{"vulnerability": "CVE-2026-48558", "sightings": [{"uuid": "45e74bb6-3289-40e3-b213-56634e17150e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mo6jgxce6n2p", "content": "\ud83d\udd34 CVE-2026-48558 - Critical (10)\n\nSimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypas...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-48558/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-13T15:00:16.977439Z"}, {"uuid": "e8ed3522-fa4e-41ae-98a0-8929862f9e09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mobcidnjl72t", "content": "\ud83d\udea8 CRITICAL ALERT: CVE-2026-48558\n\nCVSS 10.0/10\n\n\ud83d\udccb WHAT IT IS:\nSimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted ", "creation_timestamp": "2026-06-14T17:33:45.801948Z"}, {"uuid": "48b6053f-e4c8-4c25-99b2-f7272792ce96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3modpgoxhsx2c", "content": "\ud83d\udea8 CRITICAL: CVE-2026-48558\n\nCVSS 10.0/10\n\n\ud83d\udccb WHAT IT IS:\nSimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted withou", "creation_timestamp": "2026-06-15T16:30:48.448615Z"}, {"uuid": "339931b2-32d8-4e6b-b317-e6a6deecf9c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3moe5qpstav2q", "content": "CRITICAL OIDC BREAKDOWN: SimpleHelp Flaw Lets Attackers Instantly Become Privileged Technicians Without Login (CVE-2026-48558) +\u00a0Video\n\nIntroduction: When Identity Systems Become the Weakest Door in the Network Remote management tools sit at the heart of modern enterprise operations, quietly\u2026", "creation_timestamp": "2026-06-15T20:46:57.664946Z"}, {"uuid": "76318a96-aa1f-4880-984b-d9a0f0f48f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3moeeegyplj2n", "content": "Critical SimpleHelp flaw CVE-2026-48558 lets unauthenticated attackers create privileged Technician accounts when OIDC is enabled, bypassing MFA. Fixes are in 5.5.16 and 6.0RC2. #SimpleHelp #CVE202648558 #OIDC", "creation_timestamp": "2026-06-15T22:45:22.233923Z"}, {"uuid": "78f5e5d7-1fd0-4f19-9a4f-25777911509b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3moepyfm5qu2k", "content": "Critical SimpleHelp Zero-Day CVE-2026-48558 Enables MFA Bypass While Google Uncovers UNC6508 Espionage Campaign Hidden Since 2023 +\u00a0Video\n\nBreaking Security Landscape Overview The cybersecurity ecosystem has been shaken by two parallel revelations that expose how fragile modern digital\u2026", "creation_timestamp": "2026-06-16T02:13:23.004806Z"}, {"uuid": "ef8d75f7-3bde-4d91-acea-b94753fde3ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mof63lmlkj2j", "content": "\ud83d\udcf0 Celah Kritis SimpleHelp: Peretas Bisa Buat Akun Teknisi Siluman Tanpa Autentikasi\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/06/16/celah-kritis-simplehelp-hacker-buat-akun-teknisi/\n\n#azureAd #cve-2026-48558 #hacker #keamananSiber #komputer #oidc #patch #peretas #remoteSuppor", "creation_timestamp": "2026-06-16T06:25:42.618982Z"}, {"uuid": "dd93826d-0232-4e4f-8c13-04d4aa3ab75e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mofwfvnkj22s", "content": "SimpleHelp RMM flaw could give attackers full access to managed endpoints (CVE-2026-48558)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/06/16/s...\n\n#MSP #remotemanagement #SMBs #vulnerability #RMM #SimpleHelp #cybersecurity #cybersecuritynews @horizon3ai.bsky.social", "creation_timestamp": "2026-06-16T13:41:01.514086Z"}, {"uuid": "1ecf71a1-2f22-4fe8-8efe-b51c6fc37cef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mofww4z7ix2c", "content": "SimpleHelp RMM\u306e\u8106\u5f31\u6027\u3001\u653b\u6483\u8005\u304c\u7ba1\u7406\u5bfe\u8c61\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3078\u30d5\u30eb\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306b\uff08CVE-2026-48558\uff09\n\n\u4eba\u6c17\u306e\u30ea\u30e2\u30fc\u30c8\u30e2\u30cb\u30bf\u30ea\u30f3\u30b0\u30fb\u7ba1\u7406\uff08RMM\uff09\u30c4\u30fc\u30eb\u300cSimpleHelp\u300d\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\uff08CVE-2026-48558\uff09\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308b\u3068\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u65b0\u305f\u306a\u300c\u30c6\u30af\u30cb\u30b7\u30e3\u30f3\u300d\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4f5c\u6210\u3057\u3001\u7ba1\u7406\u5bfe\u8c61\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3078\u306e\u30ea\u30e2\u30fc\u30c8\u63a5\u7d9a\u3084\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u306a\u3069\u304c\u884c\u3048...", "creation_timestamp": "2026-06-16T13:50:02.410167Z"}, {"uuid": "5b3342c5-f653-4378-a9fc-c3eea81a9086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mofz4czfrc24", "content": "Critical SimpleHelp vulnerability (CVE-2026-48558) exposes thousands of servers to unauthorized access. Immediate action required. #SimpleHelp #CVE202648558 #AuthenticationBypass #CyberSecurity thedailytechfeed.com/critical-vul...", "creation_timestamp": "2026-06-16T14:29:17.826870Z"}, {"uuid": "fdd1d262-93fa-42a8-8636-2f331ef335b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/attrition.org/post/3mog7m2jsis2z", "content": "@f5labs.bsky.social re: www.f5.com/labs/article...  Are you using \"AI\" to do these? e.g. \"Threat Details and IOCs\" and \"CVE-2026-35273, CVE-2026-46695, CVE-2026-46703, CVE-2026-48558, CVE-2026-50545\" has nothing to do with the section above, and those CVEs are largely not for the software listed.", "creation_timestamp": "2026-06-16T16:25:31.463878Z"}, {"uuid": "82909ec6-4bb8-4de5-bcae-aec50a10efdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mohbhfp4ax2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-35273: 62 interactions\nCVE-2026-54420: 26 interactions\nCVE-2025-10263: 25 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-54420: 21 interactions\nCVE-2026-20262: 8 interactions\nCVE-2026-48558: 8 interactions\n", "creation_timestamp": "2026-06-17T02:31:19.728184Z"}, {"uuid": "082ee5ea-5f02-4b38-a170-fde14dce1e7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mohjkawbps2h", "content": "SimpleHelp RMM flaw could give attackers full access to managed endpoints (CVE-2026-48558)\n\nA critical vulnerability (CVE-2026-48558) in SimpleHelp, a popular remote monitoring and management (RMM) tool, can be exploited remotely by unauthenticated attackers to create a new \u201cTechn\u2026\n#hackernews #news", "creation_timestamp": "2026-06-17T04:56:05.379651Z"}, {"uuid": "0036257f-bc81-4f00-8e83-0d7a39499527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3moirzfqc6r24", "content": "\ud83d\udce2 CVE-2026-48558 : Contournement d'authentification critique dans SimpleHelp via OIDC\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nLe 12 juin 2026, Horizon3.ai publie une divu\u2026\nhttps://cyberveille.ch/posts/2026-06-17-cve-2026-48558-contournement-d-authentification-critique-dans-simplehelp-via-oidc/ #CVE_2026_48558 #Cyberveille", "creation_timestamp": "2026-06-17T17:00:22.699633Z"}, {"uuid": "29087ed9-72a8-4217-a0ac-f359608d5125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3molhiycnzt2s", "content": "\ud83d\udce2 ~14 000 serveurs SimpleHelp expos\u00e9s via un contournement d'authentification critique (CVE-2026-48558)\n\ud83d\udcdd \ud83d\udcf0 **Source** : Cybersecu\u2026\nhttps://cyberveille.ch/posts/2026-06-18-14-000-serveurs-simplehelp-exposes-via-un-contournement-d-authentification-critique-cve-2026-48558/ #CVE_2026_48558 #Cyberveille", "creation_timestamp": "2026-06-18T18:30:13.693970Z"}, {"uuid": "7e1b5c9b-0e49-40e1-9040-62ef8d946637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3moutld5gaj27", "content": "\ud83d\udd0d Top signals this week:\n\nCVEs: CVE-2026-20262, CVE-2026-35273, CVE-2026-39813, CVE-2026-48558, CVE-2026-50656\nActors: Ransomware, Apt, Play\n\nFull intel: https://matlock.ca/cybersecnews", "creation_timestamp": "2026-06-22T12:00:28.290333Z"}, {"uuid": "5034cab6-5a40-4d95-8809-926a2972c4ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mpgnkfwvpl25", "content": "Hackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux.", "creation_timestamp": "2026-06-29T14:00:16.824588Z"}, {"uuid": "bf64e8f5-bea7-44bf-a585-6453b7e7fc2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mpgp537lae2n", "content": "\ud83e\udd16 CVE-2026-48558 (CVSS 9.8): SimpleHelp RCE exploited in the wild deploying Djinn Stealer \u2014 cross-platform infostealer (Win/macOS/Linux). CISA KEV added.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/", "creation_timestamp": "2026-06-29T14:28:36.710774Z"}, {"uuid": "a269eaa4-1a13-47d9-9aff-7c49044bea55", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b3a20fd8-eebe-4a24-887e-3d9ad481e7d6", "content": "", "creation_timestamp": "2026-06-29T15:00:33.461318Z"}, {"uuid": "68e57489-e400-4678-b424-a2521f9e3caf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mpgrirte6o25", "content": "CVE-2026-48558: Djinn Stealer Exploited In-the-Wild on SimpleHelp", "creation_timestamp": "2026-06-29T15:10:57.921711Z"}, {"uuid": "7774a8a0-a619-46d0-a131-4b24cb6d7330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mpgyew67m625", "content": "Unauthenticated attackers are exploiting a critical SimpleHelp RMM flaw (CVE-2026-48558) to create privileged accounts and steal AI/cloud keys. This isn't phishing; it's a logic flaw putting your core infrastructure at risk.\u2026\n\nhttps://www.tpp.blog/1spta96\n\n#cybersecurity #simplehelp #cve202648558", "creation_timestamp": "2026-06-29T17:14:05.221305Z"}, {"uuid": "2c9c03db-59cc-4f04-88cb-cfa5ae7a39c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mph2xw4awv2t", "content": "SimpleHelp CVE-2026-48558 is being exploited to create privileged technician accounts and deploy TaskWeaver loader plus Djinn Stealer on Windows, macOS, and Linux, targeting credentials and cloud assets. #SimpleHelp #TaskWeaver #DjinnStealer", "creation_timestamp": "2026-06-29T18:00:28.566533Z"}, {"uuid": "d3d6edb8-8d9c-440a-97e9-72cf9a063261", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cdbc909e-25e9-4715-8ddf-2a0998483dfc", "content": "", "creation_timestamp": "2026-06-29T20:00:01.988851Z"}, {"uuid": "d5e2bdd9-a0c3-4952-b857-630c5d67494e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6868012", "content": "2026-06-29: [CVE-2026-48558] SimpleHelp Authentication Bypass VulnerabilitySimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.\ncisakev", "creation_timestamp": "2026-06-29T20:05:32.014170Z"}, {"uuid": "23f8578a-e05f-4267-b6e8-ca3a4683096a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mphbyhlon52k", "content": "\ud83d\uded1 CVE-2026-48558\nSimpleHelp  SimpleHelp\nCVSS 9.5 / EPSS 1% / KEV \u2705\nTL;DR: SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentic\u2026\nhttps://cvesentinel.com/report/CVE-2026-48558?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-06-29T20:06:06.625291Z"}, {"uuid": "d9dfafae-a1bc-4bb4-906e-cd212a3b1aff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mphf4gsuzb2d", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)\n\n\u26a0\ufe0f CVE-2026-48558 - SimpleHelp Authentication Bypass Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-06-29T21:01:57.735299Z"}, {"uuid": "7e10331f-ac5d-4a12-b801-482a3917091f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mphgzbfj3n2z", "content": "Threat actors exploit CVE-2026-48558 in SimpleHelp RMM to gain admin access, deploy TaskWeaver and Djinn Stealer, and exfiltrate extensive developer and AI assistant data.\n", "creation_timestamp": "2026-06-29T21:35:59.204076Z"}, {"uuid": "f85f4469-efdd-42af-9543-32a31daa7e63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mphnikjcez2r", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48558 SimpleHelp Authentication\u2026\n\n\ud83d\udd17 https://hnow.live/a/4e2ac225", "creation_timestamp": "2026-06-29T23:31:54.490238Z"}, {"uuid": "2d1904c3-048e-437a-89d5-3ea1538bbfbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mphrf5lrf323", "content": "\ud83e\udd16 CVE-2026-48558 (CVSS 9.8): Auth bypass in SimpleHelp RMM delivering 'Djinn' infostealer targeting cloud & AI credentials. Exploited in the wild.\n\nhttps://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials", "creation_timestamp": "2026-06-30T00:41:34.791149Z"}, {"uuid": "09b02ad5-54a4-4923-ab4b-5a4cd274fb74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mphrlvorlt2x", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds One Known Exploited Vulnerability to Catalog  #CISA (Jun 29)\n\nCVE-2026-48558 SimpleHelp\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-06-30T00:45:21.459453Z"}, {"uuid": "1e82f08b-0bbf-472f-8ece-9f6227e3e766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials", "content": "The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp, targeting credentials linking development and admin environments to wider enterprise systems.", "creation_timestamp": "2026-06-30T01:00:42.602331Z"}, {"uuid": "add41a8d-bfb2-473a-9353-d7d8bc4f72f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mphuvaf7g22o", "content": "CVE-2026-48558, a SimpleHelp authentication bypass, is exploited in the wild to deploy TaskWeaver and Djinn Stealer. CISA added it to KEV. Patch now.