Vulnerabilità · 200 giorni fa
Google segnala che attori malintenzionati sfruttano bug RCE di terze parti per ottenere accesso a risorse cloud e installare cryptominer entro 48 ore dalla divulgazione.
Sfruttamento noto · CISA KEV
CVSS 9.8 CRITICAL: xWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. EPSS 100% (100º percentile).
Data di correzione federale CISA 20 nov · data superata
Sfruttamento noto · CISA KEV
CVSS 10 CRITICAL: a pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0… Impiego noto in campagne ransomware. EPSS 100% (100º percentile).
Data di correzione federale CISA 12 dic · data superata
4 fonti che coprono questa storia
Most Google Cloud Attacks Start With Bug Exploitation
Thanks to AI, the new top cause of cloud compromises is vulnerability exploits that beat patching cycles.
Software vulnerabilities push credential abuse aside in cloud intrusions - Help Net Security
Cyber threats in cloud environments are shifting toward software vulnerabilities, identity compromise and insider data theft.
Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials
Google Cloud report details a sharp rise in attackers exploiting software vulnerabilities, including React2Shell
Google: Cloud attacks exploit flaws more than weak credentials
Hackers are increasingly exploiting newly disclosed vulnerabilities in third-party software to gain initial access to cloud environments, with the window for attacks shrinking from weeks to just days.
Part of the PlainSec briefing for 2026-03-23