Latest Actively Exploited news

Hackers target WordPress database plugin active on 1 million sites

Malicious activity targeting a critical severity flaw in the 'Better Search Replace' WordPress plugin has been detected, with researchers observing thousands of attempts in the past 24 hours.
- Bill Toulas
- January 25, 2024
- 09:15 AM
- 2
Apple fixes first zero-day bug exploited in attacks this year

Apple released security updates to address this year's first zero-day vulnerability exploited in attacks that could impact iPhones, Macs, and Apple TVs.
- Sergiu Gatlan
- January 22, 2024
- 02:20 PM
- 0
Hackers start exploiting critical Atlassian Confluence RCE flaw

Security researchers are observing exploitation attempts for the CVE-2023-22527 remote code execution flaw vulnerability that affects outdated versions of Atlassian Confluence servers.
- Bill Toulas
- January 22, 2024
- 08:41 AM
- 0
CISA emergency directive: Mitigate Ivanti zero-days immediately

CISA issued this year's first emergency directive ordering Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate two Ivanti Connect Secure and Ivanti Policy Secure zero-day flaws in response to widespread and active exploitation by multiple threat actors.
- Sergiu Gatlan
- January 19, 2024
- 02:25 PM
- 0
VMware confirms critical vCenter flaw now exploited in attacks

VMware has confirmed that a critical vCenter Server remote code execution vulnerability patched in October is now under active exploitation.
- Sergiu Gatlan
- January 19, 2024
- 08:22 AM
- 0
CISA: Critical Ivanti auth bypass bug now actively exploited

CISA warns that a critical authentication bypass vulnerability in Ivanti's Endpoint Manager Mobile (EPMM) and MobileIron Core device management software (patched in August 2023) is now under active exploitation.
- Sergiu Gatlan
- January 18, 2024
- 03:51 PM
- 0
Citrix warns of new Netscaler zero-days exploited in attacks

Citrix urged customers on Tuesday to immediately patch Netscaler ADC and Gateway appliances exposed online against two actively exploited zero-day vulnerabilities.
- Sergiu Gatlan
- January 16, 2024
- 03:33 PM
- 0
Google fixes first actively exploited Chrome zero-day of 2024

Google has released security updates to fix the first Chrome zero-day vulnerability exploited in the wild since the start of the year.
- Sergiu Gatlan
- January 16, 2024
- 02:13 PM
- 1
Ivanti Connect Secure zero-days now under mass exploitation

Two zero-day vulnerabilities affecting Ivanti's Connect Secure VPN and Policy Secure network access control (NAC) appliances are now under mass exploitation.
- Sergiu Gatlan
- January 15, 2024
- 08:05 PM
- 0
Ivanti Connect Secure zero-days exploited to deploy custom malware

Hackers have been exploiting the two zero-day vulnerabilities in Ivanti Connect Secure disclosed this week since early December to deploy multiple families of custom malware for espionage purposes.
- Bill Toulas
- January 12, 2024
- 10:30 AM
- 0
CISA warns agencies of fourth flaw used in Triangulation spyware attacks

The U.S. Cybersecurity and Infrastructure Security Agency has added to its to the Known Exploited Vulnerabilities catalog six vulnerabilities that impact products from Adobe, Apache, D-Link, and Joomla.
- Bill Toulas
- January 09, 2024
- 02:32 PM
- 0
Hackers target Apache RocketMQ servers vulnerable to RCE attacks

Security researchers are detecting hundreds of IP addresses on a daily basis that scan or attempt to exploit Apache RocketMQ services vulnerable to a remote command execution flaw identified as CVE-2023-33246 and CVE-2023-37582.
- Bill Toulas
- January 05, 2024
- 12:32 PM
- 0
CISA warns of actively exploited bugs in Chrome and Excel parsing library

The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to the Known Exploited Vulnerabilities catalog, a recently patched flaw in Google Chrome and a bug affecting an open-source Perl library for reading information in an Excel file called Spreadsheet::ParseExcel.
- Bill Toulas
- January 03, 2024
- 07:55 AM
- 0
Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers

A critical Apache OFBiz pre-authentication remote code execution vulnerability is being actively exploited using public proof of concept (PoC) exploits.
- Bill Toulas
- December 28, 2023
- 11:20 AM
- 0
QNAP VioStor NVR vulnerability actively exploited by malware botnet

A Mirai-based botnet named 'InfectedSlurs' is exploiting a remote code execution (RCE) vulnerability in QNAP VioStor NVR (Network Video Recorder) devices to hijack and make them part of its DDoS (distributed denial of service) swarm.
- Bill Toulas
- December 16, 2023
- 11:17 AM
- 0
Hackers are exploiting critical Apache Struts flaw using public PoC

Hackers are attempting to leverage a recently fixed critical vulnerability (CVE-2023-50164) in Apache Struts that leads to remote code execution, in attacks that rely on publicly available proof-of-concept exploit code.
- Bill Toulas
- December 13, 2023
- 11:19 AM
- 1
Sophos backports RCE fix after attacks on unsupported firewalls

Sophos opted to backport a security update for CVE-2022-3236 for end-of-life (EOL) firewall firmware versions after discovering hackers actively exploiting the flaw in attacks.
- Bill Toulas
- December 12, 2023
- 12:29 PM
- 0
Hackers breach US govt agencies using Adobe ColdFusion exploit

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning about hackers actively exploiting a critical vulnerability in Adobe ColdFusion identified as CVE-2023-26360 to gain initial access to government servers.
- Bill Toulas
- December 05, 2023
- 12:07 PM
- 2
Russian hackers exploiting Outlook bug to hijack Exchange accounts

Microsoft's Threat Intelligence team issued a warning earlier today about the Russian state-sponsored actor APT28 (aka "Fancybear" or "Strontium") actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts and steal sensitive information.
- Bill Toulas
- December 04, 2023
- 03:14 PM
- 0
Cactus ransomware exploiting Qlik Sense flaws to breach networks

Cactus ransomware has been exploiting critical vulnerabilities in the Qlik Sense data analytics solution to get initial access on corporate networks.
- Bill Toulas
- November 30, 2023
- 12:46 PM
- 0