Security Affairs

Attackers are exploiting SharePoint flaw CVE-2026-55040 after a public PoC was released, allowing unauthenticated users to impersonate administrators. Attackers started exploiting CVE-2026-55040 (CVSS score of 9.1), a critical SharePoint authentication by

Bad Epoll (CVE-2026-46242) lets local attackers gain root on Linux and Android. The flaw was missed by AI but found by a security researcher.

FBI says TeamPCP poisoned trusted developer tools to steal cloud credentials, spread malware through software updates, and extort victims.

Attackers are exploiting the patched Ghost CMS flaw CVE-2026-26980, compromising over 700 unpatched sites, including universities.

Operation PowerOFF shut down 53 DDoS-for-hire domains, arrested four suspects, and exposed data on over 3 million criminal user accounts.

Mirax Android RAT spreads via Meta ads, infected 220,000 users and turns devices into SOCKS5 proxies, giving attackers full remote control.

Hackers breached Venice 's San Marco flood system, claiming control of pumps and the ability to disable defenses and flood coastal areas.

Masjesu is a DDoS-for-hire botnet targeting IoT devices, active since 2023 and designed to stay hidden by avoiding high-profile networks

Drift lost $285M in a sophisticated attack, likely by North Korea , who used nonce-based tricks to gain control and quickly drain funds

Iran-linked hackers claim to have breached Israeli air defence contractor PSK Wind, which develops command and control systems.