\n\n#SimpleHelp #CVE202648558 #InfoStealer #RMMSecurity #ExploitedInTheWild #CyberSecurity", "creation_timestamp": "2026-06-30T01:44:16.673189Z"}, {"uuid": "b7b41cf6-855d-4a71-a05b-e7c319fda22a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mphvwyursr23", "content": "'Djinn' Stealer Targets Cloud, AI Credentials\nThe infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp, targeting credentials linking development and admin environments to\u2026\n\n\ud83d\udd17 https://hnow.live/a/f106129a", "creation_timestamp": "2026-06-30T02:03:09.259130Z"}, {"uuid": "a2840a51-485d-4f0f-8b3b-444dc4f4f7a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mpi32vz6s622", "content": "\ud83d\udcf0 Celah Kritis SimpleHelp Dieksploitasi untuk Sebarkan Malware Baru Djinn Stealer\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/06/30/cve-2026-48558-simplehelp-dieksploitasi-djinn-stealer/\n\n", "creation_timestamp": "2026-06-30T03:34:48.927750Z"}, {"uuid": "2fd1b1e6-6047-4818-a7ca-a97a914789b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mpi3f7zmtf25", "content": "\ud83d\udea8 CRITICAL RMM ALERT: CISA has added CVE-2026-48558 (SimpleHelp Admin Bypass) to the KEV matrix. Attackers are forging tokens to hijack environments. Lock down your perimeter. Full T-SUITE forensic detection logs, n8n playbooks, and mitigation scripts are live: https://thecybermind.co/jily", "creation_timestamp": "2026-06-30T03:40:35.334227Z"}, {"uuid": "b68778b2-c343-4139-bb0d-6019f753a526", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mpi4iktyfp23", "content": "SimpleHelp CVE-2026-48558 enables authentication bypass used to deliver Djinn stealer and harvest cloud/AI credentials. Patch immediately and au\u2026 #Cybersecurity #Vulnerability #IdentitySecurity\n\nSource: https://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials", "creation_timestamp": "2026-06-30T04:00:20.860502Z"}, {"uuid": "073efafe-6b8d-451e-8eee-c207f7dd7e46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mpicvwpyr324", "content": "\ud83d\udea8 EXECUTIVE ALERT: CISA has added CVE-2026-48558 (SimpleHelp Bypass) to the KEV matrix. This is a critical governance emergency exposing entire client supply chains to hijacking. Protect your enterprise assets now. Full C-SUITE risk management directives are live: https://thecybermind.co/jily", "creation_timestamp": "2026-06-30T05:55:13.206898Z"}, {"uuid": "b57bcba7-1596-4268-b168-353c86474348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mpimrmyarv2m", "content": "CVE-2026-48558 lets attackers forge OIDC identity tokens to gain fully authenticated technician sessions in SimpleHelp RMM, enabling file transfer, command execution, and malware deployment.\n", "creation_timestamp": "2026-06-30T08:51:45.401985Z"}, {"uuid": "109343a0-b3c4-4cc4-8691-11ce3d5e5fa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mpimvj4laz26", "content": "SimpleHelp \u306e\u6df1\u523b\u306a\u8106\u5f31\u6027\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u914d\u5e03\u306b\u60aa\u7528\n\nSimpleHelp \u306e\u30ea\u30e2\u30fc\u30c8\u76e3\u8996\u30fb\u7ba1\u7406\uff08RMM\uff09\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306b\u5b58\u5728\u3059\u308b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\u304c\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u914d\u5e03\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002 CVE-2026-48558\uff08CVSS\u30b9\u30b3\u30a2\uff1a10\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001SimpleHelp \u306e OpenID Connect\uff08OIDC\uff09\u8a8d\u8a3c\u30d5\u30ed\u30fc...", "creation_timestamp": "2026-06-30T08:53:54.863636Z"}, {"uuid": "35730671-19b0-4ddd-920d-c24f4e47aa06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mpismwpdzy22", "content": "SimpleHelp\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u305f\u5f37\u529b\u306aDjinn Stealer\u306e\u914d\u5e03\uff08CVE-2026-48558\uff09\n\n\u653b\u6483\u8005\u306f\u3001SimpleHelp RMM\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027CVE-2026-48558\uff08\u6700\u8fd1\u30d1\u30c3\u30c1\u304c\u516c\u958b\uff09\u3092\u60aa\u7528\u3057\u3001\u65b0\u578b\u30de\u30eb\u30a6\u30a7\u30a2\u300cDjinn Stealer\u300d\u3092\u88ab\u5bb3\u8005\u306e\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u30fc\u306b\u5c55\u958b\u3057\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306fWindows\u3001macOS\u3001Linux\u30b7\u30b9\u30c6\u30e0\u3092\u6a19\u7684\u3068\u3057\u3001\u300c\u30af\u30e9\u30a6\u30c9\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9...", "creation_timestamp": "2026-06-30T10:36:29.393151Z"}, {"uuid": "035033c8-70f3-453d-9b80-0a5b9d0b6737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mpisrxrre224", "content": "SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/06/30/s...\n\n#cybersecurity #cybersecuritynews #credentials #datatheft #malware #MSP #remotemanagement #vulnerability @horizon3ai.bsky.social", "creation_timestamp": "2026-06-30T10:39:21.078167Z"}, {"uuid": "ad2aa3c5-8656-4dfd-aec6-24fd51c96e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mpitsx2rwv2b", "content": "\ud83d\udd34 EXPLOITED\n\nMax severity, and it is already being exploited.\n\nA forged login key unlocks SimpleHelp remote-support servers with no password, then drops a stealer that hunts cloud and AI developer keys.\n\nRun SimpleHelp? Patch to 5.5.16 / 6.0 RC2 now. (CVE-2026-48558)", "creation_timestamp": "2026-06-30T10:57:45.354853Z"}, {"uuid": "a7362f14-ee83-43aa-8113-0acb552a20ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mpiwetmwau2s", "content": "An unauthenticated attacker exploited CVE-2026-48558 in SimpleHelp to gain technician access and deploy TaskWeaver and Djinn Stealer malware.\n", "creation_timestamp": "2026-06-30T11:43:33.091328Z"}, {"uuid": "6dc072ce-16e5-4e7e-b397-c8184935dc50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpiwt3yw4k2z", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer", "creation_timestamp": "2026-06-30T11:51:31.863457Z"}, {"uuid": "3f079213-0fcd-4ebf-a335-7b80424484d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mpixcvzndx2t", "content": "Critical SimpleHelp flaw CVE-2026-48558 lets attackers bypass auth, forge technician sessions, and deliver TaskWeaver and Djinn Stealer via exposed servers. #SimpleHelp #TaskWeaver #DjinnStealer", "creation_timestamp": "2026-06-30T12:00:22.225232Z"}, {"uuid": "a2c50e73-e3d7-43e0-bc12-204523543aa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mpixeyzsma2f", "content": "SimpleHelp CVE-2026-48558 \u306e\u60aa\u7528\u3067 TaskWeaver \u3068 Djinn Stealer \u3092\u914d\u5e03\n\n\u653b\u6483\u8005\u304c SimpleHelp CVE-2026-48558 \u3092\u60aa\u7528\u3057\u3001TaskWeaver \u3068 Djinn Stealer \u3092\u914d\u5e03\u3002\u30af\u30e9\u30a6\u30c9\u3001\u30b3\u30fc\u30c9\u3001AI\u3001\u30a6\u30a9\u30ec\u30c3\u30c8\u30c4\u30fc\u30eb\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u72d9\u3063\u305f\u6a19\u7684\u578b\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u304c\u5831\u544a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u30de\u30eb\u30a6\u30a7\u30a2", "creation_timestamp": "2026-06-30T12:01:32.817107Z"}, {"uuid": "ea3c0a36-5941-42fd-ba91-d74ae0ebecac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpixqm72es27", "content": "Today\u2019s #CTI Brief for 2026-06-30: \n\nSimpleHelp CVE-2026-48558 is now in CISA KEV with a July 2 due date. In vulnerable OIDC configs, forged identity-token claims can become a technician session in an RMM tool.\n\n#Cybersecurity #ThreatIntel #CISA", "creation_timestamp": "2026-06-30T12:08:03.797220Z"}, {"uuid": "8a6e622b-6f80-46a8-b7dd-0dfc190d9fb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpixqm7f4k27", "content": "Today\u2019s #CTI Brief for 2026-06-30: \n\nSimpleHelp CVE-2026-48558 is now in CISA KEV with a July 2 due date. In vulnerable OIDC configs, forged identity-token claims can become a technician session in an RMM tool.\n\n#Cybersecurity #ThreatIntel #CISA", "creation_timestamp": "2026-06-30T12:08:04.674486Z"}, {"uuid": "d1832f9b-c2b1-4e46-98f9-99104792e63b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpixqm7g3s27", "content": "Today\u2019s #CTI Brief for 2026-06-30: \n\nSimpleHelp CVE-2026-48558 is now in CISA KEV with a July 2 due date. In vulnerable OIDC configs, forged identity-token claims can become a technician session in an RMM tool.\n\n#Cybersecurity #ThreatIntel #CISA", "creation_timestamp": "2026-06-30T12:08:05.868663Z"}, {"uuid": "44a7089c-3afb-40e8-856f-0b3c7308045c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mpixxczjeq26", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer", "creation_timestamp": "2026-06-30T12:11:47.790730Z"}, {"uuid": "956389d6-8a8d-47ad-b0eb-4c635e2daeff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpixqm7g3t27", "content": "Today\u2019s #CTI Brief for 2026-06-30: \n\nSimpleHelp CVE-2026-48558 is now in CISA KEV with a July 2 due date. In vulnerable OIDC configs, forged identity-token claims can become a technician session in an RMM tool.\n\n#Cybersecurity #ThreatIntel #CISA", "creation_timestamp": "2026-06-30T12:08:06.716473Z"}, {"uuid": "704ab9ac-9aac-401e-97ae-7b00ad35ca2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/it4intserver.bsky.social/post/3mpizrjvvyr2k", "content": "iT4iNT SERVER Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer VDS VPS Cloud #CyberSecurity #Malware #DataBreach #InformationSecurity #CVE202648558", "creation_timestamp": "2026-06-30T12:44:20.766571Z"}, {"uuid": "eb2e8da8-5ac7-4fe9-9de7-15aa1d56e26d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116839121132129488", "content": "Attackers are exploiting the CVE-2026-48558 authentication bypass vulnerability in SimpleHelp RMM to deploy Djinn Stealer, a sophisticated malware targeting sensitive data across Windows, macOS, and Linux systems. This credential-harvesting campaign leverages trusted support sessions to steal information from cloud platforms, development tools, and cryptocurrency wallets.https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/", "creation_timestamp": "2026-06-30T12:45:10.308790Z"}, {"uuid": "451cf7e4-5dc5-4536-abb9-2bcb52208849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3mpizzetwg22i", "content": "SimpleHelp-Sicherheitsl\u00fccke CVE-2026-48558: Authentifizierung l\u00e4sst sich ohne g\u00fcltige Zugangsdaten umgehen\n\nwww.all-about-security.de/simplehelp-s...", "creation_timestamp": "2026-06-30T12:48:45.734575Z"}, {"uuid": "671eb1c0-9619-4093-8d85-1adc67fd8921", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mpj2agig3c2s", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer\n\nthehackernews.com/2026/06/atta...\n\n#Cybersecurity #ThreatIntel #Vulnerability", "creation_timestamp": "2026-06-30T12:52:41.756974Z"}, {"uuid": "54a12805-fcfa-418f-95cd-46e7cbba04c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mpj2dhmvr22a", "content": "Critical SimpleHelp flaw exploited to deploy new stealer malware\n\nHackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and L\u2026\n#hackernews #news", "creation_timestamp": "2026-06-30T12:54:22.235068Z"}, {"uuid": "5131d866-1413-4913-a61a-2714f35f2908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mpj2kwwdlq2l", "content": "\ud83e\udd16 CVE-2026-48558 (CVSS 10.0): Critical auth bypass in SimpleHelp OIDC flow exploited in the wild. Attackers deploy TaskWeaver C2 backdoor + Djinn Stealer info-stealer.\nhttps://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html", "creation_timestamp": "2026-06-30T12:58:32.672548Z"}, {"uuid": "3776aefd-1c0b-470a-aabc-f31b6a27e9b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mpj3652vvv2g", "content": "iT4iNT SERVER Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer VDS VPS Clown #PotatoSecurity #Malware #DataBreach #InformationSecurity #CVE202648558", "creation_timestamp": "2026-06-30T13:09:16.587730Z"}, {"uuid": "d96282e7-58b8-4486-b1a3-d12213df46a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mpj36fl5ls23", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer reconbee.com/attackers-ex...\n\n#cyberattack #TaskWeaver #Djinnstealer #cybersecurity #SimpleHelp", "creation_timestamp": "2026-06-30T13:09:29.910705Z"}, {"uuid": "5e5c686a-5c57-49f7-b135-bd14ad6cd169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mpj3j5ihpo24", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-06-30T13:15:26.564109Z"}, {"uuid": "58b620ba-8ca2-478a-9677-a031d36f2286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mpj3ljgraz25", "content": "SimpleHelp CVE-2026-48558 Actively Exploited \u2014 CVSS 10 Flaw Drops Stealer Malware\n\nhttps://blindthoughts.com/simplehelp-cve-2026-48558-active-exploitation-stealer-malware\n\n#vulnerability #remotesupport #malware #incidentresponse #mspsecurity", "creation_timestamp": "2026-06-30T13:16:45.901879Z"}, {"uuid": "bb446cc9-998c-4d98-aede-19e91a2f0d88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mpj44ksl2k2m", "content": "SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)\n\nwww.helpnetsecurity.com/2026/06/30/s...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "creation_timestamp": "2026-06-30T13:26:18.989454Z"}, {"uuid": "6ea29b5b-cffa-4f0a-a0de-a9c7d435d72a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpj4qmybvg2u", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48558 \u0432 SimpleHelp RMM: \u043e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OIDC \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0434\u043b\u044f \u0418\u0422-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b\n\n\n\nhttps://kripta.biz/posts/DF2F4104-A19F-49C4-98D3-2CF5CB6222B2", "creation_timestamp": "2026-06-30T13:37:30.837442Z"}, {"uuid": "020c3dd8-cd60-4845-972d-36cf1a086894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpj4s7yr5e2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48558 \u0432 SimpleHelp: \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u044e\u0442 TaskWeaver \u0438 Djinn Stealer\n\n\n\nhttps://kripta.biz/posts/0B94B83C-28FB-433C-B8F5-AB2630274F1D", "creation_timestamp": "2026-06-30T13:38:24.617314Z"}, {"uuid": "30f768e9-5ef6-4044-91de-552a96b5d328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mpj66t36gw25", "content": "\ud83d\udd12 Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer\n\nAn unknown threat actor has been observed exploiting a recently disclosed maximum-severity secu...\n\nhttps://tinyurl.com/2ddxxlry #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-06-30T14:03:20.988492Z"}, {"uuid": "8b789ffa-3c52-4b3d-84c0-58836aea4086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mpj6bi4va72d", "content": "SimpleHelp CVE-2026-48558 (CVSS 10.0) is under active exploitation to drop the TaskWeaver loader and Djinn Stealer. Edge RMM = a direct route into ICS. Patch now.\n#ThreatIntel #ICS\nhttps://threat-intelligence.redeyesecurity.com/blog/simplehelp-cve-2026-48558-taskweaver-djinn-stealer-2026", "creation_timestamp": "2026-06-30T14:04:50.398021Z"}, {"uuid": "edf49eac-d0a2-46c3-b306-046083e93091", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mpj6gx6txs2c", "content": "Attackers are exploiting CVE-2026-48558, an authentication bypass vulnerability in SimpleHelp RMM, to deploy Djinn Stealer malware, which targets various systems and steals sensitive credentials from cloud services, GitHub, package registries, and cryptocurrency wallets. Discovered by Horizon3.", "creation_timestamp": "2026-06-30T14:07:54.012934Z"}, {"uuid": "5b6de4e4-9f31-4193-a340-8d1cf1bf1ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116839842047861446", "content": "This is tracked as CVE-2026-48558.\nBlackpoint, published yesterday: A Djinn in the Machine: TaskWeaver\u2019s Node.js Intrusion Chain https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/\nMore:\nInfosecurity-Magazine:  Critical SimpleHelp Vulnerability Exploited For Malware Delivery https://www.infosecurity-magazine.com/news/simplehelp-rmm-vulnerability/ #infosec #vulnerability #JavaScript #malware", "creation_timestamp": "2026-06-30T15:48:24.420468Z"}, {"uuid": "2521dae8-cdbc-4031-a234-f8588fdc80d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html", "content": "An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer.\n\nThe intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated", "creation_timestamp": "2026-06-30T16:01:05.044355Z"}, {"uuid": "e701c203-2cff-4f16-97bd-6b8f119dd68f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://threatintel.cc/2026/06/30/simplehelp-vulnerability-exploited-to-deliver.html", "content": "SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) - Help Net Security\n\nAttackers are exploiting the CVE-2026-48558 authentication bypass vulnerability in SimpleHelp RMM to deploy Djinn Stealer, a sophisticated malware targeting sensitive data across Windows, macOS, and Linux systems. This credential-harvesting campaign leverages trusted support sessions to steal information from cloud platforms, development tools, and cryptocurrency wallets.", "creation_timestamp": "2026-06-30T16:01:05.905358Z"}, {"uuid": "78a55c5d-f3a0-4892-bc44-41469b834721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116840193802141611", "content": "\ud83d\udcf0 SimpleHelp RMM Flaw Actively Exploited to Deploy Novel Djinn Stealer\n\ud83d\udea8 CRITICAL FLAW: A 10.0 CVSS vulnerability (CVE-2026-48558) in SimpleHelp RMM is actively exploited to deploy new 'Djinn Stealer' malware. CISA adds to KEV catalog. Patch immediately! \u26a0\ufe0f #CyberSecurity #Vulnerability #Ransomware #Infosec\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-djinn-stealer/?utm_source=mastodon&utm_medi\u2026", "creation_timestamp": "2026-06-30T17:17:54.034219Z"}, {"uuid": "57c5a241-52a2-41ca-b650-851b1b766b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mpjj3cfx2w25", "content": "\ud83d\udea8 CRITICAL FLAW: A 10.0 CVSS vulnerability (CVE-2026-48558) in SimpleHelp RMM is actively exploited to deploy new 'Djinn Stealer' malware. CISA adds to KEV catalog. Patch immediately! \u26a0\ufe0f #CyberSecurity #Vulnerability #Ransomware #Infosec\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-06-30T17:18:14.389743Z"}, {"uuid": "86e806f9-dfef-4378-a284-a26d9c65ffda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpjlfxxyao24", "content": "CVE-2026-48558: SimpleHelp OIDC Flaw Added to KEV", "creation_timestamp": "2026-06-30T17:59:59.453183Z"}, {"uuid": "0d912086-305f-49d9-bc75-77ad0761be2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mpjs56gbxi2p", "content": "SimpleHelp: attackers exploit CVE-2026-48558 to deploy TaskWeaver and Djinn Stealer. Patch immediately and audit OIDC authentication bypass attempts in logs. #Cybersecurity #Vulnerability #Malware\n\nSource: https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html", "creation_timestamp": "2026-06-30T20:00:20.908818Z"}, {"uuid": "06a97bab-ef52-4264-b570-52a41e42586e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mpkc4tzr6r2r", "content": "\u653b\u6483\u8005\u306fSimpleHelp\u306e\u8106\u5f31\u6027CVE-2026-48558\u3092\u60aa\u7528\u3057\u3066TaskWeaver\u3068Djinn Stealer\u3092\u5c55\u958b\u3059\u308b \n\nAttackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer  #HackerNews (Jun 30)\n\nthehackernews.com/2026/06/atta...", "creation_timestamp": "2026-07-01T00:46:30.967578Z"}, {"uuid": "b33bd3b9-515c-40d5-8c61-f06f2c657f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html", "content": "An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer.\n\nThe intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated", "creation_timestamp": "2026-07-01T01:00:45.239836Z"}, {"uuid": "c209ff44-f9d5-41d0-9d6c-452bbfa58ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://threatintel.cc/2026/06/30/simplehelp-vulnerability-exploited-to-deliver.html", "content": "SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) - Help Net Security\n\nAttackers are exploiting the CVE-2026-48558 authentication bypass vulnerability in SimpleHelp RMM to deploy Djinn Stealer, a sophisticated malware targeting sensitive data across Windows, macOS, and Linux systems. This credential-harvesting campaign leverages trusted support sessions to steal information from cloud platforms, development tools, and cryptocurrency wallets.", "creation_timestamp": "2026-07-01T01:00:45.889702Z"}, {"uuid": "9db6adb9-5a2b-48d2-9b55-dffc21e13b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mpkcyd3q7y2o", "content": "SimpleHelp\u306e\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3001\u5f37\u529b\u306aDjinn Stealer\u304c\u914d\u4fe1\u3055\u308c\u308b\uff08CVE-2026-48558\uff09 \n\nSimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)  #HelpNetSecurity (Jun 30)\n\nwww.helpnetsecurity.com/2026/06/30/s...", "creation_timestamp": "2026-07-01T01:01:51.944136Z"}, {"uuid": "6a39eaaa-3d5e-4e26-8613-546de9c456b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog", "content": "", "creation_timestamp": "2026-07-01T02:33:56.487873Z"}, {"uuid": "7f8bb259-36eb-4f8c-9266-4c8440450c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mpkiinuaa42m", "content": "The latest update for #ArcticWolf includes \"CVE-2026-48558: Critical Authentication Bypass Vulnerability in SimpleHelp RMM Exploited for Credential Theft and Malware Delivery\".\n\n#cybersecurity #infosec #networks https://opsmtrs.com/2ZFbaTl", "creation_timestamp": "2026-07-01T02:40:28.216909Z"}, {"uuid": "0aeb8d04-c689-44e7-b9a4-1d25ed116c84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/simplehelp-security-advisory-av26-642", "content": "", "creation_timestamp": "2026-07-01T02:37:25.666931Z"}, {"uuid": "31ace949-62f5-4323-88ac-9b2c013fa5fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mpkmqgu2222a", "content": "SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)\n\nAttackers are exploiting CVE-2026-48558, a recently patched authentication bypass vulnerability in SimpleHelp RMM, to drop the novel Djinn Stealer malware on victim computers. The malware is capab\u2026\n#hackernews #news", "creation_timestamp": "2026-07-01T03:56:24.855071Z"}, {"uuid": "100c6ced-bdba-4c56-a52f-f82edaf00df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mpkq74xvus2a", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer\n\nAn unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn St\u2026\n#hackernews #news", "creation_timestamp": "2026-07-01T04:58:18.753815Z"}, {"uuid": "81b51138-ef91-4c79-9e1e-687facecdfb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mpldjd7xvp2a", "content": "Your remote management tool just became the attacker's delivery system.\n\nSimpleHelp CVE-2026-48558.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-taskweaver-and-djinn-steal/\n\n#CyberSecurity #PatchNow", "creation_timestamp": "2026-07-01T10:44:01.924208Z"}, {"uuid": "3ddd6428-0735-4058-8c96-5d3bc0d03cd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mpldnztyi22s", "content": "\ud83d\udea8 #Alerta Cr\u00edtica: #Parchea ya el CVE-2026-48558 en servidores #SimpleHelp (+MITIGACI\u00d2N) \n\n Vulnerabilidad cr\u00edtica en SimpleHelp permite acceso total a servidores. Gu\u00eda t\u00e9cnica de remediaci\u00f3n y mitigaci\u00f3n.\nwww.newstecnicas.com/2026/07/aler...", "creation_timestamp": "2026-07-01T10:46:46.952240Z"}, {"uuid": "b216e47c-ff20-47fc-a836-aeb07f1bc418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/faisalyahya.com/post/3mpls2s2m6p2u", "content": "A CFO once asked why we needed budget for identity posture tools. I didn't rattle off buzzwords. I pointed to flaws like CVE-2026-48558\u2014the recent SimpleHelp OIDC bypass. Attackers forge identity tokens, skip crypto checks, and gain full technician access to the fleet.", "creation_timestamp": "2026-07-01T15:04:19.836771Z"}, {"uuid": "3e6c7b09-ca26-409a-9d2a-1eaba293a4ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mpm6nr7dr224", "content": "SimpleHelp RMM Authentication Bypass CVE-2026-48558 and Dj...\n\nhttps://www.bleepingcomputer.com/news/security/simplehelp-bug-lets-hackers-create-rogue-remote-support-accounts\nhttps://flagthis.com/newsletter/2026/07/01/tldr/3871\n\n##SimpleHelp ##CVE202648558 ##DjinnStealer ##RMM ##AuthenticationBypass", "creation_timestamp": "2026-07-01T18:49:41.377981Z"}, {"uuid": "7018c62b-67c1-4355-87c2-d977786dc5ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://www.jerrygamblin.com/2026/07/01/3528/", "content": "We are halfway through 2026, so it is time for the mid-year CVE check-in. The short version: the volume curve has gone vertical while exploitation has not. This review covers everything published in the first half of 2026 (Jan 1 – Jun 30, 2026), the volume, the severity, what is actually being exploited, and who is driving the numbers, all measured against the same elapsed window a year ago so a partial half is never compared to a full one.\n\n\n\n\nTL;DR\n\n\n\n\nThe first half of 2026 produced 35,364 CVEs, more in six months than any full year before 2024 (all of 2023 finished at 28,817). That works out to one new CVE every 7.4 minutes, an increase of 49.5% over the same window in 2025 (23,656). And yet only 85 of them (0.24%) have made CISA’s KEV list so far, a floor that will rise as the cohort ages and exploitation is confirmed. That gap is the story of 2026 so far: we are minting CVEs faster than ever while confirmed exploitation stays rare, so the hard problem is signal-to-noise, not patch volume.\n\n\n\n\nAt this pace the year projects to roughly 71,314 to 72,008, and the all-time catalog has now passed 344,258 CVEs since 1999.\n\n\n\n\n\n\nNote: All statistics in this report exclude rejected CVEs to provide an accurate count of active vulnerabilities.\n\n\n\n\n\nKey Statistics at a Glance\n\n\n\n\n\nMetricValueTotal CVEs (H1 2026)35,364CVEs per Day195.4Change vs same window 2025+49.5%Projected Full Year71,314 – 72,008Critical Severity3,554High Severity13,821Average CVSS Score6.89CVSS Coverage94.3%CWE Coverage95.6%Active CNAs340Rejected CVEs (H1 2026)1,265Already Known-Exploited (KEV)85\n\n\n\n\n\n\n\n\n\nH1-over-H1: Three Years Side by Side\n\n\n\n\nTo keep the comparison honest while 2026 is still in progress, each year is measured over the identical window (January 1 through Jun 30).\n\n\n\n\n\nWindowCVEsPer DayAvg CVSSJan 1 – Jun 30, 202420,374112.66.65Jan 1 – Jun 30, 202523,656130.76.57Jan 1 – Jun 30, 202635,364195.46.89\n\n\n\n\n\n\n\n\n\nForecast Scorecard: Are We On Pace?\n\n\n\n\nAt 195.4 CVEs/day, two straight-line methods land close to each other (both are simple extrapolations of the same H1 run, so this is a sanity check, not two truly independent signals): the run-rate extrapolates to 71,314, and a seasonality-adjusted estimate (scaling the pace across the full half, then dividing by 2025’s 49% first-half share) to 72,008.\n\n\n\n\nCVEForecast, one of my own RogoLabs tools, projects\u00a090,831 CVEs\u00a0for full-year 2026 (LinearRegression, MAPE 17.9), so I am partly arguing with my own model here. That is\u00a018,823 above\u00a0the top of the straight-line range, and here is where I will plant a flag:\u00a0I think the model is high.\u00a0Both simple extrapolations land near 72,008, and the forecast’s entire gap to them rests on a heavy second-half surge that still has to show up.\u00a0My call is the year closes nearer 72,008 than 90,831.\u00a0I will happily eat those words in the December review if H2 accelerates the way the model expects, but the burden of proof is on the surge.\n\n\n\n\n\n\n\n\n\nWhat Changed in H1 2026\n\n\n\n\nGitHub Security Advisories is the busiest CNA at 6,801 assignments. New to the most-affected product list this year: Chrome, OpenClaw. Among weakness types, CWE-862 (Missing Authorization) climbed to #2 in the top five.\n\n\n\n\nSpotlight: OpenClaw. A project that barely existed a year ago, OpenClaw (Peter Steinberger’s viral local AI agent, the subject of Lex Fridman Podcast #491) is already one of the most-reported products of the half with 537 CVEs. The striking part is who is doing the reporting: VulnCheck alone assigned 500 of them (93%), disclosed steadily across the half rather than in a single dump. That concentration says more about researcher attention than code quality: VulnCheck, whose remit is emerging and exploited-in-the-wild threats, is exactly the kind of team that systematically covers a fast-growing new target, and concentrated third-party research on a hot AI agent is the coverage you would want. To its credit the project embraced the CVE lifecycle itself, issuing advisories through GitHub as reports came in. I track its CVEs at OpenClawCVEs.\n\n\n\n\n\n\n\n\n\nHistorical CVE Growth\n\n\n\n\nTo compare like with like, this chart counts only the first half of every year (January 1 through Jun 30). On that basis 2026 already stands taller than any prior first half: more CVEs in six months than the same window has ever produced.\n\n\n\n\n\n\n\n\n\nFirst-half growth has been relentless, and 2026 is +49.5% on the first half of 2025.\n\n\n\n\n\n\n\n\n\nCounting full years, the cumulative catalog has now passed 344,258 CVEs.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nMonthly Distribution (H1 2026)\n\n\n\n\nCVE publications varied across the first half of 2026, with Jun being the peak month at 7,454 CVEs.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nPublication Patterns by Day of Week\n\n\n\n\nPublishing clusters midweek. Wednesday is the busiest day at 7,943 CVEs, with Tuesday close behind at 7,216. Patch Tuesday is part of the story, but the midweek bulge owes as much to the high-volume CNAs (GitHub, Linux, the WordPress plugin crowd) that batch-publish midweek.\n\n\n\n\n\n\n\n\n\nWeekdays average 6,517 CVEs against just 1,389 on weekends.\n\n\n\n\n\n\n\n\n\nBusiest Days of H1 2026\n\n\n\n\nSome days saw massive spikes in CVE publications:\n\n\n\n\n\n\n\n\n\nTop 5 Busiest Days\n\n\n\n\n\nRankDateCVE Count12026-06-0974722026-06-1773232026-05-2771642026-03-2560652026-05-12554\n\n\n\n\n\n\n\n\n\nCVSS Score Analysis\n\n\n\n\nThe Common Vulnerability Scoring System (CVSS) helps standardize severity assessments. Here’s how H1 2026 CVEs were distributed across the scoring range.\n\n\n\n\n\n\n\n\n\nThe average CVSS score for H1 2026 was 6.89, with a median of 7.10.\n\n\n\n\nSeverity Breakdown\n\n\n\n\n\nSeverityCountPercentageCritical3,55410.0%High13,82139.1%Medium14,48541.0%Low3,0568.6%Unscored4481.3%\n\n\n\n\nPercentages are of all H1 2026 CVEs; “Unscored” are the 1.3% with no CVSS severity assigned.\n\n\n\n\n\n\n\n\n\nCVSS Trends Over Time\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nTop Weakness Types (CWE)\n\n\n\n\nThe Common Weakness Enumeration (CWE) categorizes the types of security weaknesses. Here are the most prevalent weakness types in H1 2026:\n\n\n\n\n\n\n\n\n\nTop 5 CWEs in H1 2026\n\n\n\n\n\nRankCWENameCount1CWE-79XSS3,7832CWE-862Missing Authorization1,7043CWE-89SQL Injection1,4454CWE-22Path Traversal1,2645CWE-416Use After Free1,037\n\n\n\n\n\n\n\n\n\nCVE Numbering Authorities (CNAs)\n\n\n\n\nThe leaderboard increasingly reflects where modern software and modern vulnerability research live: platform and ecosystem CNAs (GitHub, Patchstack) and dedicated research CNAs (VulnCheck, VulDB) alongside the traditional product vendors. High assignment counts are not inflation, a CNA covering the WordPress plugin ecosystem or issuing a CVE per kernel fix is doing exactly its job; the low KEV overlap below reflects how rare confirmed exploitation is across all sources, not the validity of any CNA’s records. The most active assigners this year:\n\n\n\n\n\n\n\n\n\nTop 5 CNAs in H1 2026\n\n\n\n\n\nRankCNACVEs Assigned1GitHub Security Advisories6,8012VulDB3,3193VulnCheck3,2734Patchstack2,7045Linux2,564\n\n\n\n\nIn total, 340 unique CNAs assigned CVEs in H1 2026.\n\n\n\n\n\n\n\n\n\nTop Vendors\n\n\n\n\nThe vendors with the most CVEs attributed to their products this year (each links to its NVD search):\n\n\n\n\n\n\n\n\n\nTop 5 Vendors in H1 2026\n\n\n\n\n\nRankVendorCVE Count1Linux2,5642Google1,8013Microsoft8644OpenClaw5375Oracle445\n\n\n\n\n\n\n\n\n\nMost Vulnerable Products\n\n\n\n\nDrilling past vendors to specific products, the H1 2026 leaders:\n\n\n\n\n\n\n\n\n\nTop 5 Products\n\n\n\n\n\nRankProductCVE Count1Linux Kernel1,9562Chrome1,2033OpenClaw5344Windows 103725Android303\n\n\n\n\nProduct-level counts can differ slightly from the vendor totals above: a vendor’s CVEs may span several products, and a single CVE can name more than one.\n\n\n\n\n\n\n\n\n\nKnown-Exploited Vulnerabilities (CISA KEV)\n\n\n\n\nVolume is the headline, but exploitation is what should actually drive patching. Of the 35,364 CVEs published in H1 2026, only 85 (0.24%) have shown up in the CISA KEV catalog so far. Treat that as a floor, not a verdict: KEV is a US-government catalog that lags disclosure by months and records only confirmed, observed exploitation, so this share will climb as the 2026 cohort ages. Even so, the signal holds, most CVEs are not known-exploited, so exploitability (KEV plus a forward-looking score like EPSS) beats chasing raw counts.\n\n\n\n\nNote these are two different populations: the 85 above are H1-2026-published CVEs already in KEV, while CISA added 146 entries to KEV during the half (more than the 132 added in the same window of 2025, many of them older CVEs newly exploited), and 17 of those additions are tied to known ransomware campaigns.\n\n\n\n\nH1 2026 CVEs Already in KEV\n\n\n\n\nA sample (5 most recent of 85):\n\n\n\n\n\nCVEVendorProductAddedRansomwareCVE-2026-48558SimplehelpSimpleHelp2026-06-29NoCVE-2026-20230CiscoUnified Communications Manager2026-06-25NoCVE-2026-12569PtcWindchill and FlexPLM2026-06-25NoCVE-2025-67038LantronixEDS50002026-06-23NoCVE-2026-34910UbiquitiUniFi OS2026-06-23No\n\n\n\n\n\n\n\n\n\nData Quality\n\n\n\n\nNot all CVEs have complete metadata. Here’s how data quality has evolved over the years:\n\n\n\n\n\n\n\n\n\nH1 2026 Data Quality Metrics\n\n\n\n\n\nMetricCoverageCVSS Score94.3%CWE Classification95.6%CPE Identifiers59.0%\n\n\n\n\nThis is where two ideas from the CVE Decaf work I did with Jay Jacobs get practical: actionable data quality (judge a record by whether it is complete enough to act on, not by abstract completeness) and data provenance (knowing which source asserted each field). The CPE gap is the clearest case. At 59.0% CPE coverage, nearly half of H1 2026 CVEs cannot be automatically matched to a product the day they publish, so for those records the answer to “can I act on this today?” is no, no matter how complete the rest of the entry looks. Scoring each record on its provenance (who supplied it) and on the fields that actually drive action (CPE for asset matching, KEV and EPSS for exploitability) is how you turn the raw feed into a measurable signal-to-noise ratio instead of a flat backlog.\n\n\n\n\n\n\n\n\n\nRejected CVEs\n\n\n\n\nNot all CVE IDs stay active. Some are rejected for duplicates, disputes, or invalid submissions, and the rejection rate is a useful read on the ecosystem’s quality control.\n\n\n\n\n\n\n\n\n\nH1 2026 Rejection Statistics\n\n\n\n\n\nMetricValueRejected CVEs in H1 20261,265H1 2026 Rejection Rate3.45%Total Rejected (All Time)17,648\n\n\n\n\nCVE rejections occur for several reasons:\n\n\n\n\n\n\nDuplicates: The same vulnerability assigned multiple CVE IDs\n\n\n\n\nDisputes: Vendor disagreement that the issue is a vulnerability\n\n\n\n\nInvalid: Not a security vulnerability or insufficient information\n\n\n\n\nWithdrawn: CVE withdrawn by the assigning CNA\n\n\n\n\n\n\n\n\n\n\nConclusions\n\n\n\n\nKey Takeaways from the First Half of 2026\n\n\n\n\n\n\nVolume keeps climbing: 35,364 CVEs in roughly six months, up 49.5% on the same window last year, with the full year projecting to 71,314-72,008.\n\n\n\n\nSeverity stays heavy: 17,375 CVEs (49.1%) are Critical or High.\n\n\n\n\nWeb and access-control flaws lead: XSS, Missing Authorization, SQL Injection, Path Traversal headline the CWE list. Memory-safety issues barely register in the top tier this half.\n\n\n\n\nThe CNA mix is shifting: platform teams and aggregators, not the original vendors, now top the assigner list, and the lineup reshuffled from a year ago.\n\n\n\n\nCoverage gaps persist: CVSS and CWE are well covered, but CPE sits at 59.0%, which still hampers automated matching.\n\n\n\n\nConfirmed exploitation stays rare (so far): just 85 of 35,364 H1 CVEs (0.24%) are in CISA KEV today, a floor that rises as the cohort ages. Volume is a triage problem, not a patch-everything problem.\n\n\n\n\n\nWhat this means for you\n\n\n\n\n\n\nIf you defend a network: do not let the raw count set your pace. Only 0.24% of H1 CVEs are confirmed-exploited in KEV today, but KEV lags and is a floor, not the full risk picture. Lead with exploitability (KEV as a hard floor, EPSS with a threshold you pick), then weight by your own context: internet-facing and sensitive systems jump the queue regardless of score, and compliance SLAs (PCI, FedRAMP, and the like) still set hard clocks. Lower priority is not never, so park the rest in a managed cycle rather than ignoring it.\n\n\n\n\nIf you run a CNA: the leaderboard now runs through platforms, ecosystems, and research CNAs. Volume reflects scope, not padding; the differentiator that is still genuinely uneven is data quality, and the biggest gap, CPE coverage, is largely an NVD-side enrichment problem rather than a function of who assigned the CVE.\n\n\n\n\nIf you consume NVD data: enrichment is the bottleneck. CPE at 59.0% means nearly half of new CVEs lack a formal CPE, which complicates NVD-style automated matching (many CNAs still carry vendor/product strings), and volume only widens that gap.\n\n\n\n\n\nWhat I’m watching in H2\n\n\n\n\nMy call from the scorecard stands: 2026 closes nearer 72,008 than the 90,831 forecast. Two things would change my mind: a December disclosure surge bigger than 2025’s, or another OpenClaw-style project flooding the catalog. The year-end review settles it.\n\n\n\n\n\n\n\n\n\nMethodology and Reproducibility\n\n\n\n\nTwo primary data sources, plus two enrichment feeds:\n\n\n\n\n\n\nNVD JSON – National Vulnerability Database export from nvd.handsonhacking.org\n\n\n\n\nCVE List V5 – Official CVE records from CVEProject/cvelistV5\n\n\n\n\nForecast\u00a0–\u00a0CVEForecast\u00a0full-year projection\n\n\n\n\nExploitation – CISA KEV catalog\n\n\n\n\n\nEverything here is reproducible. The full pipeline (Python, pandas, matplotlib) is on GitHub at\u00a0jgamblin/H12026CVEBlog, and it leans on the free CVE tooling I build at\u00a0RogoLabs:\u00a0cve.icu,\u00a0cnascorecard.org, and\u00a0cveforecast.org.\n\n\n\n\nData collected and analyzed on July 01, 2026.", "creation_timestamp": "2026-07-01T19:00:55.687189Z"}, {"uuid": "88dd323e-6506-4ecc-abc7-a23666df333d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://www.jerrygamblin.com/2026/07/01/3528/", "content": "We are halfway through 2026, so it is time for the mid-year CVE check-in. The short version: the volume curve has gone vertical while exploitation has not. This review covers everything published in the first half of 2026 (Jan 1 – Jun 30, 2026), the volume, the severity, what is actually being exploited, and who is driving the numbers, all measured against the same elapsed window a year ago so a partial half is never compared to a full one.\n\n\n\n\nTL;DR\n\n\n\n\nThe first half of 2026 produced 35,364 CVEs, more in six months than any full year before 2024 (all of 2023 finished at 28,817). That works out to one new CVE every 7.4 minutes, an increase of 49.5% over the same window in 2025 (23,656). And yet only 85 of them (0.24%) have made CISA’s KEV list so far, a floor that will rise as the cohort ages and exploitation is confirmed. That gap is the story of 2026 so far: we are minting CVEs faster than ever while confirmed exploitation stays rare, so the hard problem is signal-to-noise, not patch volume.\n\n\n\n\nAt this pace the year projects to roughly 71,314 to 72,008, and the all-time catalog has now passed 344,258 CVEs since 1999.\n\n\n\n\n\n\nNote: All statistics in this report exclude rejected CVEs to provide an accurate count of active vulnerabilities.\n\n\n\n\n\nKey Statistics at a Glance\n\n\n\n\n\nMetricValueTotal CVEs (H1 2026)35,364CVEs per Day195.4Change vs same window 2025+49.5%Projected Full Year71,314 – 72,008Critical Severity3,554High Severity13,821Average CVSS Score6.89CVSS Coverage94.3%CWE Coverage95.6%Active CNAs340Rejected CVEs (H1 2026)1,265Already Known-Exploited (KEV)85\n\n\n\n\n\n\n\n\n\nH1-over-H1: Three Years Side by Side\n\n\n\n\nTo keep the comparison honest while 2026 is still in progress, each year is measured over the identical window (January 1 through Jun 30).\n\n\n\n\n\nWindowCVEsPer DayAvg CVSSJan 1 – Jun 30, 202420,374112.66.65Jan 1 – Jun 30, 202523,656130.76.57Jan 1 – Jun 30, 202635,364195.46.89\n\n\n\n\n\n\n\n\n\nForecast Scorecard: Are We On Pace?\n\n\n\n\nAt 195.4 CVEs/day, two straight-line methods land close to each other (both are simple extrapolations of the same H1 run, so this is a sanity check, not two truly independent signals): the run-rate extrapolates to 71,314, and a seasonality-adjusted estimate (scaling the pace across the full half, then dividing by 2025’s 49% first-half share) to 72,008.\n\n\n\n\nCVEForecast, one of my own RogoLabs tools, projects\u00a090,831 CVEs\u00a0for full-year 2026 (LinearRegression, MAPE 17.9), so I am partly arguing with my own model here. That is\u00a018,823 above\u00a0the top of the straight-line range, and here is where I will plant a flag:\u00a0I think the model is high.\u00a0Both simple extrapolations land near 72,008, and the forecast’s entire gap to them rests on a heavy second-half surge that still has to show up.\u00a0My call is the year closes nearer 72,008 than 90,831.\u00a0I will happily eat those words in the December review if H2 accelerates the way the model expects, but the burden of proof is on the surge.\n\n\n\n\n\n\n\n\n\nWhat Changed in H1 2026\n\n\n\n\nGitHub Security Advisories is the busiest CNA at 6,801 assignments. New to the most-affected product list this year: Chrome, OpenClaw. Among weakness types, CWE-862 (Missing Authorization) climbed to #2 in the top five.\n\n\n\n\nSpotlight: OpenClaw. A project that barely existed a year ago, OpenClaw (Peter Steinberger’s viral local AI agent, the subject of Lex Fridman Podcast #491) is already one of the most-reported products of the half with 537 CVEs. The striking part is who is doing the reporting: VulnCheck alone assigned 500 of them (93%), disclosed steadily across the half rather than in a single dump. That concentration says more about researcher attention than code quality: VulnCheck, whose remit is emerging and exploited-in-the-wild threats, is exactly the kind of team that systematically covers a fast-growing new target, and concentrated third-party research on a hot AI agent is the coverage you would want. To its credit the project embraced the CVE lifecycle itself, issuing advisories through GitHub as reports came in. I track its CVEs at OpenClawCVEs.\n\n\n\n\n\n\n\n\n\nHistorical CVE Growth\n\n\n\n\nTo compare like with like, this chart counts only the first half of every year (January 1 through Jun 30). On that basis 2026 already stands taller than any prior first half: more CVEs in six months than the same window has ever produced.\n\n\n\n\n\n\n\n\n\nFirst-half growth has been relentless, and 2026 is +49.5% on the first half of 2025.\n\n\n\n\n\n\n\n\n\nCounting full years, the cumulative catalog has now passed 344,258 CVEs.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nMonthly Distribution (H1 2026)\n\n\n\n\nCVE publications varied across the first half of 2026, with Jun being the peak month at 7,454 CVEs.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nPublication Patterns by Day of Week\n\n\n\n\nPublishing clusters midweek. Wednesday is the busiest day at 7,943 CVEs, with Tuesday close behind at 7,216. Patch Tuesday is part of the story, but the midweek bulge owes as much to the high-volume CNAs (GitHub, Linux, the WordPress plugin crowd) that batch-publish midweek.\n\n\n\n\n\n\n\n\n\nWeekdays average 6,517 CVEs against just 1,389 on weekends.\n\n\n\n\n\n\n\n\n\nBusiest Days of H1 2026\n\n\n\n\nSome days saw massive spikes in CVE publications:\n\n\n\n\n\n\n\n\n\nTop 5 Busiest Days\n\n\n\n\n\nRankDateCVE Count12026-06-0974722026-06-1773232026-05-2771642026-03-2560652026-05-12554\n\n\n\n\n\n\n\n\n\nCVSS Score Analysis\n\n\n\n\nThe Common Vulnerability Scoring System (CVSS) helps standardize severity assessments. Here’s how H1 2026 CVEs were distributed across the scoring range.\n\n\n\n\n\n\n\n\n\nThe average CVSS score for H1 2026 was 6.89, with a median of 7.10.\n\n\n\n\nSeverity Breakdown\n\n\n\n\n\nSeverityCountPercentageCritical3,55410.0%High13,82139.1%Medium14,48541.0%Low3,0568.6%Unscored4481.3%\n\n\n\n\nPercentages are of all H1 2026 CVEs; “Unscored” are the 1.3% with no CVSS severity assigned.\n\n\n\n\n\n\n\n\n\nCVSS Trends Over Time\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nTop Weakness Types (CWE)\n\n\n\n\nThe Common Weakness Enumeration (CWE) categorizes the types of security weaknesses. Here are the most prevalent weakness types in H1 2026:\n\n\n\n\n\n\n\n\n\nTop 5 CWEs in H1 2026\n\n\n\n\n\nRankCWENameCount1CWE-79XSS3,7832CWE-862Missing Authorization1,7043CWE-89SQL Injection1,4454CWE-22Path Traversal1,2645CWE-416Use After Free1,037\n\n\n\n\n\n\n\n\n\nCVE Numbering Authorities (CNAs)\n\n\n\n\nThe leaderboard increasingly reflects where modern software and modern vulnerability research live: platform and ecosystem CNAs (GitHub, Patchstack) and dedicated research CNAs (VulnCheck, VulDB) alongside the traditional product vendors. High assignment counts are not inflation, a CNA covering the WordPress plugin ecosystem or issuing a CVE per kernel fix is doing exactly its job; the low KEV overlap below reflects how rare confirmed exploitation is across all sources, not the validity of any CNA’s records. The most active assigners this year:\n\n\n\n\n\n\n\n\n\nTop 5 CNAs in H1 2026\n\n\n\n\n\nRankCNACVEs Assigned1GitHub Security Advisories6,8012VulDB3,3193VulnCheck3,2734Patchstack2,7045Linux2,564\n\n\n\n\nIn total, 340 unique CNAs assigned CVEs in H1 2026.\n\n\n\n\n\n\n\n\n\nTop Vendors\n\n\n\n\nThe vendors with the most CVEs attributed to their products this year (each links to its NVD search):\n\n\n\n\n\n\n\n\n\nTop 5 Vendors in H1 2026\n\n\n\n\n\nRankVendorCVE Count1Linux2,5642Google1,8013Microsoft8644OpenClaw5375Oracle445\n\n\n\n\n\n\n\n\n\nMost Vulnerable Products\n\n\n\n\nDrilling past vendors to specific products, the H1 2026 leaders:\n\n\n\n\n\n\n\n\n\nTop 5 Products\n\n\n\n\n\nRankProductCVE Count1Linux Kernel1,9562Chrome1,2033OpenClaw5344Windows 103725Android303\n\n\n\n\nProduct-level counts can differ slightly from the vendor totals above: a vendor’s CVEs may span several products, and a single CVE can name more than one.\n\n\n\n\n\n\n\n\n\nKnown-Exploited Vulnerabilities (CISA KEV)\n\n\n\n\nVolume is the headline, but exploitation is what should actually drive patching. Of the 35,364 CVEs published in H1 2026, only 85 (0.24%) have shown up in the CISA KEV catalog so far. Treat that as a floor, not a verdict: KEV is a US-government catalog that lags disclosure by months and records only confirmed, observed exploitation, so this share will climb as the 2026 cohort ages. Even so, the signal holds, most CVEs are not known-exploited, so exploitability (KEV plus a forward-looking score like EPSS) beats chasing raw counts.\n\n\n\n\nNote these are two different populations: the 85 above are H1-2026-published CVEs already in KEV, while CISA added 146 entries to KEV during the half (more than the 132 added in the same window of 2025, many of them older CVEs newly exploited), and 17 of those additions are tied to known ransomware campaigns.\n\n\n\n\nH1 2026 CVEs Already in KEV\n\n\n\n\nA sample (5 most recent of 85):\n\n\n\n\n\nCVEVendorProductAddedRansomwareCVE-2026-48558SimplehelpSimpleHelp2026-06-29NoCVE-2026-20230CiscoUnified Communications Manager2026-06-25NoCVE-2026-12569PtcWindchill and FlexPLM2026-06-25NoCVE-2025-67038LantronixEDS50002026-06-23NoCVE-2026-34910UbiquitiUniFi OS2026-06-23No\n\n\n\n\n\n\n\n\n\nData Quality\n\n\n\n\nNot all CVEs have complete metadata. Here’s how data quality has evolved over the years:\n\n\n\n\n\n\n\n\n\nH1 2026 Data Quality Metrics\n\n\n\n\n\nMetricCoverageCVSS Score94.3%CWE Classification95.6%CPE Identifiers59.0%\n\n\n\n\nThis is where two ideas from the CVE Decaf work I did with Jay Jacobs get practical: actionable data quality (judge a record by whether it is complete enough to act on, not by abstract completeness) and data provenance (knowing which source asserted each field). The CPE gap is the clearest case. At 59.0% CPE coverage, nearly half of H1 2026 CVEs cannot be automatically matched to a product the day they publish, so for those records the answer to “can I act on this today?” is no, no matter how complete the rest of the entry looks. Scoring each record on its provenance (who supplied it) and on the fields that actually drive action (CPE for asset matching, KEV and EPSS for exploitability) is how you turn the raw feed into a measurable signal-to-noise ratio instead of a flat backlog.\n\n\n\n\n\n\n\n\n\nRejected CVEs\n\n\n\n\nNot all CVE IDs stay active. Some are rejected for duplicates, disputes, or invalid submissions, and the rejection rate is a useful read on the ecosystem’s quality control.\n\n\n\n\n\n\n\n\n\nH1 2026 Rejection Statistics\n\n\n\n\n\nMetricValueRejected CVEs in H1 20261,265H1 2026 Rejection Rate3.45%Total Rejected (All Time)17,648\n\n\n\n\nCVE rejections occur for several reasons:\n\n\n\n\n\n\nDuplicates: The same vulnerability assigned multiple CVE IDs\n\n\n\n\nDisputes: Vendor disagreement that the issue is a vulnerability\n\n\n\n\nInvalid: Not a security vulnerability or insufficient information\n\n\n\n\nWithdrawn: CVE withdrawn by the assigning CNA\n\n\n\n\n\n\n\n\n\n\nConclusions\n\n\n\n\nKey Takeaways from the First Half of 2026\n\n\n\n\n\n\nVolume keeps climbing: 35,364 CVEs in roughly six months, up 49.5% on the same window last year, with the full year projecting to 71,314-72,008.\n\n\n\n\nSeverity stays heavy: 17,375 CVEs (49.1%) are Critical or High.\n\n\n\n\nWeb and access-control flaws lead: XSS, Missing Authorization, SQL Injection, Path Traversal headline the CWE list. Memory-safety issues barely register in the top tier this half.\n\n\n\n\nThe CNA mix is shifting: platform teams and aggregators, not the original vendors, now top the assigner list, and the lineup reshuffled from a year ago.\n\n\n\n\nCoverage gaps persist: CVSS and CWE are well covered, but CPE sits at 59.0%, which still hampers automated matching.\n\n\n\n\nConfirmed exploitation stays rare (so far): just 85 of 35,364 H1 CVEs (0.24%) are in CISA KEV today, a floor that rises as the cohort ages. Volume is a triage problem, not a patch-everything problem.\n\n\n\n\n\nWhat this means for you\n\n\n\n\n\n\nIf you defend a network: do not let the raw count set your pace. Only 0.24% of H1 CVEs are confirmed-exploited in KEV today, but KEV lags and is a floor, not the full risk picture. Lead with exploitability (KEV as a hard floor, EPSS with a threshold you pick), then weight by your own context: internet-facing and sensitive systems jump the queue regardless of score, and compliance SLAs (PCI, FedRAMP, and the like) still set hard clocks. Lower priority is not never, so park the rest in a managed cycle rather than ignoring it.\n\n\n\n\nIf you run a CNA: the leaderboard now runs through platforms, ecosystems, and research CNAs. Volume reflects scope, not padding; the differentiator that is still genuinely uneven is data quality, and the biggest gap, CPE coverage, is largely an NVD-side enrichment problem rather than a function of who assigned the CVE.\n\n\n\n\nIf you consume NVD data: enrichment is the bottleneck. CPE at 59.0% means nearly half of new CVEs lack a formal CPE, which complicates NVD-style automated matching (many CNAs still carry vendor/product strings), and volume only widens that gap.\n\n\n\n\n\nWhat I’m watching in H2\n\n\n\n\nMy call from the scorecard stands: 2026 closes nearer 72,008 than the 90,831 forecast. Two things would change my mind: a December disclosure surge bigger than 2025’s, or another OpenClaw-style project flooding the catalog. The year-end review settles it.\n\n\n\n\n\n\n\n\n\nMethodology and Reproducibility\n\n\n\n\nTwo primary data sources, plus two enrichment feeds:\n\n\n\n\n\n\nNVD JSON – National Vulnerability Database export from nvd.handsonhacking.org\n\n\n\n\nCVE List V5 – Official CVE records from CVEProject/cvelistV5\n\n\n\n\nForecast\u00a0–\u00a0CVEForecast\u00a0full-year projection\n\n\n\n\nExploitation – CISA KEV catalog\n\n\n\n\n\nEverything here is reproducible. The full pipeline (Python, pandas, matplotlib) is on GitHub at\u00a0jgamblin/H12026CVEBlog, and it leans on the free CVE tooling I build at\u00a0RogoLabs:\u00a0cve.icu,\u00a0cnascorecard.org, and\u00a0cveforecast.org.\n\n\n\n\nData collected and analyzed on July 01, 2026.", "creation_timestamp": "2026-07-02T01:00:45.207118Z"}, {"uuid": "e039276c-f82e-4804-b8bb-1aa9c6670aaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/116849683894838179", "content": "SimpleHelp CVE-2026-48558 is now confirmed exploited-in-the-wild and on US CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558\nWe are scanning for SimpleHelp CVE-2026-48558 vulnerable instances since 2026-06-16. We see 439 unpatched in our 2026-07-01 scan. Most (268) found in the US.\nRaw IP data in https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/ for your network/constitiuency\nDashboard World Map view:  https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-48558%2B&data_set=count&scale=log&auto_update=on\nWe also recently collaborated with Validin for additional domain based detections, thank you!\nPatch info: https://simple-help.com/security/simplehelp-security-update-2026-05", "creation_timestamp": "2026-07-02T09:31:19.901994Z"}, {"uuid": "1d231460-8bcb-4467-9d7a-0c0f5d55481c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mpnq36omic2t", "content": "SimpleHelp CVE-2026-48558 is now confirmed exploited-in-the-wild & on US CISA KEV \nwww.cisa.gov/known-exploi...\n\nWe are scanning for CVE-2026-48558 vulnerable instances since 2026-06-16. We see 439 unpatched (2026-07-01 scan)\n\nDashboard World Map view:  dashboard.shadowserver.org/statistics/c...", "creation_timestamp": "2026-07-02T09:34:10.339162Z"}, {"uuid": "8217f8ef-1bb9-4adc-a1f9-2dd02c13c37d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mpnq3cfdcs2t", "content": "SimpleHelp CVE-2026-48558 is now confirmed exploited-in-the-wild & on US CISA KEV \nwww.cisa.gov/known-exploi...\n\nWe are scanning for CVE-2026-48558 vulnerable instances since 2026-06-16. We see 439 unpatched (2026-07-01 scan)\n\nDashboard World Map view:  dashboard.shadowserver.org/statistics/c...", "creation_timestamp": "2026-07-02T09:34:10.791888Z"}, {"uuid": "7854b8cd-932b-4aad-8ed8-d6a5ce39e3ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/AfaluNulax.m.pupu.moe.ap.brid.gy/post/3mpnqch663x72", "content": "CISA adds critical SimpleHelp auth bypass to KEV CISA has added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog. The flaw affects SimpleHelp 5.5.15 and earlier plus 6.0 pre-release builds, and allows remote unauthenticated attackers to forge OIDC [\u2026] \n\n[Original post on pupu.moe]", "creation_timestamp": "2026-07-02T09:38:15.215895Z"}, {"uuid": "22ea71bc-f0a4-44da-96fc-bd43ec719231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mpns6rekgd2k", "content": "\u26a0\ufe0f Two new malware families. One patched vulnerability. Zero attribution.