The Exploit HQ

Cybersecurity made practical. Daily threat briefs, clear patch priorities, and safe hands-on demos for beginners. Learn what matters and what to do

[The Exploit HQ @TheExploitHQ]

New to cybersecurity? Start here.

The Exploit HQ helps you understand:
• Which threats matter
• What to patch and why
• How security tools work through safe demos

Follow for clear explanations and practical next steps.

Watch: https://t.co/oU59XHavkT

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/Me0M7AYWhV

Primary sources:
- Adobe Commerce / Magento and Google Brotli: https://t.co/lKzNetEeo0
- VMware ESX and Linux Kernel: https://t.co/nklvn8Buxk
- Cisco Secure Firewall ASA and FTD Software: https://t.co/6yXkXbNjpv
- U.S. Department of Justice / Hive and Nefilim Ransomware: https://t.co/tEdiAKf0sc

[The Exploit HQ @TheExploitHQ]

[!] Adobe Commerce / Magento and Google Brotli: active exploitation confirmed.

Apply patches for Adobe Commerce and update software libraries using Google Brotli in accordance with CISA BOD 26-04.

[!] ACTIVELY EXPLOITED
- Adobe Commerce / Magento and Google Brotli - CVE-2026-48356, CVE-2026-111497 (CISA KEV)
- VMware ESX and Linux Kernel - CVE-2026-41709, CVE-2026-46300, CVE-2026-109618, CVE-2026-109619 (CISA KEV)
- Cisco Secure Firewall ASA and FTD Software - CVE-2026-76418
- U.S. Department of Justice / Hive and Nefilim Ransomware - ransomware

[>] Full 7-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel #VMWare #Adobe #Cisco #CISA

[The Exploit HQ @TheExploitHQ]

AWS Strands masking bypass: upgrade and rotate exposed credentials. #AWS #StrandsAgents #n8n #MCP #Tabularis
https://t.co/J8MeN6btrY

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/NiUEFyjAay

Primary sources:
- PHP: https://t.co/OBCMnXXkKC
- Adobe Commerce, Magento, and Google Brotli: https://t.co/lKzNetEeo0
- U.S. Department of Justice / Nefilim and Hive Ransomware: https://t.co/tEdiAKf0sc
- GMO Internet https://t.co/XqisNW4lHM Desktop Cloud: https://t.co/KDqUovjN7X

[The Exploit HQ @TheExploitHQ]

[!] PHP: active exploitation confirmed.

Immediately update PHP installations to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, prioritizing internet-facing systems.

[!] ACTIVELY EXPLOITED
- PHP - CVE-2026-109618, CVE-2026-109619 (remote code execution)
- Adobe Commerce, Magento, and Google Brotli - CVE-2026-48356, CVE-2026-111497 (CISA KEV)
- U.S. Department of Justice / Nefilim and Hive Ransomware - ransomware
- GMO Internet https://t.co/XqisNW4lHM Desktop Cloud - ransomware

[!] DEVELOPING
- The Privacy Commissioner of Canada initiated an investigation into Navigate360 over a data breach involving its tip management platform used by Crime Stoppers programs
- The University of New Mexico Health Sciences Center restored critical electronic systems after containing a cybersecurity event that affected some end-user devices without penetrating core servers
- Singapore's Personal Data Protection Commission opened an investigation into Alliance Medinet following an unauthorized access incident involving its membership database

[>] Full 10-min brief with sources in the first reply.

[The Exploit HQ @TheExploitHQ]

OpenHands sandbox ports exposed root commands. Check your deployment. #OpenHands #VulnCheck #Docker #Apptainer #Cohere #Alibaba #Qwen #Microsoft #DeepSeek #UniversityOfRochester
https://t.co/Jxd7fxCGN0

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/vtvrIPqVVF

Primary sources:
- PHP: https://t.co/DCQGlfBgW0

[The Exploit HQ @TheExploitHQ]

[!] PHP: active exploitation confirmed.

Federal agencies must remediate both vulnerabilities under BOD 26-04, and all organizations should prioritize patching them.

[!] ACTIVELY EXPLOITED
- PHP - CVE-2026-109618, CVE-2026-109619 (CISA KEV)

[!] DEVELOPING
- Wiz Research reported on Gheist, an automated campaign mass-abusing compromised GitHub tokens to exfiltrate secrets via GitHub Actions workflows
- CISA unveiled its CISA 2030 strategic plan to transition toward an aggressive, anticipatory posture protecting critical infrastructure

[>] Full 5-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

@OpenAI We need to see how this new model will work on both sides of cybersecurity (red and blue teams).

