threat-intel LAPSUS$ réapparaît autour d’une attaque contre Courir The LAPSUS$ group, a notorious name in cybercrime, has seemingly resurfaced, attempting to rebuild its operations and recruit insiders. The group, claiming continuity with its past, is now seeking privileged access within telecom, SaaS, cloud, and hosting environments, offering exclusive access packages. Following thi… ZATAZ · 2h ago High FRrecruitmentaccess-brokercybercrime
vulnerability Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE Multiple critical vulnerabilities have been discovered in popular WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These flaws could lead to complete site takeover, all… The Hacker News · 1d ago Critical CVE-2026-76581CVE-2026-18431CVE-2026-19632wordpressvulnerabilityplugin
threat-intel Pokémon Center touché par la cyberattaque d’un prestataire A cyberattack targeting CEVA Logistics, a third-party logistics provider, has exposed customer data of the Pokémon Center in Europe. This follows a similar incident affecting Steam users and The Pokémon Company, with pot… ZATAZ · Aug 21, 2026 High FRsupply-chainphishingdata-breach
threat-intel Puériculture : trois bases clients revendiquées en 2026 A series of announcements on Russian forums are claiming that ChimeraZ, a hacker, has leaked customer databases belonging to Madeinbebe.com, Allobebe.fr, and Babyvista, a maternity photography company, in 2026. These dat… ZATAZ · Aug 21, 2026 High data-breachcustomer-datafraud
threat-intel Fuite Stripe : au moins 200 Français concernés A massive data leak linked to Stripe has exposed the email addresses of at least 200 French users, including both customers and merchants, alongside a significant number of addresses from various services across France,… ZATAZ · Aug 20, 2026 High FRBECAdata breachemail leakcyber intelligence
threat-intel EVA visée par une nouvelle fuite de données, le pirate génére 1 million d’euros de cartes cadeaux ! A data breach affecting EVA Nantes Sud, a subsidiary of VR game developer EVA, has been disclosed. A hacker claims to have stolen a database containing customer data, commercial information, and potentially exploitable g… ZATAZ · Aug 14, 2026 High FRdata breachgift cardscrm
vulnerability Magento visé quelques heures après la divulgation d’un correctif A critical vulnerability (CVE-2026-71362) in Adobe Commerce, Commerce B2B, and Magento Open Source has been actively exploited shortly after its patch release. While no confirmed customer breaches have been publicly repo… ZATAZ · Aug 13, 2026 Critical CVE-2026-71362session hijackingpatchecommerce
vulnerability Adobe Commerce Bug Targeted Immediately After Disclosure A critical vulnerability in Adobe Commerce and Magento allowed unauthenticated attackers to gain access to other customer accounts immediately after its disclosure. Adobe swiftly released a patch, but threat actors were… SecurityWeek · Aug 13, 2026 Critical CVE-2026-71362vulnerabilityecommerceadobe
vulnerability Multiples vulnérabilités dans les produits Adobe (13 août 2026) Multiple vulnerabilities have been discovered in Adobe products, including Adobe Commerce and ColdFusion. These vulnerabilities allow for remote code execution, privilege escalation, denial of service, and circumvention… CERT-FR · Aug 13, 2026 High CVE-2026-21273CVE-2026-21279CVE-2026-25652vulnerabilitypatchadobe
vulnerability Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws Multiple security flaws have been patched across Firefox, Chrome, Adobe products (including ColdFusion, Commerce, Experience Manager, and Illustrator), and VMware. Mozilla addressed two critical vulnerabilities in Firefo… The Hacker News · Jul 15, 2026 High CVE-2026-15718CVE-2026-15719CVE-2026-15764UNsecurity updatevulnerabilitypatch
threat-intel Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites A cybercrime crew exposed its operations – including tools, logs, and target lists – after leaving a server open for three weeks. The WP-SHELLSTORM operation, which involved planting webshells on vulnerable WordPress and… The Hacker News · Jul 10, 2026 High CVE-2026-3844CVE-2021-29441CVE-2026-3300CHwebshellvulnerabilityexploit
threat-intel Supreme Court decision threatens EU-US data transfer agreement A Supreme Court ruling questioning the independence of the U.S. Federal Trade Commission (FTC) poses a significant threat to the EU-U.S. Data Privacy Framework (DPF), a key agreement enabling data transfers between the t… The Record · Jul 2, 2026 High USEUdataprotectionprivacyeu-us
threat-intel 'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat This article details a new supply chain threat dubbed "Phantom Squatting," where large language models (LLMs) are hallucinating non-existent web domains linked to legitimate brands. Cybercriminals are exploiting this by… Dark Reading · Jul 1, 2026 High USllmsupply chainai
malware Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts Microsoft removed 119 malicious Edge extensions from its add-on store that employed steganography to hide malware, including credential theft and ad fraud capabilities. The operation, dubbed StegoAd, had been active sinc… The Hacker News · Jun 29, 2026 High CHsteganographycredential theftad fraud
supply-chain ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack A supply chain attack compromised multiple WordPress plugins from ShapedPlugin, injecting backdoor code into Pro plugin releases distributed through official update channels. The malicious plugins, affecting versions of… The Hacker News · Jun 22, 2026 Critical CVE-2026-49777CVE-2026-10735wordpresssupply chainbackdoor
threat-intel A Glimpse into the “Search Your Target” Market for Stolen Credentials This report details a growing underground market where threat actors are offering ‘search your target’ services, leveraging massive collections of stolen credentials. Researchers analyzed 470 forum posts revealing a serv… BleepingComputer · Jun 22, 2026 High UScredential theftinfostealerunderground market
vulnerability Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin Hackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin, allowing them to access sensitive information such as API keys and email service credentials. This flaw, tracked as CVE-2026-4020, has… BleepingComputer · Jun 19, 2026 Medium CVE-2026-4020CVE-2026-8713wordpressapicredentials
supply-chain ShapedPlugin update flow hacked to infect WordPress sites A supply-chain attack targeting WordPress plugins from ShapedPlugin resulted in malicious updates containing a backdoor designed to steal sensitive data from affected websites. The attack exploited a compromised build pi… BleepingComputer · Jun 18, 2026 High CVE-2026-10735CVE-2026-49777wordpresssupply chainbackdoor
supply-chain OptinMonster WordPress plugin hacked in CDN supply-chain attack A supply-chain attack targeting the Awesome Motive CDN compromised WordPress plugins OptinMonster, TrustPulse, and PushEngage. Attackers gained access through a vulnerability in the UpdraftPlus plugin, leveraging the CDN… BleepingComputer · Jun 15, 2026 High UScdnwordpresssupply chain
malware Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites A security incident has been discovered affecting over 1.2 million WordPress sites using the PushEngage, OptinMonster, and TrustPulse plugins. An attacker tampered with the plugins' JavaScript files, creating backdoors t… The Hacker News · Jun 15, 2026 High CVE-2026-10795USwordpresscdnbackdoor
