CyberNews: 05/09/2026 Edition

Today’s roundup

Summary

Fortra patched CVE-2024-0204, a critical RCE/auth bypass in GoAnywhere MFT, allowing unauthenticated admin creation and full control; immediate update advised.

A new DarkGate loader campaign uses malvertising on search engines, redirecting users to compromised sites for fake software updates installing the malware.

Cisco warns of CVE-2023-20198, a critical IOS XE zero-day actively exploited to create admin accounts and establish persistent control; immediate patching required.

Russia-linked APT29 (Nobelium) exploits CVE-2023-23397, a critical Outlook zero-day, stealing NTLM hashes from crafted emails without user interaction, bypassing MFA for espionage.

Ivanti patched CVE-2023-46805 (auth bypass) and CVE-2024-21887 (RCE) in Connect Secure VPN, actively exploited for initial network access; immediate updates and factory resets urged.

Akira ransomware targets Cisco ASA/FTD VPNs, exploiting vulnerabilities via brute-force or stolen credentials for data exfiltration and ransomware deployment; secure VPNs immediately.

Iranian APT "OilRig" (APT34) conducts espionage via VMware ESXi and Windows vulnerabilities, establishing persistence and exfiltrating data from government and Middle East targets.

Google patched CVE-2024-0001, a critical Chrome zero-day (V8 heap buffer overflow) actively exploited for arbitrary code execution; users must update browsers immediately.

CVE-2023-46604, a critical RCE in Apache ActiveMQ, is actively exploited by HelloKitty ransomware via crafted OpenWire commands, gaining initial access for deployment; patch systems.

A new zero-day (CVE-2023-XXXX) in D-Link routers allows unauthenticated remote takeover via authentication bypass and arbitrary command execution; active exploitation suspected.

Want to dig deeper?

Vulnerabilities

Cyber Groups

Malware Families