Resecurity mapped the Iron Man System PhaaS operation using a lab deployment, packet capture, registry artifacts and binary analysis. It identified 2,360 phishing templates across 130 areas; Microsoft’s DCU facilitated disruption.
Researchers found that a hard-coded cookie-signing secret and publicly exposed user IDs let them forge sessions for 95 of 241 tested accounts, including administrators, in an authorized staging assessment, bypassing application-level SSO and MFA.
CISA added three actively exploited Cisco, Citrix and Fortinet vulnerabilities to its KEV catalog on Sept. 9, 2026, with a Sept. 12 federal remediation deadline. The article details affected builds, exploit paths and mitigations.
CVE-2026-65400 allows network attackers to bypass macOS Screen Sharing authentication. Apple patched supported releases; CISA lists it as exploited, and NCSC-NL reported exposed Macs compromised with XMRig. Researchers' detailed root-cause account remains partly unestt.
CVE-2025-62593 affects Ray versions before 2.52.0: DNS rebinding and a bypassable User-Agent check can let a webpage submit unauthenticated jobs to a local Ray Dashboard, potentially enabling code execution. Upgrade to 2.52.0 or later.
Resecurity says a 152.5-GiB archive tied to the March 2026 LiteLLM/Trivy campaign contains 415,427 CI secret-capture files across 2,038 repositories; its sample was dominated by GitHub Actions tokens. Attribution draws partly on published reporting.
Metabase says attackers exploited GHSA-vwf4-m7j8-wcjf, an unauthenticated SQL injection in password reset that can grant admin access. Self-hosted versions need patching; Framework reported unauthorized access to customer information.
Resecurity reports that ExfilSquad claimed 13 organizations as victims and posted torrents said to contain stolen data. Its analysis found more than 50 later seeds and early activity from hosts in China and Russia, without linking those hosts to the group.
Arista says CVE-2026-16812, an unauthenticated OS command injection in on-premises VeloCloud Orchestrator, is actively exploited. The flaw could expose SD-WAN management assets; fixed releases are available.
Resecurity reports exploitation of CVE-2026-15409 and CVE-2026-15410 to gain root access on SonicWall SMA 1000 appliances, linking activity to UTA0533 and INC Ransomware and detailing persistent implants and credential harvesting.
ReSecurity describes CVE-2026-42897 as stored XSS in on-premises Exchange OWA, reportedly exploited by TA488 to deploy the OWAReaper browser implant. It details mailbox persistence, token theft, command channels, patches and response steps.
A survey of AI pentesting agents explains their tool orchestration, autonomy and dual-use risks, citing reported attack cases and benchmark limits. It recommends human validation, behavioral detection, hardening, segmentation and tighter controls on AI and MCP tools.
CVE-2026-0770 lets unauthenticated attackers execute code through Langflow’s /api/v1/validate/code endpoint because validation used Python exec(). The article reports active exploitation and advises upgrading, investigating exposed instances, and rotating credentials.
The article says CISA confirmed active exploitation of three of six flaws in on-premises SharePoint Server. It describes web-shell and machine-key theft techniques, lists affected builds and patches, and recommends AMSI scanning, threat hunting, and network hardening.
The article says Illinois’ SB 315 requires annual AI safety disclosures and audits, reporting of significant incidents within 72 hours (24 hours for imminent threats), and restricts certain high-risk AI uses. Resecurity promotes related services.
Resecurity reports active exploitation of CVE-2026-48282, a ColdFusion RDS FILEIO path-traversal flaw enabling unauthenticated arbitrary file writes and potential RCE. CISA added it to KEV; Adobe fixed it in ColdFusion 2025 Update 10 and 2023 Update 21.
The guide explains how to fingerprint and enumerate AI infrastructure—including inference servers, MLflow, vector databases and notebooks—and how exposed APIs, metrics, credentials and dependencies can reveal systems and create security risks.
Resecurity describes CVE-2026-20253 as a pre-authentication RCE in Splunk Enterprise’s PostgreSQL Sidecar Service, chaining unauthenticated recovery endpoints, path traversal and PostgreSQL restore behavior; fixes are listed for affected releases.
The article describes reported ShinyHunters targeting of education platforms and FulcrumSec’s extortion claim against Global Schools Foundation, which confirmed a cyberattack. Specific stolen-data claims and attribution remain unverified or contested.
Resecurity reports that Anubis ransomware disrupted the Adriatic Port Authority, with files allegedly encrypted, data exfiltrated and a $10 million ransom demanded. The article provides no independent corroboration.