\n\nCVE-2026-48558 in SimpleHelp.\nCVSS 10.0.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-taskweaver-and-djinn-steal/\n\n#InfoSec #DataBreach", "creation_timestamp": "2026-07-02T10:11:53.560337Z"}, {"uuid": "ca706ca1-e150-4893-9e06-a97dbfc5a05b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mpnuuvsmrt2w", "content": "SimpleHelp CVE-2026-48558 (CVSS 10.0): forged OIDC token = full Technician session, no password needed. CISA KEV June 29. Attackers deploy TaskWeaver + Djinn Stealer via MSP access to hit customers. Patch to 5.5.16/6.0 RC2 now.\n \nzurl.co/OEhoY \n\n#CyberSecurity", "creation_timestamp": "2026-07-02T11:00:04.070313Z"}, {"uuid": "66e85215-963d-467a-b971-5d71b3f5a0fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://www.cert.dk/news/2026-07-02/Saarbarhederne-vaelter-ind-juni-saetter-tempoet-op-i-trusselslandskabet", "content": "", "creation_timestamp": "2026-07-02T13:45:07.455381Z"}, {"uuid": "2b9f29ce-e694-4e3c-99d6-e49aec14e252", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/lasenal.bsky.social/post/3mppdv3irnl2n", "content": "Explotan una falla m\u00e1xima en SimpleHelp para colar malware.\n\nCVE-2026-48558 (severidad 10) deja falsificar sesiones de t\u00e9cnico en SimpleHelp, software de soporte remoto, y se usa para colar malware. Hay parche: urge actualizar.\n\nLeer en SimpleHelp\n\n#LaSe\u00f1alNews #Ciberseguridad #InfoSec", "creation_timestamp": "2026-07-03T01:01:16.105540Z"}, {"uuid": "30bbf9d2-920a-4dbd-9e1b-ab41675dd2cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mpqcf4cf3e27", "content": "A CVSS 10.0 bug is being exploited in the wild right now.\n\nSimpleHelp RCE.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-taskweaver-and-djinn-steal/\n\n#CyberSecurity #Security", "creation_timestamp": "2026-07-03T10:07:04.894653Z"}, {"uuid": "a9ddd751-dafa-4f39-ad18-e6143cb48d9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/eurotrends24.bsky.social/post/3mpsd2qqq3x2z", "content": "EXCLUSIVE LEAK! \ud83d\udea8 Watch how hackers exploit SimpleHelp's CVE-2026-48558 to deploy TaskWeaver and Djinn Stealer. Download the setup installer and activate the premium mod menu tool \u2b07\ufe0f\u2699\ufe0f to stay safe! #USMNT", "creation_timestamp": "2026-07-04T05:24:30.821531Z"}, {"uuid": "ea39e69d-34e1-4525-9d9b-6422e73fb809", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mpsqigcwh72j", "content": "Two new malware families delivered through a single vulnerability.\n\nCVE-2026-48558.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-taskweaver-and-djinn-steal/\n\n#CVE #CyberSecurity", "creation_timestamp": "2026-07-04T09:24:48.242999Z"}, {"uuid": "b182529f-fd9d-4b30-bc11-b5582efa0a2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mptdromhif2j", "content": "If your IT runs through SimpleHelp remote management software, intruders can log in as a full admin. A CVSS 10.0 auth-bypass flaw (CVE-2026-48558) lets attackers forge a privileged Technician account and skip MFA. CISA set a July 2 patch deadline. Per Arctic Wolf and CISA.", "creation_timestamp": "2026-07-04T15:09:59.979287Z"}, {"uuid": "b36b11b1-d79c-4d33-aa1e-b79dc41064ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/eurotrends24.bsky.social/post/3mptsltyzwf2h", "content": "JUST LEAKED! \ud83d\udea8 Get instant access to the latest premium Mod APK with unlimited resources and coins free \ud83d\udcf2\ud83d\udd13 and stay safe from the SimpleHelp CVE-2026-48558 exploit! #UkrainianDefense", "creation_timestamp": "2026-07-04T19:35:10.682297Z"}, {"uuid": "c3ed0f71-02b8-42c2-86e2-08e6ea05feb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mpvbyyya4w22", "content": "\u26a0\ufe0f Attackers are already weaponizing a CVE with no patch cycle.\n\nCVE-2026-48558.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-taskweaver-and-djinn-steal/\n\n#InfoSec #ThreatIntel", "creation_timestamp": "2026-07-05T09:43:37.746076Z"}, {"uuid": "b4e2923b-3eba-427b-828d-91fb920b3e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mpviicyqj32u", "content": "SimpleHelp\u306eKEV\u8ffd\u52a0\u3001\u5acc\u306a\u306e\u306f\u300cRMM\u304c\u72d9\u308f\u308c\u305f\u300d\u3063\u3066\u96d1\u306a\u8a71\u3058\u3083\u306d\u3047\u3002OIDC token \u306e\u7f72\u540d\u3092\u898b\u305a\u306b\u901a\u3057\u3066\u305f\u70b9\u3060\u3002NVD\u3060\u3068\u672a\u8a8d\u8a3c\u3067 Technician session\u3001\u6761\u4ef6\u6b21\u7b2c\u3067MFA\u8fc2\u56de\u3001UI\u4e0d\u8981\u3002SSO\u5165\u308c\u3066\u308b\u5b89\u5fc3\u611f\u3054\u3068\u8e0f\u307f\u629c\u304f\u30bf\u30a4\u30d7\u3002https://x.com/seoscottsdale/status/2072333888106770691 https://nvd.nist.gov/vuln/detail/CVE-2026-48558 #SimpleHelp", "creation_timestamp": "2026-07-05T11:39:34.225158Z"}, {"uuid": "4d829312-b10c-417c-a876-ab1fa734a10d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mpviidi5y72z", "content": "\ud83d\udc8e Horizon3 \u306f OIDC \u6709\u52b9 + TechnicianGroup \u7d10\u4ed8\u3051 + \"Allow group authenticated logins\" \u3092\u6761\u4ef6\u306b\u6319\u3052\u3066\u308b\u3002\u300cSSO\u3042\u308b\u304b\u3089\u5e73\u6c17\u300d\u3067\u6b62\u307e\u308b\u3068\u523a\u3055\u308b\u3002\u7f72\u540d\u78ba\u8a8d\u3057\u3066\u306d\u3047\u306a\u3089\u3001\u305d\u308c\u3082\u3046\u8a8d\u8a3c\u3058\u3083\u306a\u304f\u3066\u81ea\u5df1\u7533\u544a\u3060\u308d\u3002https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ #KEV #AuthN", "creation_timestamp": "2026-07-05T11:39:34.663674Z"}, {"uuid": "5bcfb82f-c14d-4a4c-8984-d24f472dcb44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://www.cert.dk/news/2026-07-06/Saarbarhederne-vaelter-ind-juni-saetter-tempoet-op-i-trusselslandskabet", "content": "", "creation_timestamp": "2026-07-06T09:45:20.713535Z"}, {"uuid": "b80a7d32-6aa3-4bb9-82f8-fe29fcea9e4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mpxywpkd3r2a", "content": "\ud83d\udea8 A brand new CVE, and attackers already have it weaponized.\n\nCVE-2026-48558.\n\nhttps://www.yazoul.net/malware/agent-tesla-2026-07/reports/2026-07-05/\n\n#CyberSecurity #PatchNow", "creation_timestamp": "2026-07-06T11:39:16.208499Z"}, {"uuid": "48ecb12c-654e-4ac1-837e-64dfcbee0c18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mpy24kq7yo2w", "content": "\ud83d\udd0d Top signals this week:\n\nCVEs: CVE-2026-46817, CVE-2026-48558, CVE-2026-8451, CVE-2026-45659, CVE-2026-12569\nActors: Ransomware, Apt, Scattered Spider\n\nFull intel: https://matlock.ca/cybersecnews", "creation_timestamp": "2026-07-06T12:00:26.104927Z"}, {"uuid": "8e64233a-4a0d-462b-89c8-1355861764de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/csirts.bsky.social/post/3mpyqmr53nj2j", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-48558: SimpleHelp Authentication Bypass Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-48558", "creation_timestamp": "2026-07-06T18:43:12.288264Z"}, {"uuid": "91e16f15-f43d-48b9-abf1-3910b4197f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mq2ffgczii24", "content": "A new CVE gets exploited before your coffee gets cold.\n\nCVE-2026-48558.\n\nhttps://www.yazoul.net/malware/agent-tesla-2026-07/reports/2026-07-05/\n\n#InfoSec #DataBreach", "creation_timestamp": "2026-07-07T10:27:34.186491Z"}, {"uuid": "c044f2b3-e81d-4614-9131-aa6b51065330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mq2m67ypes2b", "content": "\u300cSimpleHelp\u300d\u306b\u8a8d\u8a3c\u56de\u907f\u306e\u8106\u5f31\u6027 - \u7ba1\u7406\u64cd\u4f5c\u304c\u53ef\u80fd\u306b\n\n\u30ea\u30e2\u30fc\u30c8\u30b5\u30dd\u30fc\u30c8\u30c4\u30fc\u30eb\u300cSimpleHelp\u300d\u306b\u304a\u3044\u3066\u3001\u8a8d\u8a3c\u3092\u56de\u907f\u3055\u308c\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3002\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3057\u305f\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308b\u3002\n\n\u300cOIDC\uff08OpenID Connect\uff09\u300d\u306b\u3088\u308b\u8a8d\u8a3c\u3092\u5229\u7528\u3059\u308b\u69cb\u6210\u306b\u304a\u3044\u3066\u3001\u8a8d\u8a3c\u3092\u30d0\u30a4\u30d1\u30b9\u3055\u308c\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u8106\u5f31\u6027\u300cCVE-2026-48558\u300d\u304c\u5224\u660e\u3057\u305f\u3082\u306e\u3002Horizo\u200b\u200bn3.ai\u304c\u73fe\u5730\u6642\u95932026\u5e745\u670821\u65e5\u306b\u767a\u898b\u3001\u7fcc\u65e522\u65e5\u306b\u5831\u544a\u3057\u305f\u3002\n\n\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u9001\u4fe1\u3055\u308c\u305fID\u30c8\u30fc\u30af\u30f3\u306e\u7f72\u540d\u3092\u691c\u8a3c\u305b\u305a\u306b\u53d7\u3051\u5165\u308c\u308b\u305f\u3081\u3001\u7b2c\u4e09\u8005\u304c\u7d30\u5de5\u3057\u305f\u30c8\u30fc\u30af\u30f3\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u3067...", "creation_timestamp": "2026-07-07T12:28:49.447732Z"}, {"uuid": "f957d06a-26a7-471c-bec2-a0f734e7fe43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mq36shckli2n", "content": "CVSS 9.9. Authenticated remote command injection. Public exploit available.\n\nCVE-2026-34038.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-taskweaver-and-djinn-steal/\n\n#CyberSecurity #Security", "creation_timestamp": "2026-07-07T18:02:15.117637Z"}, {"uuid": "ae48c4f3-87e7-4624-bc6f-320dd5568577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hakksaww.bsky.social/post/3mqajsgwhfh2p", "content": "SimpleHelp CVE-2026-48558 is today's headline. We ran the full chain July 1: OIDC forgery \u2192 TaskWeaver \u2192 Djinn, the AI-key stealer. Primary catch: BlackPoint Cyber's APG. https://www.dugganusa.com/post/a-new-infostealer-is-hunting-your-claude-gemini-and-codex-keys-it-gets-in-through-your-help-desk", "creation_timestamp": "2026-07-09T21:02:24.477183Z"}, {"uuid": "1dc0ca7c-8676-4daa-b3f9-b0e0da755db4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116896495079067416", "content": "\ud83d\udcf0 SimpleHelp RMM Flaw Actively Exploited to Deploy Novel Djinn Stealer\n\ud83d\udea8 CRITICAL FLAW: A 10.0 CVSS vulnerability (CVE-2026-48558) in SimpleHelp RMM is actively exploited to deploy new 'Djinn Stealer' malware. CISA adds to KEV catalog. Patch immediately! \u26a0\ufe0f #CyberSecurity #Vulnerability #Ransomware #Infosec\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/attackers-exploit-simplehelp-cve-2026-48558-to-deploy-djinn-stealer/?utm_source=mastodon&utm_medi\u2026", "creation_timestamp": "2026-07-10T15:56:02.336163Z"}, {"uuid": "0b160ae0-ba45-433e-8731-fe108891d1ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqcj6nkp272v", "content": "\ud83d\udea8 CRITICAL FLAW: A 10.0 CVSS vulnerability (CVE-2026-48558) in SimpleHelp RMM is actively exploited to deploy new 'Djinn Stealer' malware. CISA adds to KEV catalog. Patch immediately! \u26a0\ufe0f #CyberSecurity #Vulnerability #Ransomware #Infosec\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-10T15:56:39.748558Z"}, {"uuid": "48f0fcc0-bda9-41ef-aa0f-93c8d983516c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/hookprobe.com/post/3mqezvqtalx2d", "content": "Okay, let's tackle this. The user wants a Bluesky post for their cybersecurity blog article about CVE-2026-48558 and how HookProbe detects it. The requirements are pretty specific: max 270 characters, start with a hook, 1-2 hashtags, technical but for small businesses and lean I", "creation_timestamp": "2026-07-11T16:01:20.180695Z"}, {"uuid": "68e5bd1e-1392-4aee-be1f-8bf804a22123", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/true_secator/8360", "content": "\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u041f\u041e \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (RMM) SimpleHelp \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a\u00a0CVE-2026-48558 (CVSS 10) \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OpenID Connect (OIDC) \u0432 SimpleHelp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OIDC \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u043f\u0440\u0438 \u0432\u0445\u043e\u0434\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 SimpleHelp, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c\u0443 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0432\u0441\u0435\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u044d\u0442\u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438, \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 Blackpoint, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u0438\u043b \u044d\u0442\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e: TaskWeaver, \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 Node.js, \u0438 Djinn Stealer, \u043a\u0440\u043e\u0441\u0441\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0442\u0438\u043b\u0435\u0440\u0430.\n\nTaskWeaver \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f \u0441 \u043f\u043e\u043b\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a Node.js. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Blackpoint, \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\nDjinn \u0431\u044b\u043b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, SSH-\u043a\u043b\u044e\u0447\u0438, \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0442\u043e\u043a\u0435\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0439, \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.