Skip to main content
IMMUNITYSEC

Cybersecurity News & Intelligence

Page 3 of 3. News on actively exploited vulnerabilities, hacking and extortion campaigns, AI security incidents, and patching priorities.

Updated

Latest Articles

18 total
AI Security News & Analysis
2026-08-29•4 min read

Claude, Codex, and Hermes installed unclaimed code packages listed in corporate llms.txt files

Researchers found 120 corporate websites whose llms.txt files, guides published for AI tools, told readers to install code packages that nobody had registered, Ars Technica reported on August 27, 2026. After the researchers registered some of those names, AI coding agents including Claude, OpenAI Codex, and Nous Research Hermes installed them inside corporate networks, the first at a Fortune 500 company within an hour. One such package, linked from clerk.com, already contained malware.

Threat Intelligence News & Analysis
2026-08-28•3 min read

DOJ and FBI seize QScan and QTRouter, two hacking platforms run by China state-sponsored group QTFY

On August 26, 2026, the U.S. Justice Department and FBI announced they had seized internet domains behind QScan and QTRouter, two hacking platforms that court documents say were run by QTFY, a Chinese state-sponsored group employed by Nanjing Xinjiuwei Network Technology Company. According to an FBI affidavit, the group has targeted U.S. federal networks since at least 2018, including NASA, the Federal Reserve, the Department of Energy, the Department of Justice, HHS, NIH, and the U.S. Senate. On August 28 the DOJ corrected its statement to say the agencies were targets, only some of which were compromised.

Defensive Engineering News & Analysis
2026-08-27•4 min read

CISA adds exploited Citrix NetScaler flaw and five older bugs to its KEV catalog

CISA added six vulnerabilities to its catalog of flaws known to be used in attacks on August 26, 2026. Researchers showed that the newest, CVE-2026-8452 in Citrix NetScaler ADC and NetScaler Gateway, lets attackers run their own code on the appliance without logging in. Federal civilian agencies had until August 29 to fix it.

Vulnerability News & CVE Analysis
2026-08-26•3 min read

Vercel patches two critical Next.js flaws that let attackers run code on servers

Vercel released Next.js 15.5.24 and 16.3.3 on August 25, 2026, moving the release forward to fix two critical flaws that let attackers run code on servers without logging in. One affects sites hosted on Windows servers and has no workaround. The other comes from an image library that Next.js uses to process AVIF images.

Defensive Engineering News & Analysis
2026-08-18•4 min read

Suspected China-linked hackers exploit VMware vCenter flaw five days after Broadcom fix

A hacking group that researchers suspect is Chinese-speaking began exploiting CVE-2026-59310, a critical flaw in VMware vCenter Server, five days after Broadcom released a fix on July 29, 2026. German incident response firm QUIRSO counted 361 victim IP addresses in 47 countries and found ransomware in one network it analyzed.

Vulnerability News & CVE Analysis
2026-08-12•3 min read

Microsoft patches SharePoint flaw CVE-2026-63520 that lets attackers run code on servers

Microsoft has patched CVE-2026-63520, a SharePoint Server flaw that lets an attacker with a SharePoint login run code on the server, according to Rapid7, which disclosed it with Microsoft on August 11, 2026. Microsoft's advisory says an attacker without a login could exploit it. Combined with a separate login bypass, CVE-2026-55040, the attack needs no account. CISA added CVE-2026-55040 to its catalog of exploited vulnerabilities on August 18 with a due date of August 21, 2026.