[The Exploit HQ @TheExploitHQ]

Gheist steals GitHub secrets. Revoke tokens; rotate secrets. #Wiz #GitHub #Anthropic #HuggingFace #Groq #NVIDIA #AWS #Amazon #Google #Microsoft #HashiCorp #IBM #Xinference #Xorbits #Unitree #Leon #VulnCheck
https://t.co/dUvgCBMNjs

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/kb9dcoUzhW

Primary sources:
- Arista VeloCloud Orchestrator: https://t.co/90gHXGe7tU
- Collabora Online Built-in CODE Server for Nextcloud: https://t.co/90gHXGe7tU

[The Exploit HQ @TheExploitHQ]

[!] Arista VeloCloud Orchestrator: active exploitation confirmed.

Upgrade to a fixed VCO release as soon as possible and preserve logs if compromise is suspected.

[!] ACTIVELY EXPLOITED
- Arista VeloCloud Orchestrator - CVE-2026-114625 (CISA KEV)
- Collabora Online Built-in CODE Server for Nextcloud - CVE-2026-110447 (CISA KEV)

[!] PATCH NOW
- JPCERT/CC updated its security alert warning that proof-of-concept exploit codes and communications attempting exploitation have been observed for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

[!] DEVELOPING
- JPCERT/CC warned that an out-of-bounds write vulnerability in Google's Brotli C implementation can cause application crashes, memory disclosure, or arbitrary code execution (CVE-2026-111497)

[>] Full 6-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

[!] Collabora Online / Nextcloud CODE Server: active exploitation confirmed.

Update the Collabora Online Built-in CODE Server (richdocuments) app to version .303 or later immediately.

[!] ACTIVELY EXPLOITED
- Collabora Online / Nextcloud CODE Server - CVE-2026-110447 (CISA KEV)
- Arista VeloCloud Orchestrator (VCO) On-Prem - CVE-2026-114625

[!] PATCH NOW
- Palo Alto Networks confirmed that PAN-OS firewalls and Panorama management appliances are affected by PHP2Shell vulnerabilities, with fixes in upcoming releases (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560)

[!] DEVELOPING
- CISA warned that InterSystems IRIS for Health has TLS/SSL encryption disabled by default, allowing attackers to intercept transmitted data and log in (CVE-2026-111594)

[>] Full 6-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

LiteLLM 1.107.0 shipped credential-stealing malware. Rebuild affected environments and rotate exposed secrets. #LiteLLM #GitHub #Docker #AWS #Amazon #BerriAI
https://t.co/ZblHPJOq71

[The Exploit HQ @TheExploitHQ]

@ollama This is why local matters: redaction tools miss things. We demonstrated that with a fictional support ticket and a local Ollama workflow on The AI Security HQ. Redact, keep inference local, check the output, then get human approval.

https://t.co/DvctvN5itc

[The Exploit HQ @TheExploitHQ]

@NetworkChuck I've used it for several months and it's been getting dumber

[The Exploit HQ @TheExploitHQ]

@claudeai Is not who made it first, is who make it better than the others.

[The Exploit HQ @TheExploitHQ]

ARTEX targets vendors. Review sign-in logs. #Wiz #Microsoft #Baidu #GitHub #Zscaler #Okta #Amazon #AWS #Anthropic #Theorem #HiddenLayer #TogetherAI #FireworksAI #LiteLLM #BerriAI #OpenAI #VirusTotal #Google #NVIDIA #Tencent #Cisco #Cline #Ollama
https://t.co/SqHy953c2J

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/rstUt8qvVR

Primary sources:
- Siemens Software Center: https://t.co/sPM4of68uH
- Arista VeloCloud Orchestrator (VCO) On-Prem: https://t.co/yfMQRFteHq

[The Exploit HQ @TheExploitHQ]

[!] Siemens Software Center: active exploitation confirmed.

Update Siemens Software Center to the latest version and inspect AppData directories for unauthorized binaries.

[!] ACTIVELY EXPLOITED
- Siemens Software Center - CVE-2026-110936 (CISA KEV)
- Arista VeloCloud Orchestrator (VCO) On-Prem - CVE-2026-114625

[!] PATCH NOW
- The PHP Group released emergency security updates fixing two critical unauthenticated remote code execution vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

[!] DEVELOPING
- ConnectWise confirmed unauthorized access to application credentials for Cloud Backup, attributing the incident to a China state-aligned group using agentic AI
- Microsoft Threat Intelligence reported that Chinese state-aligned group Storm-0940 leveraged the ARTEX agentic AI framework to automate attacks following a ConnectWise supply-chain compromise

[>] Full 7-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel