vBulletin Patches Critical RCE Vulnerability Amid Public Exploit Concerns
vBulletin released patches for critical pre-auth PHP template RCE; public exploit demonstrating eval() usage is available.
§Source · Bleeping Computer
Bleeping Computer
Every dispatch we have aggregated from Bleeping Computer.
All dispatchesWednesday, July 29
Legacy Flaw Exposes Over 24,000 BMC Interfaces to Password Hash Leaks
Researchers found 24,650 internet-exposed BMC/IPMI interfaces disclosing password-derived hashes before login, enabling offline cracking.
DNS Hijacking Disrupts CubePilot's Drone Services
CubePilot reports DNS hijack disrupted drone flight-controller developer services and intercepted customer traffic and updates.
CISA Issues Guidance on Isolating Critical Systems Amid Cyber Threats
U.S. and Australian guidance from CISA advises critical infrastructure to prepare for isolating OT systems during cyber incidents.
Massive Data Breach at Medical Billing Firm Exposes Patient Records
Medical Computer Business Services breach exposed sensitive records of over 1.26 million patients from billing systems.
Monday, July 27
Sunday, July 26
Qilin Ransomware Gang Exploits Critical Vulnerability in Palo Alto VPN
Qilin ransomware exploits critical Palo Alto PAN-OS GlobalProtect authentication bypass to breach networks and deploy ransomware.
Addressing Windows LegacyHive Zero-Day Flaw with New Patches
Windows LegacyHive local privilege escalation zero-day allows attackers to gain elevated privileges on up-to-date Windows systems.
Major Crypto Heist: Ostium Loses $23.7 Million in Sophisticated Attack
Off-chain infrastructure compromise at Ostium enabled attackers to steal $23.75M in cryptocurrency from liquidity vaults.
Exploited SharePoint Vulnerability Poses Persistent Security Threat
SharePoint CVE-2026-50522 exploited to steal machine keys enabling persistent access even after patching.
Exploited WordPress Vulnerabilities Lead to Webshell Installations
Active exploitation of wp2shell (CVE-2026-63030, CVE-2026-60137) enables webshell installation and site takeover on many WordPress hosts.
Friday, July 24
Zimbra Zero-Click Vulnerability Exploited by Russian Group
PremiumRussia-linked Laundry Bear leveraged a Zimbra zero-click vulnerability to steal emails, prompting international advisories and urgent patching.
Check Point Addresses Critical SmartConsole Vulnerability
PremiumCheck Point patched an actively exploited SmartConsole zero-day used against customer admin panels; immediate patching recommended.
Monday, July 20
Microsoft Highlights Rising Threat of ACR Stealer Attacks
PremiumMicrosoft reports a surge in ACR Stealer attacks exfiltrating browser credentials, tokens, and sensitive documents from customers.
Hackers Exploit ViPNet Software to Compromise Russian Government Agencies
PremiumThreat actors abused ViPNet update mechanism to push malicious updates targeting Russian government organizations.
Windows Zero-Day Exploit Elevates Threat Levels for Admin Access
PremiumLegacyHive Windows zero-day exploit enables privilege escalation to admin on up-to-date Windows systems via registry hive flaws.
Ernst & Young Hit by Data Breach Exposing Client Tax Documents
PremiumEY discloses breach of a third-party support ticket system, with client tax documents accessed and downloaded.
Urgent Patch Required for Fortinet FortiSandbox Vulnerabilities
PremiumCISA mandated urgent patching for actively exploited Fortinet FortiSandbox vulnerabilities with near-term federal deadlines.
Friday, July 17
Russian Hackers Exploit WebEx and Zoom to Spread Starland Malware
PremiumRussian actor UAT-11795 trojanized WebEx and Zoom installers to deploy Starland RAT, stealing credentials and crypto.
Spirals Ransomware Poses Urgent Challenge with Rapid Network Encryption
PremiumSpirals ransomware completes intrusion-to-encryption in under 24 hours, stressing the need for rapid detection and response.
Get these articles delivered to your inbox.
Subscribe free