Bulletins d'actualité

Classification

TLP:WHITEC0

Offensive Security’s Exploit Database

[webapps] WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI

[webapps] Apache HertzBeat 1.8.0 - Remote Code Execution Apache HertzBeat 1.8.0 - Remote Code Execution

[webapps] ePati Antikor NGFW 2.0.1301 - Authentication Bypass ePati Antikor NGFW 2.0.1301 - Authentication Bypass

[webapps] PJPROJECT 2.16 - Heap Bufferoverflow PJPROJECT 2.16 - Heap Bufferoverflow

[webapps] Ninja Forms Uploads - Unauthenticated PHP File Upload Ninja Forms Uploads - Unauthenticated PHP File Upload

[webapps] glances 4.5.2 - command injection glances 4.5.2 - command injection

[webapps] coreruleset 4.21.0 - Firewall Bypass coreruleset 4.21.0 - Firewall Bypass

[webapps] Flowise < 3.0.5 - Missing Authentication for Critical Function Flowise < 3.0.5 - Missing Authentication for Critical Function

[remote] telnetd 2.7 - Buffer Overflow telnetd 2.7 - Buffer Overflow

[webapps] Ghost CMS 6.19.0 - SQLi Ghost CMS 6.19.0 - SQLi

Dark Reading

Impossible de charger le flux RSS de https://www.darkreading.com/rss_simple.asp : Il y a eu un problème lors de la requête HTTP : 403 Forbidden

ZATAZ

Phishing, faux fournisseurs, comptes compromis : ces attaques qui visent toujours les PME en 2026 En 2026, les cyberattaques contre les PME ne commencent pas toujours par une faille spectaculaire. Très souvent, tout part d’un email bien tourné, d’un mot de passe déjà compromis.

Coopération sino-américaine contre des escroqueries crypto États-Unis et Chine démantèlent neuf centres d’arnaque crypto à Dubaï, avec 276 arrestations.

Fret détourné, alerte sur le piratage des transporteurs Le FBI alerte sur des pirates qui détournent du fret via comptes compromis, faux chargements et usurpation.

Un négociateur pirate condamné à 8 ans de prison Un pirate informatique, membre des groupes Akira et Conti, condamné à 8 ans prison. sa mission, analyser les données volées.

Par vengeance, il supprime 96 bases de données gouvernementales. Il voulait se venger après son licenciement : 96 bases gouvernementales supprimées.

Hacker caché pendant deux ans dans une société Pendant près de deux ans, les pirates du groupe Cl0p sont restés invisibles dans les machines d'un spécialiste de la gestion et du traitement de l'eau.

Instructure paie les pirates après l’attaque de Canvas ! Instructure paie ShinyHunters après l’attaque de Canvas, tandis que le Congrès enquête sur la réponse cyber.

PACI : fuite revendiquée de 5,23 millions d’identités Fuite revendiquée contre la PACI au Koweït : données civiles, cartes sensibles et enjeu de renseignement.

West Pharmaceutical frappé par un rançongiciel West Pharmaceutical touché par un rançongiciel : données volées, production perturbée et enquête cyber en cours.

Foxconn relance ses usines après une cyberattaque Foxconn confirme une cyberattaque en Amérique du Nord, revendiquée par Nitrogen, avec 8 To de données volées

';--	Identity Leaked

	Abrigo - 711,099 breached accounts In April 2026, the fintech software company Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group. Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from
	Canada Life - 237,810 breached accounts In April 2026, Canada Life was the victim of a "pay or leak" extortion campaign by the ShinyHunters group. The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets. In
	Cushman & Wakefield - 310,431 breached accounts In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with tens of thousands of external email addresses and corporate cont...

Zara - 197,376 breached accounts In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses a...

Woflow - 447,593 breached accounts In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group. The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it relat...

LegionProxy - 10,144 breached accounts In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach. The incident exposed 10k email addresses, bcrypt password hashes, names and purchases.

	Vimeo - 119,167 breached accounts In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their "pay or leak" campaign. They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata. The data also included 119k unique email addresses, sometimes accompanied by names.
	Reborn Gaming - 126 breached accounts In April 2026, the gaming community Reborn Gaming suffered a data breach due to a vulnerability in cPanel and WebHost Manager (WHM). The breach exposed 126 unique email addresses along with IP addresses and Steam IDs. Reborn Gaming self-submitted the data to Have I Been Pwned.

Marcus & Millichap - 1,837,078 breached accounts In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group. Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment...

ZenBusiness - 5,118,184 breached accounts In March 2026, the hacker and extortion group "ShinyHunters" claimed to have obtained a substantial corpus of data from ZenBusiness, a business formation and compliance platform. The group claimed the data had been exfiltrated from platforms including Snowflake, Mixpanel and Salesforce, and threatened to publish it if a ransom was not paid. The following month, after claiming payme...