Overview of incoming advisories.
2019 results found
Two critical vulnerabilities have been discovered in Wasmtime, a widely-used WebAssembly runtime that can be embedded in other software. These flaws could allow a malicious WebAssembly module to escape the sandbox designed to isolate and contain it. An attacker would need to control a module compiled by a vulnerable Wasmtime build to exploit these issues. One of the two flaws is specific to ARM64 architecture systems. The Wasmtime project maintainers have acknowledged the vulnerabilities and released fixed versions to address them. The severity is considered critical due to the sandbox escape nature, which undermines a core security guarantee of the WebAssembly runtime model. Organizations using Wasmtime in their software stack, especially on ARM64, are advised to update immediately.
View original advisory →A rentable Android spyware kit named uCreator has been discovered targeting users of Telegram and WeChat by embedding malicious code inside trojanized versions of these popular apps. The spyware spreads through unofficial app stores or via a custom container app created by the kit's developers. Once installed, uCreator can steal Telegram two-factor authentication passwords and clone WeChat accounts. The kit's Telegram-targeting component has been linked to a known backdoor called Baohuo, previously documented by Doctor Web. The campaign represents a significant threat to users who sideload applications outside official marketplaces. The modular, rentable nature of the kit suggests a malware-as-a-service model, lowering the barrier for threat actors to deploy sophisticated mobile espionage tools.
View original advisory →Two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have been actively exploited in the wild. The vulnerabilities are classified as critical severity and allow attackers to execute arbitrary code remotely. Security researchers have confirmed successful exploitation attempts against affected systems. The dual CVEs are being tracked together under the PHP2Shell collective name, suggesting a coordinated or related attack surface. Organizations running affected PHP2Shell installations are urged to apply patches or mitigations immediately given the confirmed in-the-wild exploitation status.
View original advisory →Cybersecurity researchers at Huntress identified a Microsoft 365 campaign exploiting adversary-in-the-middle (AitM) relay techniques to capture sign-in sessions and replay stolen authentication tokens. The campaign was observed between July 14 and September 22, 2026, resulting in 497 successful sign-in events. A total of 97 accounts across 79 organizations were compromised through this token hijacking method. The attack bypasses traditional authentication controls by intercepting and reusing valid session tokens rather than stealing credentials. This type of attack is particularly dangerous as it can circumvent multi-factor authentication protections. The campaign specifically targeted Microsoft 365 email accounts, suggesting a focus on business email compromise or data exfiltration.
View original advisory →An automated campaign tracked as Gheist is leveraging stolen GitHub tokens to inject malicious workflows into repositories. These workflows are designed to print repository secrets into GitHub Actions logs, which attackers then download and subsequently delete to cover their tracks. The campaign has successfully compromised both private repositories and GitHub Enterprise environments. The analysis was conducted by cloud security company Wiz. A GitHub safeguard mechanism that pauses workflows is referenced as a partial mitigation. The attack method abuses legitimate GitHub Actions functionality to exfiltrate sensitive credentials and secrets. The use of stolen tokens allows attackers to authenticate and operate as legitimate users, making detection difficult. The campaign highlights risks associated with CI/CD pipeline security and secret management in GitHub environments.
View original advisory →Researchers discovered a malicious AGENTS.md markdown instruction file placed in a customer's Downloads folder that was used to hijack an AI coding agent. The file tricked the AI agent into installing a rogue npm package, demonstrating a new attack vector targeting AI-assisted development tools. This technique leverages the way AI coding agents process instruction files found in accessible directories. The attack represents a form of prompt injection or indirect instruction manipulation targeting AI development workflows. The incident highlights significant supply chain risks introduced by AI coding agents that autonomously execute tasks based on contextual files. Organizations using AI coding tools should be aware that malicious instruction files in common directories like Downloads can compromise development environments.
