Leaky server exposes toolkit behind 14,500-camera Dahua hijack

Hunt.io rebuilt Operation CameraSwarm from an exposed operator directory after more than 14,500 Dahua devices were compromised.

The Latest

Breaking News and Alerts

WordPress form plugin flaw lets strangers plant backdoor PHP files

A critical arbitrary file upload bug in Forminator Forms, running on more than 600,000 WordPress sites, lets unauthenticated attackers execute PHP.

Spotlight

Cybersecurity Profiles and Stories

DNS rebinding trick puts Ray AI clusters within browser attackers’ reach

CISA added an actively exploited Ray AI framework flaw to its KEV catalog, citing evidence of active exploitation in the wild.

Unauthenticated GraphQL injection lets strangers wipe GitLab projects

GitLab shipped emergency patches for a critical GraphQL code injection flaw that lets unauthenticated attackers modify or delete public projects.

Fake captchas on 2,000 hacked WordPress sites push malware

Check Point links nearly 2,000 hacked WordPress sites to fake-captcha malware delivery.

TWINLOOT hides inside Microsoft cloud to swipe logins and roam

New Windows implant TWINLOOT abuses SharePoint and Teams to steal credentials and move laterally.

Features

Research and Thought Leadership