Stay informed on the latest exploit trends and vulnerabilities. Get expert insights and updates on information security exploits with our dedicated tag.
Search across headline titles and summaries.
Background for this topic.
An exploit is code, data, or a sequence of actions that uses a software, hardware, or configuration vulnerability to produce unintended behavior. Depending on the flaw and the attacker’s access, it may enable unauthorized code execution, privilege escalation, information disclosure, or denial of service. Exploitation can occur remotely through exposed services, web applications, or client software, or locally after an attacker gains limited access.
Exploitation matters because a vulnerability becomes an active attack path when the required conditions are reachable and exploitable. Defenders should inventory affected assets, prioritize remediation when exploitation is known or credible, apply patches or vendor mitigations, and reduce exposure through access controls, segmentation, and secure configuration. Monitoring for exploit-specific indicators—such as abnormal requests, unexpected processes, or privilege changes—supports detection; systems suspected of successful exploitation require containment and investigation for follow-on access.
Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js, a widely used JavaScript implementation of Google's Protocol Buffers. [...]
Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42
Optimizing Value and Utility Hinges on AI Scaffolding, Says Aisle's Ondrej VlcekWhile the world is in "awe" of how Mythos can find vulnerabilities and chain together exploits, the next step is to identify how to build the best cybersecurity pipelines and scaffolding to get maximum value from all AI models used inside an organization, said Aisle CEO Ondrej Vlcek.
AI models are making rapid gains in vulnerability research and exploit development, raising new cybersecurity risks, a Forescout study finds
Pause your Mythos panic because mainstream models anyone can use already pick holes in popular software Anthropic withheld its Mythos bug-finding model from public release due to concerns that it would enable attackers to find and exploit vulnerabilities before anyone could react.…
Equifax CTO Jamil Farshchi on Cybersecurity's Response to Flood of VulnerabilitiesCybersecurity organizations must adapt to machine-speed threats in the age of Anthropic's Claude Mythos, a new AI model that can uncover vulnerabilities and lead to a flood of repaid exploits. Equifax CTO Jamil Farshchi says security programs must be built for scale, automation and quick response.
A researcher known as "Chaotic Eclipse" has published a proof-of-concept exploit for a second Microsoft Defender zero-day, dubbed "RedSun," in the past two weeks, protesting how the company works with cybersecurity researchers. [...]
Also: ZachXBT Uncovers DPRK Worker Scam, Hyperbridge Hack, Coinone FineThis week, Operation Atlantic disrupts $45M phishing fraud, ZachXBT uncovers DPRK crypto worker scheme, Hyperbridge exploit, South Korea fines Coinone $3.5M, Kraken faces extortion attempt over insider data leak and American musician loses $420K in fake Ledger app.
SANS Institute and Cloud Security Alliance Leaders on the Coming Vulnerability StormIn the latest Proof of Concept, SANS and Cloud Security Alliance leaders join ISMG editors to discuss how the storm clouds of Claude Mythos could upend cyber defenses by compressing time to exploit, and why vulnerability management, risk models and security operations must change.
Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces. [...]
Forescout's Rik Ferguson on AI-Driven Vulnerability Risks and Visibility GapsAnthropic's Claude Mythos marks a shift in AI-driven vulnerability discovery, but the bigger challenge facing defenders is how to respond. Faster exploit development is exposing gaps in asset visibility, patching and security operations across IT and OT environments, said Forescout's Rik Ferguson.
Vuln old enough to drive lands on CISA's exploited list While Microsoft was rolling out its bumper Patch Tuesday updates this week, US cybersecurity agency CISA was readying an alert about a 17-year-old critical Excel flaw now under exploit.…
Real-Time Payments, AI-Led Exploits Are Exposing Flaws Fraud Detection Can't CatchFor years, fraud prevention has followed a familiar script. A transaction is initiated. A model evaluates it. Fraud still gets detected as it happens or after it occurs. But this model is breaking down with the rise of instant payments and artificial intelligence tools.
Cybersecurity researchers have unmasked a novel ad fraud scheme that has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news stories into Google's Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial scams
April 2026 Patch Tuesday is the largest in years: 167 CVEs from Microsoft plus 344 released throughout the month for 512 total updates. An actively exploited SharePoint zero-day, wormable RCEs in Remote Desktop and Active Directory, and preview-pane Office exploits demand immediate action.
Ex-Microsoft CIO: Mythos Could Surface Known Flaws Faster Than Vendors Can Fix ThemFormer Microsoft CIO Jim DuBois and IDC's Frank Dickson say Claude Mythos Preview could rapidly surface long-known but unfixed software flaws at scale, forcing vendors and enterprises to strengthen patch validation, orchestration and deployment before attackers exploit the backlog.
In a new report from the Cloud Security Alliance (CSA), experts warn of an "AI vulnerability storm" triggered by the introduction of Anthropic's Claude Mythos.
An attacker has been using maliciously crafted PDF files to exploit a zero-day in Adobe Acrobat and Reader for at least four months.
Or it's a bunch of pre-IPO hype. Either way, we're giving it the once-over on this week's episode Kettle Anthropic dropped a doozy on us this week with the launch of Mythos, an AI model it says is able to find and exploit zero-day vulnerabilities with a shocking level of ability. …