Hackers exploit YOOtheme Pro vulnerability CVE-2026-102785 (CVSS 10) for remote code execution, dropping webshells. Update to 5.0.53 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post YOOtheme Pro Vulnerability CVE-2026-102785 (CVSS 10) Exploited for Remote Code Execution appeared first on Daily CyberSecurity.

Unit 42 reveals the CL-UNK-1211 SysGoRAT malware campaign, where attackers use AI scripts and SysGoRAT malware to breach government Linux servers.

Related Posts:

• 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks
• Aoki Infostealer Harvests API Keys and Tokens From AI Coding Assistants
• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

The post CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers appeared first on Daily CyberSecurity.

Ransomware gangs exploit CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to slip past MFA and open VPN sessions. Patch now.

Related Posts:

• OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build
• AdFection Spyware Attack Targets Al Jazeera Devices
• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

The post Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access appeared first on Daily CyberSecurity.

Unit 42 reveals how CL-STA-0954 deploys PEERSTITCH malware after a FortiManager breach, using FortiOS PEERSTITCH malware to hijack firewalls.

Related Posts:

• Fake WatchGuard VPN Site Steals Credentials Before Delivering Genuine Installer
• CodeAudit AI VS Code Extension Captures Developer Source Code in the Background
• Ledger Supply Chain Attack Hits Europe via Tampered Wallets

The post CL-STA-0954 Deploys PEERSTITCH Malware on FortiGate Firewalls After FortiManager Breach appeared first on Daily CyberSecurity.

The Blinder Tunnel campaign used a fake Dubai Airports coding test to drop ShelbyLoader V2 on an Iraqi target. See how it works and how to defend.

Related Posts:

• ccTLD Registry Hijacks Let Attackers Mint TLS Certs
• ShinyHunters Hacker Arrest in Jordan Aids FBI Probe
• Warlock Ransomware Group Hits Water and Telecom Operators Through SharePoint Flaws

The post Iran-Linked Hackers Pose as Dubai Airports Recruiters in Blinder Tunnel Campaign Against Iraq appeared first on Daily CyberSecurity.