Public Exploit Released for vBulletin CVE-2026-61511 RCE
July 28, 2026
SSD Secure Disclosure released a weaponized unauthenticated RCE exploit for CVE-2026-61511 in vBulletin 6.x, exposing forum sites not yet on
Cybersecurity
Public Exploit Released for vBulletin CVE-2026-61511 RCE
SSD Secure Disclosure released a weaponized unauthenticated RCE exploit for CVE-2026-61511 in vBulletin 6.x, exposing forum sites not yet on version 6.2.2.
n8n Sandbox Escape GHSA-gv7g-jm28-cr3m Exposes Host OS Commands
n8n versions before 2.31.5 let authenticated users escape the expression sandbox via arrow functions and Reflect.get(), executing OS commands on the host.
Operation BlueDash Delivers RMM Tools via Fake Teams Lures
Operation BlueDash deploys Level RMM and ScreenConnect against enterprises through fake Microsoft Teams and Zoom pages linked to a Nigerian threat actor.
Cruciferra Crypter Combines BYOVD and Process Ghosting to Kill EDR
Cruciferra, a MaaS crypter active since fall 2025, bypasses EDR via BYOVD and Process Ghosting. TA4922, Silver Fox, and 11 malware families are linked to ...
Victims Sue Apple Over $1.8M Bitcoin Theft Via Fake Sparrow App
Three individuals sued Apple over a fake iOS Sparrow Wallet app that stole $1.8 million in Bitcoin by harvesting seed phrases. Apple was warned in ...
ShinyHunters Claims Ernst & Young Breach via Third-Party System
ShinyHunters posted Ernst & Young to its leak site, claiming a supply-chain attack on a third-party ticket system that exposed client tax and financial data.
Origin Energy Breach Exposes Data on 900,000 Australian Customers
Origin Energy disclosed a breach affecting 900,000 Australian customers, exposing names, bank account fragments, and addresses amid unconfirmed ransom claims.
MedusaHVNC Hides Covert Browser Sessions in Windows Desktops
BlackFog exposed MedusaHVNC, a MaaS RAT that runs browsers on a hidden Windows virtual desktop to commit banking fraud without the victim's awareness.
Fastjson CVE-2026-16723 Under Active Attack With No Patch
Fastjson CVE-2026-16723, a CVSS 9.0 Java RCE flaw with no patch, is under active attack against financial services, healthcare, computing, and retail targets.
TELESHIM Backdoor Hits Middle East Governments via Telegram C2
Zscaler ThreatLabz uncovered TELESHIM, MIXEDKEY, and BINDCLOAK — three new malware families an East Asia-linked APT used against Middle Eastern governments.
n8n Sandbox Escape GHSA-gv7g-jm28-cr3m Exposes Host OS Commands
July 28, 2026
n8n versions before 2.31.5 let authenticated users escape the expression sandbox via arrow functions and Reflect.get(), executing OS commands on
Operation BlueDash Delivers RMM Tools via Fake Teams Lures
July 28, 2026
Operation BlueDash deploys Level RMM and ScreenConnect against enterprises through fake Microsoft Teams and Zoom pages linked to a Nigerian
Cruciferra Crypter Combines BYOVD and Process Ghosting to Kill EDR
July 28, 2026
Cruciferra, a MaaS crypter active since fall 2025, bypasses EDR via BYOVD and Process Ghosting. TA4922, Silver Fox, and 11
Victims Sue Apple Over $1.8M Bitcoin Theft Via Fake Sparrow App
July 28, 2026
Three individuals sued Apple over a fake iOS Sparrow Wallet app that stole $1.8 million in Bitcoin by harvesting seed
ShinyHunters Claims Ernst & Young Breach via Third-Party System
July 28, 2026
ShinyHunters posted Ernst & Young to its leak site, claiming a supply-chain attack on a third-party ticket system that exposed
Origin Energy Breach Exposes Data on 900,000 Australian Customers
July 28, 2026
Origin Energy disclosed a breach affecting 900,000 Australian customers, exposing names, bank account fragments, and addresses amid unconfirmed ransom claims.
MedusaHVNC Hides Covert Browser Sessions in Windows Desktops
July 28, 2026
BlackFog exposed MedusaHVNC, a MaaS RAT that runs browsers on a hidden Windows virtual desktop to commit banking fraud without
Fastjson CVE-2026-16723 Under Active Attack With No Patch
July 27, 2026
Fastjson CVE-2026-16723, a CVSS 9.0 Java RCE flaw with no patch, is under active attack against financial services, healthcare, computing,
TELESHIM Backdoor Hits Middle East Governments via Telegram C2
July 27, 2026
Zscaler ThreatLabz uncovered TELESHIM, MIXEDKEY, and BINDCLOAK — three new malware families an East Asia-linked APT used against Middle Eastern
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.