Latest threats.Explained and fixed.
Each threat is checked against national advisories and the software maker. Filter by what it affects.
12 results · All countries
Out-of-date iPhones, iPads and Macs are being attacked
A 2024 Apple flaw that helps attackers get past a built-in protection is now being exploited. Updating fixes it.
WordPress sites can be taken over while they update
A flaw in how WordPress installs core updates lets attackers run code on your server. Update to WordPress 7.1.4.
Office VPN gateways are being taken over
Attackers are chaining three Ivanti Connect Secure flaws to run commands on VPN gateways. Update, and check for signs of a break-in.
Cisco firewalls can be crashed through their VPN
A flaw in Cisco ASA and FTD firewalls lets anyone on the internet make the device restart through the VPN service. Update to a fixed release.
Online shops on Magento and Adobe Commerce need the July update
Adobe fixed critical flaws in its shop software in July. One is now being exploited, so any shop that skipped the update is exposed.
Two PHP flaws let attackers run code on web servers
Two critical PHP flaws let anyone on the internet run code on a server that runs PHP. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Backup servers (AhsayCBS) are being broken into
Two critical AhsayCBS flaws let attackers bypass login and run commands on backup servers. Update, and rebuild if you may have been hit.
A Windows security feature can be bypassed, and attackers are using it
Microsoft's October update fixes a Windows Shell flaw that attackers are already exploiting. Install the October 2026 updates.
Business email gateways (FortiMail) are under attack
A critical Fortinet FortiMail flaw lets attackers write files to the server with no login. Update to 8.0.2, 7.6.7 or 7.4.9.
Office routers (MikroTik) are being taken over through SSH
Attackers are taking full control of MikroTik routers that expose SSH to the internet. Update RouterOS and close remote access.
Staff approving login prompts they did not start
Attackers who have a password send login prompts until someone taps Approve. Number matching and passkeys stop it.
Fake invoices from suppliers you really use
Criminals take over or copy a supplier's email, then ask you to pay a new bank account. A phone call before paying stops it.