NetScaler’s Authentication Bypass Is Now Drawing Live Attack Traffic
A public proof of concept for CVE-2026-19490 is now drawing exploit-matching traffic. The evidence shows active targeting, not confirmed compromise.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
The Outage Lasted Eight Hours. The Patient Exposure Reached 3.75 Million.
CareCloud first described an eight-hour disruption affecting one of six electronic health record environments. The same incident is now listed as affecting 3,756,469 people.
You Changed the Camera Password. The Attacker Account Was Still There.
CameraSwarm compromised more than 14,500 Dahua devices. A hidden account and vendor relay paths can survive the remediation steps defenders normally trust.
They Did Not Steal Passwords. They Stole the Map of Who to Attack Next.
Alleged Entra directory theft exposed organisational maps rather than passwords. Treat bulk directory reads as a high-impact identity event.
A Failed WordPress Login Could Become Code Execution.
WordPress fixed a pre-auth reflected XSS that can be chained to server-side code execution when a logged-in administrator is drawn into the attack. The chain is contextual, but the update is urgent.
The Private Keys Were Safe. The Address of the Person Holding Them Was Not.
SafePal says private keys and funds were not exposed, but order records linked wallet ownership to names, contact details and home addresses.
They Never Became Customers. Their Identity Data Was Still in the Breach.
A Heights Finance cloud-platform breach reached borrowers, applicants and people who only enquired. Data retention turned a past interaction into a present risk.
The Exploit Did Not Just Steal $3 Million. It Ended the Blockchain.
A flaw in BounceBit Chain's inherited Evmos authorisation logic let an attacker move 286.5 million BB. The response will permanently retire the Layer 1 and reissue BB on BNB Chain.
The Rust Crates Were Removed in Under Two Hours. The Build Hosts Still Need Incident Response.
The malicious crates and the new video-call campaign are separate incidents. They meet at the same target: the people and credentials trusted to publish Rust packages.
The Fake Lock Screen Stole the Password. The Proxy Made the Login Look Internal.
SynkLoader used a fake Teams help desk, an Azure-hosted installer, a counterfeit Windows lock screen and an internal proxy to turn one user action into hands-on-keyboard corporate access.