing names, national IDs, and financial data, tied to late March cyberattack.
Judge Rules Pentagon Actions Against Anthropic Unlawful
U.S. District Judge Rita Lin ruled Pentagon
AI Research Org METR Loses $600K in Credits to Dual Breach Attacks
METR disclosed two incidents where attackers stole API keys and consumed $600,000 in AI credits through fail-open authentication and targeted probing.
360 Attacks Target Langflow and Rails Flaws Within 72 Hours
VulnCheck recorded 360 exploitation attempts targeting CVE-2026-0768 in Langflow and Rails KindaRails2Shell CVE-2026-66066 within 72 hours of disclosure.
REVSTEALER Modules Disable Windows Defender to Deploy Miner
September 8, 2026
Elastic Security Labs found four REVSTEALER persistence modules that remain after the stealer deletes itself, disabling Defender to run a
Five Critical WordPress Flaws Enable Site Takeover and RCE
September 2, 2026
Five critical vulnerabilities in WPMU DEV Dashboard, Avada Theme, TranslatePress, Pods, and GiveWP allow authentication bypass, privilege escalation, and RCE.
Anthropic Warns Infostealer Malware Hijacking Claude Sessions
September 2, 2026
Anthropic warns Vidar, Lumma, StealC, RedLine, and AMOS malware are stealing Claude session tokens, enabling attackers to drain user credits
PaperCut Zero-Days Under Active Exploit Despite Two Patches
September 1, 2026
CVE-2026-81578 and CVE-2026-82078 allow unauthenticated RCE on PaperCut NG/MF versions 24-26; WatchTowr found patch bypasses forcing second emergency patch.
McKesson Breach: ShinyHunters Demands $55M for 284M Records
September 1, 2026
ShinyHunters demands $55 million for 284 million McKesson records containing PHI, prescriptions, and billing data; threatens release by September 1.
Hasbro Data Breach Exposed 436+ Employee Records
September 1, 2026
Hasbro disclosed breach affecting 436+ Massachusetts employees, exposing names, national IDs, and financial data, tied to late March cyberattack.
Judge Rules Pentagon Actions Against Anthropic Unlawful
September 1, 2026
U.S. District Judge Rita Lin ruled Pentagon
AI Research Org METR Loses $600K in Credits to Dual Breach Attacks
September 1, 2026
METR disclosed two incidents where attackers stole API keys and consumed $600,000 in AI credits through fail-open authentication and targeted
360 Attacks Target Langflow and Rails Flaws Within 72 Hours
September 1, 2026
VulnCheck recorded 360 exploitation attempts targeting CVE-2026-0768 in Langflow and Rails KindaRails2Shell CVE-2026-66066 within 72 hours of disclosure.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.