Bogdan D Sergiu

'It's not who I am underneath, but what I do that define me'

[Florian Roth ⚡️ @cyb3rops]

This would be bad ..

[Blue Team News @blueteamsec1]

Zimbra urges customers to patch critical web client XSS flaw https://t.co/E1iOO7mmWr #Security

[Netlas.io @Netlas_io]

Apache Kafka OAUTHBEARER authentication bypass, no CVE assigned yet, 8.1 rating 🔥

The vulnerability is a missing 'exp' enforcement in the SASL/OAUTHBEARER unauthenticated token acceptance path on the broker side. An attacker holding any historical Kafka session JWT can replay it indefinitely after the JWT's own 'exp' has passed.

👉https://t.co/mJRpMZjDK5

[/r/netsec @_r_netsec]

Inside an AI coal mine security camera network powered by plaintext passwords https://t.co/hvCkTAgDh6

[Blue Team News @blueteamsec1]

New Helix vishing group emerges in SharePoint data theft attacks https://t.co/sEwJViNSoa #Security

[Blue Team News @blueteamsec1]

Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama https://t.co/7nMhs8feIL #cyber #threathunting #infosec

[Daily CyberSecurity @Daily_CyberSec]

CVE-2026-13753 exposes a missing authorization vulnerability in HP Deskjet 2800 printers. Unauthenticated attackers can extract sensitive Wi-Fi credentials.
#CVE202613753 #HPDeskjet #CyberSecurity #Vulnerability #PrinterSecurity
https://t.co/qakI60dAbt

[SOCRadar® @socradar]

One actor. 27 weaponized CVEs. 1.4M+ WordPress sites targeted. 🚨

WP-SHELLSTORM is a massive lesson in scaled attacks, leaving 5,700+ active webshells in its wake (alongside a parallel Nacos/Java campaign).

Time to audit your infrastructure, mitigate the risk, and strengthen your posture before automated scanners find you.

🔍 Read the intel: https://t.co/Huk8E7vfkH
#CyberSecurity #WordPress #ThreatIntel #Webshell

[Dark Web Informer @DarkWebInformer]

💥 CVE-2026-44825: A scanner for Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions.

GitHub: https://t.co/fSw1grZdlK

[Cyber Security News @The_Cyber_News]

RoundCube 0-Click Vulnerability Enables Stored XSS Attack via MIME Type Attachment

Source: https://t.co/1XzXjZ15rW

RoundCube has released version 1.7 to patch six security vulnerabilities, including two critical stored cross-site scripting (XSS) flaws that require zero user interaction to exploit.

The most severe issue, tracked as CVE-2026-54432, involves a stored XSS vulnerability triggered by an unescaped attachment MIME type displayed on the attachment-validation warning page.

An attacker can craft a malicious MIME type string that, when rendered without proper sanitization, executes arbitrary JavaScript in the victim’s session.

#cybersecuritynews

[Daily CyberSecurity @Daily_CyberSec]

Progress patched three MOVEit Transfer flaws, including a stored XSS bug (CVE-2026-11903). No exploitation is confirmed. Update now.
#MOVEit #MOVEitTransfer #StoredXSS #XSS #CVE #ProgressSoftware #PatchNow #InfoSec
https://t.co/SRou3RoNaD

[Daily CyberSecurity @Daily_CyberSec]

OPNsense root RCE flaws are public with PoC code. CVE-2026-57155 (9.9) chains an arbitrary file write to root. Patch 26.1.11 or 26.4.1p1 now.
#OPNsense #RootRCE #RCE #FirewallSecurity #CyberSecurity #Vulnerability #InfoSec #PoC
https://t.co/CfeeEK9rr9

[Daily CyberSecurity @Daily_CyberSec]

A Roundcube zero-click XSS, CVE-2026-54433, lets an email run script with no click. Roundcube 1.7.2 also fixes a second stored XSS. Update now.
#Roundcube #XSS #ZeroClick #Webmail #StoredXSS #CyberSecurity #Vulnerability #InfoSec
https://t.co/pkdbSSekhy

[Cyber Detective💙💛 @cyb_detective]

APT Intelligence

Threat Nexus
https://t.co/ViGL8Pb8Wb

APTMap
https://t.co/DoCFCYlTZm

Threat Group Cards: A Threat Actor Encyclopedia
https://t.co/GwOJeGmpSW

Global Threat Map
https://t.co/dgdoRLcbue

APT & Threat Actor Resources
https://t.co/n8HWwOsNBb

#cti #cybersecurity

[Rıdvan Yağlı @ridvanyagli]

🔴 Bir siber güvenlik araştırmacısı, iddiasına göre, kendi geliştirdiği AI/LLM tabanlı güvenlik açığı bulma sistemi sayesinde OpenWRT'te kritik bir 0-day buldu ve açığı bildirdi.

Geliştirdiği sistemde LLM'e projenin kaynak kodunu vererek önce mimari + veri akış haritası çıkarıyor. Sonra aynı prompt'u temiz bellekle birçok kez çalıştırarak farklı yollardan potansiyel açık arıyor. En sonda daha güçlü bir modelle bulunan adayları kontrol edip yanlış olanları atıyor, gerçek açıkları doğruluyor.

[Horizon3.ai @Horizon3ai]

🚨 An internet-facing ArcGIS Server can become an unauthenticated file disclosure point.

Rapid Response test now available for CVE-2026-9181.

[Daily CyberSecurity @Daily_CyberSec]

A critical HPLIP vulnerability, CVE-2026-14544 (CVSS 9.8), lets a remote attacker gain arbitrary code execution via crafted print data. Patch now.
#HPLIP #LinuxSecurity #RCE #CVE #hpcups #CyberSecurity #Vulnerability #InfoSec
https://t.co/8aqZOdDPYO

[Dark Web Informer @DarkWebInformer]

CVE-2026-20896: Gitea Docker Auth Bypass Checker

GitHub: https://t.co/icIV3UbdOr

[Netlas.io @Netlas_io]

CVE-2026-56843: Cleartext FTP Password Exposure in Plesk's XML API, 9.9 rating 🔥

Exposure of cleartext FTP credentials is possible in Plesk's XML API, which may allow a low-privileged attacker to upload malicious files and execute arbitrary code remotely (RCE) as another tenant's system user.

👉 https://t.co/KT4BCfBjJ5

[Hunter @HunterMapping]

🚨Alert🚨 CVE-2026-45659 : A Microsoft SharePoint Server Vulnerability Leading to Remote Code Execution via Deserialization of Untrusted Data.
📊 417.4K+ Services are found on the https://t.co/g3tSyh13yE yearly.
🔗Hunter
Link:https://t.co/rQXmUxP3sr
HUNTER : https://t.co/yFFcJwdIUc="SharePoint Server"
📰Refer:https://t.co/oRFs7CRFaj
https://t.co/BTEIl3kgfz
#hunterhow #infosec #infosecurity #OSINT #Vulnerability