Password spraying attacks surge 155x as hackers exploit MFA gaps
Teaser from the source
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on Password
Other advisories
- MediumCVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
- HighCVE-2026-18199Zohocorp ManageEngine Password Manager Pro: Betriebssystem-Befehlsinjektion
- HighCVE-2026-18199Zohocorp ManageEngine Password Manager Pro: Betriebssystem-Befehlsinjektion
- Not ratedosv:CLEANSTART-2024-YV49525When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog
- Not ratedosv:CLEANSTART-2024-VZ65902attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, passwo...
- Not ratedosv:CLEANSTART-2024-TJ47241It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords
- Not ratedosv:CLEANSTART-2024-BK15179In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue
- Not ratedosv:CLEANSTART-2024-VN57998slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash
Other news entries
- mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious ActivityNewsThe Hacker News
- Chainstack Reports Production Systems Breach Exposing Customer Data and Password HashesNewsThe Hacker News
- Password manager mSecure tells users to change passwords, won't say whyNewsThe Register — Security
- cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password HashesNewsThe Hacker News
- ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and MoreNewsThe Hacker News
- Alpine Linux rebuilds GitLab after attempted RCE attackNewsBleepingComputer
- Passkeys Are Better Than Passwords. But They Are Not Enough.NewsSecurityWeek
- Chainalysis says an attacker using agentic techniques accessed its systems; customer user names, emails and roles exposedBreachpwn.watch
ID