View original advisory →CVE-2026-111497 is a critical vulnerability in the Brotli decoder that enables remote code execution. The article, published by Wiz, provides a comprehensive overview of the flaw, its impact, and mitigation strategies. Brotli is a widely used compression algorithm, and vulnerabilities in its decoder can have broad implications for applications relying on it, including Node.js environments. The vulnerability is classified as critical due to its potential for remote code execution without authentication. Wiz provides detection and mitigation guidance to help organizations protect their infrastructure. The issue highlights risks associated with widely adopted compression libraries embedded across many software supply chains.
View original advisory →A new UEFI bootkit called BlackX was deployed in an espionage campaign in early 2026, leveraging the known 'Baton Drop' vulnerability to bypass Secure Boot protections. The bootkit loads a malicious driver specifically designed to interfere with and disable security solutions from Kaspersky and Avast. This represents a sophisticated firmware-level attack targeting endpoint security tools. The Baton Drop vulnerability, while previously known, continues to be exploited by threat actors due to slow patching of UEFI firmware. UEFI bootkits are particularly dangerous as they persist below the operating system level, surviving reboots and OS reinstallations. The use of this technique in an espionage campaign suggests a well-resourced and skilled threat actor. The targeting of security software highlights an intent to remain undetected on compromised systems for extended periods.
View original advisory →A memory-corruption vulnerability tracked as CVE-2026-111497 has been discovered in Google's Brotli decoder library. The flaw enables crafted compressed data to overwrite past the end of a buffer, corrupting program memory and potentially enabling remote code execution. The vulnerability is widespread, affecting multiple popular software ecosystems including Node.js, Bun, Python's Brotli and brotlicffi packages, and Envoy proxies configured for Brotli decompression. The breadth of affected software makes this a significant supply chain and dependency risk. Any application that decompresses Brotli-encoded data using the vulnerable decoder is potentially at risk. Patches or mitigations should be applied promptly across all affected platforms.
View original advisory →On May 27, 2026, a configuration file containing the master key to a LiteLLM Agent Platform deployment was accidentally committed to the public LiteLLM-Labs/lite-harness GitHub repository. A threat actor discovered the leaked master key and leveraged it to steal GitHub tokens. With access to these tokens, the attacker was able to push a malicious version of the LiteLLM Python package, effectively hijacking the release pipeline. This represents a serious supply chain attack affecting users of the popular LiteLLM library. The incident highlights the dangers of accidentally exposing secrets in public repositories. LiteLLM disclosed the breach on a Friday in October 2026, weeks after the initial exposure in late May 2026.
View original advisory →CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The affected products are Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). One of the listed vulnerabilities is CVE-2026-110447 with a CVSS score of 9.2. Both flaws are classified as critical severity. The advisory highlights the urgency for organizations using these products to apply mitigations or patches promptly. Active exploitation has been reported, increasing the risk to enterprise and network infrastructure environments. CISA's KEV listing signals that federal agencies and critical infrastructure operators should prioritize remediation. Details on the second vulnerability were not fully disclosed in the available content.
View original advisory →Socket's Threat Research team uncovered that malicious secret-exfiltration GitHub Actions workflows ran in the BerriAI/litellm repository on October 10 and 12, 2026 — eleven days before the known supply chain attack on October 21, 2026 that published malicious litellm==1.107.0 artifacts to PyPI and Docker. The attacker used a 'branch, push, run, delete' technique with short-lived branches named ci-tmp-<hex> to avoid detection, running workflows that stole CI secrets by exfiltrating them via curl to webhook.site endpoints. Across two workflow runs, 20 distinct secrets were stolen including GH_TOKEN, GitHub App private keys, API keys for Anthropic, OpenAI, AWS Bedrock, and GitGuardian, as well as database credentials and session cookies. LiteLLM traced initial access to an Agent Platform master key accidentally committed to a public repository in May 2026 and never revoked. The stolen GH_TOKEN from October 10 was linked by LiteLLM's audit logs to approval of the October 21 malicious release, establishing a clear attack chain from reconnaissance to supply chain compromise.
