The Hacker News

Today’s signal The Hacker News recently reported New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets. Published context: June 26, 2026. DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration for this variant. Tracked as CVE-2026-43503 (CVSS 8.8), it lets a local user corrupt file-backed memory through a cloned network packet and gain root. The patch ...

Today’s signal The Hacker News recently reported CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue. Published context: June 26, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. ...

Today’s signal The Hacker News recently reported CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited. Published context: June 24, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation of a critical security flaw impacting Lantronix EDS5000 Series devices, urging Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by June 26, 2026. The vulnerability in question is CVE-2025-67038 (CVSS score: 9.8), a code injection flaw ...

Today’s signal The Hacker News recently reported Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access. Published context: June 25, 2026. An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant. The vulnerability, tracked as CVE-2026-20245 (CVSS score: 7.8), allows an authenticated, local attacker to execute arbitrar ...

Today’s signal The Hacker News recently reported Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root. Published context: June 24, 2026. Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could ...

Today’s signal The Hacker News recently reported GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns. Published context: June 23, 2026. GitHub is moving to strengthen software supply chain security by updating “actions/checkout” to block pwn request attacks that exploit the risky use of the “pull_request_target workflow” trigger to run malicious code with the workflow’s full privileges. Effective June 18, 2026, the latest version of “actions/checkout,” the official GitHub action for checking ...

Today’s signal The Hacker News recently reported OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws. Published context: June 23, 2026. OpenAI on Monday said it’s releasing an improved version of its GPT‑5.5‑Cyber model to trusted defenders as part of the Daybreak initiative the artificial intelligence (AI) company announced last month. Calling GPT‑5.5‑Cyber its “strongest model yet for finding and helping patch software vulnerabilities,” OpenAI said the model can “sustain deeper analysis ac ...

Today’s signal The Hacker News recently reported INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific. Published context: June 22, 2026. A new report from INTERPOL has revealed a “dramatic increase” in cybercrime in Asia and the South Pacific, fueled by rapid digitalization, internet penetration, new technologies, organized criminal networks, and a disparity in cybersecurity maturity. According to INTERPOL’s 2025/2026 Asia and South Pacific Cyberthreat Assessment Report, phishing has emerged ...

Today’s signal The Hacker News recently reported F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution. Published context: June 18, 2026. F5 has released security updates to address two critical security flaws in NGINX Open Source that could be exploited to achieve code execution on affected systems. The vulnerabilities are listed below - CVE-2026-42530 (CVSS v4 score: 9.2) - A use-after-free vulnerability in the ngx_http_v3_module that could be triggered by a remote unauthenticated attacker w ...

Today’s signal The Hacker News recently reported Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys. Published context: June 20, 2026. Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that’s installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a medium-severity information disclosure flaw that can allow unauthenticated attackers to extract sensitive data, such as configuration data, API ke ...

Today’s signal The Hacker News recently reported The Top 10 Attack Surface Exposures in 2026. Published context: June 17, 2026. Breaches don’t always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. Wit ...

Today’s signal The Hacker News recently reported Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week. Published context: June 16, 2026. Bad actors are exploiting multiple security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber. In a post shared on X, the company said it has observed exploitation of CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 over the past 24 hours. CVE-2026-39813 (CVSS score: 9.1) refers to a path traversal vulnerability ...