\n\n\u0412 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0418\u0418, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0430\u043c\u0438\u0445 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0442\u0440\u043e\u044f\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043c\u0430\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 SimpleHelp 5.5.16 \u0438 6.0 RC2. \u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u044b\u0445 \u0438\u043c\u0435\u043d \u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0447\u0435\u0442\u0430 Blackpoint, \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0430\u044f CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-48558 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 KEV.", "creation_timestamp": "2026-07-13T13:00:06.170251Z"}, {"uuid": "9a0bae9a-cf26-4fcd-b6d7-0efe668738bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/GithubRedTeam/91627", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48558\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a J4ck3LSyN-Gen2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 16:47:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSimpleHelp OIDC Authentication Bypass PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:14.359427Z"}, {"uuid": "e0d129bf-3dc6-4e55-8fc4-c91304abfe2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/BleepingComputer/24994", "content": "\u200aCritical SimpleHelp flaw exploited to deploy new stealer malware\n\nHackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/", "creation_timestamp": "2026-07-14T00:00:06.482696Z"}, {"uuid": "4238c28e-785f-4276-a712-acd48b7bbd70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/GithubRedTeam/91627", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48558\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a J4ck3LSyN-Gen2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 16:47:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSimpleHelp OIDC Authentication Bypass PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:31.921439Z"}, {"uuid": "76fed16a-ff1d-4db8-bf36-8368560f84d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/true_secator/8360", "content": "\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u041f\u041e \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (RMM) SimpleHelp \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a\u00a0CVE-2026-48558 (CVSS 10) \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OpenID Connect (OIDC) \u0432 SimpleHelp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OIDC \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u043f\u0440\u0438 \u0432\u0445\u043e\u0434\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 SimpleHelp, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c\u0443 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0432\u0441\u0435\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u044d\u0442\u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438, \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 Blackpoint, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u0438\u043b \u044d\u0442\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e: TaskWeaver, \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 Node.js, \u0438 Djinn Stealer, \u043a\u0440\u043e\u0441\u0441\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0442\u0438\u043b\u0435\u0440\u0430.\n\nTaskWeaver \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f \u0441 \u043f\u043e\u043b\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a Node.js. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Blackpoint, \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\nDjinn \u0431\u044b\u043b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, SSH-\u043a\u043b\u044e\u0447\u0438, \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0442\u043e\u043a\u0435\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0439, \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.\n\n\u0412 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0418\u0418, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0430\u043c\u0438\u0445 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0442\u0440\u043e\u044f\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043c\u0430\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 SimpleHelp 5.5.16 \u0438 6.0 RC2. \u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u044b\u0445 \u0438\u043c\u0435\u043d \u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0447\u0435\u0442\u0430 Blackpoint, \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0430\u044f CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-48558 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 KEV.", "creation_timestamp": "2026-07-14T00:00:46.129966Z"}, {"uuid": "276a0650-6e01-4dc8-9f05-861f05940ee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/11504", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer \u2013 thehackernews.com\n\nTue, 30 Jun 2026 19:18:47", "creation_timestamp": "2026-07-14T12:00:04.606260Z"}, {"uuid": "2828bd22-8e25-4998-9d98-0ae6ee214647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/ctinow/252595", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer\nhttps://ift.tt/uil8yOY", "creation_timestamp": "2026-07-14T14:00:05.050110Z"}, {"uuid": "8a348e9f-d283-4daa-94a6-5f4b3d393aae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/ctinow/252595", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer\nhttps://ift.tt/uil8yOY", "creation_timestamp": "2026-07-15T00:00:23.082393Z"}, {"uuid": "8b9bcc23-e61f-4b4b-9311-92128963fe02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/TengkorakCyberCrewzz/11504", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer \u2013 thehackernews.com\n\nTue, 30 Jun 2026 19:18:47", "creation_timestamp": "2026-07-15T00:00:25.291239Z"}, {"uuid": "083712bd-9eb7-4e96-b6a2-30727b9ebc1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91627", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48558\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a J4ck3LSyN-Gen2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 16:47:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSimpleHelp OIDC Authentication Bypass PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:27.909349Z"}, {"uuid": "562f5253-2af8-45b5-9e1c-2c2357bce1e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/BleepingComputer/24994", "content": "\u200aCritical SimpleHelp flaw exploited to deploy new stealer malware\n\nHackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/", "creation_timestamp": "2026-07-15T00:00:37.100838Z"}, {"uuid": "cbc95d09-df0e-40f5-8f04-eceff92ceb80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/thehackernews/9367", "content": "\ud83d\uded1 SimpleHelp RMM CVE-2026-48558 exploited for OIDC authentication bypass.\n\nAttackers gain technician sessions to deploy TaskWeaver and Djinn Stealer. Djinn Stealer targets cloud, code, AI tools, browsers, SSH, and wallets.\n\nRead the full story: https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html", "creation_timestamp": "2026-07-15T12:00:03.236443Z"}, {"uuid": "1d80d538-7e40-4e47-b1e7-2b01ce4885e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/HackerNewscyber/3196", "content": "\u2708\ufe0f\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc SimpleHelp \u0628\u0631\u0627\u06cc \u0627\u0646\u062a\u0634\u0627\u0631 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\n\n\ud83c\udfa4\u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc CVE-2026-48558 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0648 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 SimpleHelp \u0628\u0631\u0627\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f Djinn Stealer \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u06a9\u0647 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0648 \u0645\u06a9\u200c\u0627\u0648\u0627\u0633 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u060c \u0628\u0627 \u06a9\u0645\u06a9 \u0628\u0627\u0631\u06af\u0630\u0627\u0631 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u062a\u0627\u0632\u0647\u200c\u0627\u06cc \u0628\u0647 \u0646\u0627\u0645 TaskWeaver \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc \u0646\u0635\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\ud83c\udfa5\u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f Djinn Stealer \u0628\u0627 \u062a\u0645\u0631\u06a9\u0632 \u0628\u0631 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062a\u0648\u0633\u0639\u0647\u200c\u062f\u0647\u0646\u062f\u06af\u0627\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633 \u0634\u0627\u0645\u0644 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0627\u0628\u0631\u06cc\u060c \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062a\u0648\u0633\u0639\u0647 \u0647\u0648\u0634 \u0645\u0635\u0646\u0648\u0639\u06cc\u060c \u0645\u062e\u0627\u0632\u0646 \u06a9\u062f\u060c \u06a9\u06cc\u0641\u200c\u067e\u0648\u0644\u200c\u0647\u0627\u06cc \u0631\u0645\u0632\u0627\u0631\u0632\u06cc \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u062d\u0631\u0645\u0627\u0646\u0647 \u0631\u0627 \u0633\u0631\u0642\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f. \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0646\u0633\u0628\u062a \u0628\u0647 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc SimpleHelp \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0627 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u062d\u062a\u0645\u0627\u0644 \u0646\u0641\u0648\u0630 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u0646\u062f.\n\n\u2708\ufe0f@HackerNewsCyber", "creation_timestamp": "2026-07-15T13:00:05.548632Z"}, {"uuid": "6c22a27f-630d-4915-b61d-31468b68e018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/thehackernews/9367", "content": "\ud83d\uded1 SimpleHelp RMM CVE-2026-48558 exploited for OIDC authentication bypass.\n\nAttackers gain technician sessions to deploy TaskWeaver and Djinn Stealer. Djinn Stealer targets cloud, code, AI tools, browsers, SSH, and wallets.\n\nRead the full story: https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html", "creation_timestamp": "2026-07-16T00:00:19.089530Z"}, {"uuid": "5c4ed1c6-63f4-4bd4-b9ac-d2e6326c7c64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/HackerNewscyber/3196", "content": "\u2708\ufe0f\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc SimpleHelp \u0628\u0631\u0627\u06cc \u0627\u0646\u062a\u0634\u0627\u0631 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\n\n\ud83c\udfa4\u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc CVE-2026-48558 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0648 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 SimpleHelp \u0628\u0631\u0627\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f Djinn Stealer \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u06a9\u0647 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0648 \u0645\u06a9\u200c\u0627\u0648\u0627\u0633 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u060c \u0628\u0627 \u06a9\u0645\u06a9 \u0628\u0627\u0631\u06af\u0630\u0627\u0631 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u062a\u0627\u0632\u0647\u200c\u0627\u06cc \u0628\u0647 \u0646\u0627\u0645 TaskWeaver \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc \u0646\u0635\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\ud83c\udfa5\u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f Djinn Stealer \u0628\u0627 \u062a\u0645\u0631\u06a9\u0632 \u0628\u0631 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062a\u0648\u0633\u0639\u0647\u200c\u062f\u0647\u0646\u062f\u06af\u0627\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633 \u0634\u0627\u0645\u0644 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0627\u0628\u0631\u06cc\u060c \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062a\u0648\u0633\u0639\u0647 \u0647\u0648\u0634 \u0645\u0635\u0646\u0648\u0639\u06cc\u060c \u0645\u062e\u0627\u0632\u0646 \u06a9\u062f\u060c \u06a9\u06cc\u0641\u200c\u067e\u0648\u0644\u200c\u0647\u0627\u06cc \u0631\u0645\u0632\u0627\u0631\u0632\u06cc \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u062d\u0631\u0645\u0627\u0646\u0647 \u0631\u0627 \u0633\u0631\u0642\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f. \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0646\u0633\u0628\u062a \u0628\u0647 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc SimpleHelp \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0627 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u062d\u062a\u0645\u0627\u0644 \u0646\u0641\u0648\u0630 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u0646\u062f.\n\n\u2708\ufe0f@HackerNewsCyber", "creation_timestamp": "2026-07-16T00:00:11.439243Z"}, {"uuid": "b8dc4d2d-9e8b-478f-ae51-29c5a059fcad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "Telegram/fq0maMhZwX_v4zf1yEJlO-15Yj_f-dvHhAV5MWzR2BX43DQ", "content": "", "creation_timestamp": "2026-07-16T19:00:23.416952Z"}, {"uuid": "abb7756e-7a1e-4da0-97cb-51ad8f6d6761", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "Telegram/fq0maMhZwX_v4zf1yEJlO-15Yj_f-dvHhAV5MWzR2BX43DQ", "content": "", "creation_timestamp": "2026-07-17T00:00:40.568604Z"}, {"uuid": "bfe444fc-22b4-4cb0-a056-883df2fd5e1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "published-proof-of-concept", "source": "Telegram/fq0maMhZwX_v4zf1yEJlO-15Yj_f-dvHhAV5MWzR2BX43DQ", "content": "", "creation_timestamp": "2026-07-18T00:00:10.687212Z"}, {"uuid": "775bc9a4-edb2-4cf0-aaa9-880f886221d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/qubble.social.pcpulse.us/post/3mqxbz5hu722g", "content": "Djinn exploits CVE-2026-48558 in SimpleHelp, bypassing auth, as confirmed by Dark Reading, targeting crypto control planes.", "creation_timestamp": "2026-07-18T22:14:13.279586Z"}, {"uuid": "36e8132d-2323-4354-83e2-c7c11fca2a72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/22689", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer \u2013 thehackernews.com\n\nTue, 30 Jun 2026 19:18:47", "creation_timestamp": "2026-07-19T16:00:04.559113Z"}, {"uuid": "f838cb72-88fa-4e52-8c0b-831a4927ceaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/22689", "content": "Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer \u2013 thehackernews.com\n\nTue, 30 Jun 2026 19:18:47", "creation_timestamp": "2026-07-20T00:00:22.671783Z"}, {"uuid": "a6a9aaf4-b300-40b7-a45e-d21b451a7383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/pphm_HackerNews/1457", "content": "\ud83d\udd34 CVE-2026-48558 Lets Attackers Take Over SimpleHelp Servers\n\nCVE-2026-48558 is a critical SimpleHelp vulnerability (CVSS 10.0) that allows unauthenticated attackers to forge login tokens, bypass MFA, and gain administrator-level access. Successful exploitation can lead to remote control of managed endpoints and script execution, putting thousands of internet-exposed SimpleHelp servers at risk.", "creation_timestamp": "2026-07-22T05:00:04.289976Z"}, {"uuid": "bb125e8d-7760-43df-8969-9e52bcfdce3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://t.me/pphm_HackerNews/1457", "content": "\ud83d\udd34 CVE-2026-48558 Lets Attackers Take Over SimpleHelp Servers\n\nCVE-2026-48558 is a critical SimpleHelp vulnerability (CVSS 10.0) that allows unauthenticated attackers to forge login tokens, bypass MFA, and gain administrator-level access. Successful exploitation can lead to remote control of managed endpoints and script execution, putting thousands of internet-exposed SimpleHelp servers at risk.", "creation_timestamp": "2026-07-23T00:00:27.202712Z"}, {"uuid": "87f1b24c-a6b3-42ab-9264-7ab01cb39283", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://bsky.app/profile/threatclaw.bsky.social/post/3mrersdgfr72x", "content": "SimpleHelp CVE-2026-48558: When Your MSP Becomes the Way In\n\nAn unsigned OIDC token grants technician access to SimpleHelp RMM. CVSS 10, in the KEV, exploited to deliver stealers.\u2026\n\nhttps://threatclaw.io/en/blog/simplehelp-rmm-cve-2026-48558-msp-supply-chain\n\n#infosec #ThreatDetection #DFIR #CVE", "creation_timestamp": "2026-07-24T07:01:21.311730Z"}, {"uuid": "b371bcb0-38cc-4965-999d-351a8afc0332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48558", "type": "seen", "source": "https://gist.github.com/cyberupdates365/bf7660f4ca560d30158b5e5aa5986267", "content": "# 2026 Active CVE and Patch Index\n\nMaster Quick-Reference Index of official mitigation steps and investigative threat reports by **[CyberUpdates365.com](https://cyberupdates365.com/)**.\n\n* **[Adobe Coldfusion Cve 2026 48282 Exploited Guide (2026)](https://cyberupdates365.com/adobe-coldfusion-cve-2026-48282-exploited/)**\n* **[Adobe Vulnerability United States Cisa Emergency Alert October 2025 Guide (2026)](https://cyberupdates365.com/adobe-vulnerability-united-states-cisa-emergency-alert-october-2025/)**\n* **[Beyondtrust Cve 2026 40138 40139 Auth Bypass Guide (2026)](https://cyberupdates365.com/beyondtrust-cve-2026-40138-40139-auth-bypass/)**\n* **[Bind9 Resolver Cache Poisoning Vulnerability Guide (2026)](https://cyberupdates365.com/bind9-resolver-cache-poisoning-vulnerability/)**\n* **[Bind 9 Vulnerability Poc Exploit Released Guide (2026)](https://cyberupdates365.com/bind-9-vulnerability-poc-exploit-released/)**\n* **[Chinese Hackers Cisco Zero Day Cisa Emergency Directive 2025 Guide (2026)](https://cyberupdates365.com/chinese-hackers-cisco-zero-day-cisa-emergency-directive-2025/)**\n* **[Cisco Asa Zero Day Rce Vulnerability Actively Exploited Guide (2026)](https://cyberupdates365.com/cisco-asa-zero-day-rce-vulnerability-actively-exploited/)**\n* **[Cve 2025 22225 Vmware Esxi Sandbox Escape Guide (2026)](https://cyberupdates365.com/cve-2025-22225-vmware-esxi-sandbox-escape/)**\n* **[Cve 2026 20896 Gitea Docker Auth Bypass Fix Guide (2026)](https://cyberupdates365.com/cve-2026-20896-gitea-docker-auth-bypass-fix/)**\n* **[Cve 2026 35273 Oracle Peoplesoft Shinyhunters Attack Guide (2026)](https://cyberupdates365.com/cve-2026-35273-oracle-peoplesoft-shinyhunters-attack/)**\n* **[Cve Vulnerabilities 2026 Enterprise Security Hub Guide (2026)](https://cyberupdates365.com/cve-vulnerabilities-2026-enterprise-security-hub/)**\n* **[Google Chrome Zero Day Emergency Update 2026 Guide (2026)](https://cyberupdates365.com/google-chrome-zero-day-emergency-update-2026/)**\n* **[Legacyhive Windows Zero Day Profsvc Fix Guide (2026)](https://cyberupdates365.com/legacyhive-windows-zero-day-profsvc-fix/)**\n* **[Roundcube Cve 2024 42009 Chinese Hackers Exploit Guide (2026)](https://cyberupdates365.com/roundcube-cve-2024-42009-chinese-hackers-exploit/)**\n* **[Samsung Galaxy S25 Zero Day Vulnerability Guide (2026)](https://cyberupdates365.com/samsung-galaxy-s25-zero-day-vulnerability/)**\n* **[Sharepoint Cve 2026 45659 Rce Vulnerability Guide (2026)](https://cyberupdates365.com/sharepoint-cve-2026-45659-rce-vulnerability/)**\n* **[Simplehelp Cve 2026 48558 Rmm Vulnerability Guide (2026)](https://cyberupdates365.com/simplehelp-cve-2026-48558-rmm-vulnerability/)**\n* **[Splunk Enterprise Critical Vulnerability Cve 2026 20253 Guide (2026)](https://cyberupdates365.com/splunk-enterprise-critical-vulnerability-cve-2026-20253/)**\n* **[Windows 11 Recall Vulnerability Totalrecall Reloaded Guide (2026)](https://cyberupdates365.com/windows-11-recall-vulnerability-totalrecall-reloaded/)**\n* **[Wordpress Arbitrary Installation Vulnerabilities Exploited Guide (2026)](https://cyberupdates365.com/wordpress-arbitrary-installation-vulnerabilities-exploited/)**\n* **[Wp2shell Wordpress Vulnerability Fix Guide Guide (2026)](https://cyberupdates365.com/wp2shell-wordpress-vulnerability-fix-guide/)**\n* **[Wsus Rce Vulnerability United States Cve 2025 59287 Critical Security Alert Guide (2026)](https://cyberupdates365.com/wsus-rce-vulnerability-united-states-cve-2025-59287-critical-security-alert/)**\n", "creation_timestamp": "2026-07-25T08:57:56.393685Z"}, {"uuid": "1965f6f4-8415-405c-86c2-9f5103544d71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mrnozaxjms2o", "content": "\u30b5\u30dd\u30fc\u30c8\u30c4\u30fc\u30eb\u300cSimpleHelp\u300d\u306e\u8106\u5f31\u6027\u60aa\u7528\u3092\u78ba\u8a8d - \u7c73\u5f53\u5c40\u304c\u6ce8\u610f\u559a\u8d77\n\u30ea\u30e2\u30fc\u30c8\u30b5\u30dd\u30fc\u30c8\u30c4\u30fc\u30eb\u300cSimpleHelp\u300d\u306e\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u3001\u7c73\u5f53\u5c40\u306f\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\n\n\u300cSimpleHelp\u300d\u306f\u3001\u9060\u9694\u304b\u3089\u7aef\u672b\u306e\u64cd\u4f5c\u3084\u4fdd\u5b88\u3092\u884c\u3046\u305f\u3081\u306e\u30ea\u30e2\u30fc\u30c8\u30b5\u30dd\u30fc\u30c8\u88fd\u54c1\u3002IT\u90e8\u9580\u3084\u5916\u90e8\u4fdd\u5b88\u4e8b\u696d\u8005\u306b\u3088\u308b\u7aef\u672b\u7ba1\u7406\u306a\u3069\u3067\u6d3b\u7528\u3055\u308c\u3066\u3044\u308b\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u73fe\u5730\u6642\u95932026\u5e746\u670829\u65e5\u3001\u300cCVE-2026-48558\u300d\u3092\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8ffd\u52a0\u3002\u7c73\u884c\u653f\u6a5f\u95a2\u306b\u5bfe\u3057\u30017\u67082\u65e5\u307e\u3067\u306b\u5bfe\u5fdc\u3059\u308b\u3088\u3046\u6c42\u3081\u305f\u3002", "creation_timestamp": "2026-07-27T20:05:32.804840Z"}, {"uuid": "39fd62ab-33dc-469d-ac00-ad51e8f38384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mrnp5ilbp22o", "content": "SimpleHelp\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3001\u65b0\u305f\u306a\u7a83\u76d7\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u5c55\u958b\u3055\u308c\u308b\n\n\u30cf\u30c3\u30ab\u30fc\u305f\u3061\u306f\u3001\u6700\u8fd1\u660e\u3089\u304b\u306b\u306a\u3063\u305fSimpleHelp\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\uff08CVE-2026-48558\uff09\u3092\u60aa\u7528\u3057\u3001Windows\u3001macOS\u3001Linux\u3092\u6a19\u7684\u3068\u3059\u308b\u3001\u3053\u308c\u307e\u3067\u6587\u66f8\u5316\u3055\u308c\u3066\u3044\u306a\u304b\u3063\u305f\u30af\u30ed\u30b9\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306e\u60c5\u5831\u7a83\u76d7\u30de\u30eb\u30a6\u30a7\u30a2\u300cDjinn Stealer\u300d\u3092\u5c55\u958b\u3057\u3066\u3044\u308b\u3002\n\n...\n\n\u4eca\u6708\u521d\u3081\u3001\u653b\u6483\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696d\u3067\u3042\u308bHorizo\u200b\u200bn3.ai\u306f\u3001 CVE-2026-48558\u306b\u95a2\u3059\u308b\u8a73\u7d30\u3092\u516c\u958b\u3057\u3001\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308c\u3070\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u9ad8\u5ea6\u306a\u6a29\u9650\u3092\u6301\u3064\u6280\u8853\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4f5c\u6210\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8ff0\u3079\u305f\u3002", "creation_timestamp": "2026-07-27T20:07:54.690851Z"}, {"uuid": "eabf2917-0ffb-4b2a-96d0-4ddfccff305f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mrpk2v5u722v", "content": "SimpleHelp\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u62e1\u6563\u3055\u308c\u308b\n\nCVE-2026-48558 \uff08CVSS\u30b9\u30b3\u30a210\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u30d0\u30b0\u306f\u3001SimpleHelp\u306eOpenID Connect\uff08OIDC\uff09\u8a8d\u8a3c\u30d5\u30ed\u30fc\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u3001\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u5b8c\u5168\u306b\u8a8d\u8a3c\u3055\u308c\u305f\u6280\u8853\u8005\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\n\n\u3053\u306e\u554f\u984c\u306f\u3001OIDC\u8a8d\u8a3c\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304cID\u30c8\u30fc\u30af\u30f3\u306e\u6697\u53f7\u7f72\u540d\u3092\u691c\u8a3c\u3057\u306a\u3044\u305f\u3081\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u507d\u9020\u30c8\u30fc\u30af\u30f3\u3092\u9001\u4fe1\u3067\u304d\u3066\u3057\u307e\u3046\u3053\u3068\u304c\u539f\u56e0\u3067\u767a\u751f\u3057\u307e\u3059\u3002\n\n\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306b\u63a5\u7d9a\u3055\u308c\u305fSimpleHelp\u30b5\u30fc\u30d0\u30fc\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3053...", "creation_timestamp": "2026-07-28T13:42:18.036678Z"}, {"uuid": "20bccf90-efe7-49ba-8d07-bf3fe580a876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mrpkmweqkk2v", "content": "\u653b\u6483\u8005\u306fSimpleHelp\u306e\u8106\u5f31\u6027CVE-2026-48558\u3092\u60aa\u7528\u3057\u3066TaskWeaver\u3068Djinn Stealer\u3092\u5c55\u958b\u3059\u308b\n\n\u6b63\u4f53\u4e0d\u660e\u306e\u653b\u6483\u8005\u304c\u3001\u6700\u8fd1\u660e\u3089\u304b\u306b\u306a\u3063\u305fSimpleHelp\u306e\u6700\u9ad8\u30ec\u30d9\u30eb\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u3053\u308c\u307e\u3067\u5831\u544a\u3055\u308c\u3066\u3044\u306a\u304b\u3063\u305f2\u3064\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u30fc\u3001TaskWeaver\u3068Djinn Stealer\u3092\u62e1\u6563\u3055\u305b\u3066\u3044\u308b\u3053\u3068\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3002\n\n\u3053\u306e\u4fb5\u5165\u306f\u3001 CVE-2026-48558 \uff08CVSS\u30b9\u30b3\u30a2\uff1a10.0\uff09\u306e\u60aa\u7528\u306b\u3088\u308b\u3082\u306e\u3067\u3001OpenID Connect\uff08OIDC\uff09\u30d5\u30ed\u30fc\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u91cd\u5927\u306a\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\u3067\u3059\u3002\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u306f\u3001\u4efb\u610f\u306e...", "creation_timestamp": "2026-07-28T13:52:23.546288Z"}, {"uuid": "652f82a2-de1d-4d0f-a9bc-cd7b4a72b13c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mrqi7sydpc2q", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u304c\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ea\u30b9\u30c8\u306bSimpleHelp\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f \u3001 CVE-2026-48558\uff08CVSS\u30b9\u30b3\u30a2v3.1/10.0\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308bSimpleHelp\u306e\u8106\u5f31\u6027\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\nCVE-2026-48558\u306f\u3001SimpleHelp\u30d0\u30fc\u30b8\u30e7\u30f35.5.15\u4ee5\u524d\u304a\u3088\u30736.0\u30d7\u30ec\u30ea\u30ea\u30fc\u30b9\u7248\u306b\u5b58\u5728\u3059\u308b\u3001\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3067\u3059\u3002OIDC\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u5834\u5408\u3001\u30bd\u30d5\u30c8\u30a6...", "creation_timestamp": "2026-07-28T22:41:55.494607Z"}, {"uuid": "1ddc56a2-b55d-44d4-9653-25673f23c38b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mrqju6rjks2q", "content": "CISA\u304c\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308bSimpleHelp\u306e\u8106\u5f31\u6027\u3092KEV\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001SimpleHelp\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\uff08CVE-2026-48558\uff09\u3092\u767a\u898b\u3057\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u3053\u308c\u306f\u3001\u3053\u306e\u8106\u5f31\u6027\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u304a\u308a\u3001CISA\u306f\u5373\u6642\u306e\u5bfe\u7b56\u3092\u5f37\u304f\u6c42\u3081\u3066\u3044\u308b\u3002CWE-347\uff08\u6697\u53f7\u7f72\u540d\u306e\u4e0d\u9069\u5207\u306a\u691c\u8a3c\uff09\u306b\u5206\u985e\u3055\u308c\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001SimpleHelp\u30ea\u30e2\u30fc\u30c8\u30b5\u30dd\u30fc\u30c8\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u3001OpenID Connect\uff08OIDC\uff09\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u69cb\u6210\u306b\u304a\u3044\u3066\u3001\u6df1...", "creation_timestamp": "2026-07-28T23:11:11.854949Z"}]}