View original advisory →The article discusses a significant security event surrounding a PHP2Shell vulnerability that caused widespread concern in the cybersecurity community. The author describes the situation as causing significant alarm among security professionals, including themselves. The piece appears to analyze the exploitability and reliability of the PHP2Shell vulnerability. PHP2Shell vulnerabilities typically allow attackers to execute arbitrary shell commands through PHP-based web applications. The article seems to evaluate whether the reported exploitability concerns were warranted. This type of vulnerability is of high concern as it can lead to remote code execution on affected web servers. The article was published on October 23rd as part of the SANS Internet Storm Center daily diary series.
View original advisory →Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in Onigmo, the regular expression engine embedded in the language. These three bugs are responsible for four critical remote code execution (RCE) vulnerabilities that GitLab patched over the past month. The flaws allow a specially crafted regex pattern to corrupt memory during Ruby's compilation process, potentially enabling code execution on GitLab's servers. The vulnerability chain highlights a supply chain risk where a language-level bug propagates to dependent platforms. GitLab users and Ruby developers are strongly encouraged to update to the patched versions immediately. The severity is considered critical given the RCE potential on widely-used DevOps infrastructure.
View original advisory →Cybersecurity researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is a framework called 'Phantom,' described as an Autonomous Red Team Kill Chain Framework. The threat actors are assessed to be Russian-speaking and operate as both intrusion and data-extortion operators. The discovery came through exposed infrastructure that revealed how ransomware affiliates are leveraging AI agents to execute intrusions. This represents a significant evolution in ransomware tactics, with threat actors automating attack chains using artificial intelligence. The use of AI agents enables more scalable, efficient, and potentially harder-to-detect intrusion operations. The operation highlights the growing intersection of AI technology and cybercriminal activity, particularly in the ransomware ecosystem.
View original advisory →Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach affecting patient records. A threat actor gained unauthorized access to the company's Quanum LSM system, resulting in the exposure of sensitive patient information. The breach highlights ongoing risks to healthcare organizations and their patient data management systems. Quest Diagnostics is a high-profile target given the volume and sensitivity of medical and personal data it handles. The incident underscores the importance of securing laboratory information management systems in the healthcare sector.
View original advisory →The PHP security team has disclosed a new remote code execution (RCE) vulnerability affecting PHP installations with non-default configurations. No patch is currently available, prompting the team to share mitigation measures instead. The vulnerability poses a significant risk to affected systems as it allows remote attackers to execute arbitrary code. The issue is limited to systems running non-default PHP configurations, which may reduce the overall attack surface. Until a patch is released, administrators are advised to apply the recommended mitigations to protect their environments. This situation highlights the ongoing challenge of securing widely-used scripting languages and the importance of prompt mitigation strategies when patches are unavailable.
View original advisory →A large-scale cyberattack campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs. Threat operators have successfully compromised numerous organizations worldwide, obtaining over 70,000 credentials in the process. Researchers investigating the campaign found artifacts indicating further compromise attempts against some victims. The campaign highlights ongoing risks associated with internet-exposed network perimeter devices. The scale and targeting of enterprise-grade security infrastructure makes this a significant threat to organizations globally.
View original advisory →Hewlett Packard Enterprise (HPE) released security updates addressing 72 vulnerabilities in ArubaOS (AOS), the operating system powering Aruba networking products. Among these, eight vulnerabilities were rated maximum severity, covering remote code execution (RCE) and authentication bypass flaws. The patches represent a significant security update for enterprise network infrastructure relying on Aruba products. The maximum severity rating indicates these vulnerabilities could be exploited without authentication or with minimal user interaction. Organizations using HPE Aruba networking equipment are urged to apply the patches immediately. The breadth of the patch release (72 total CVEs) suggests a comprehensive security audit was performed. No specific CVE identifiers were detailed in the article excerpt, but the severity level warrants urgent attention. This release highlights ongoing risks in enterprise networking infrastructure from critical unpatched vulnerabilities.
View original advisory →PHP has disclosed a new remote code execution vulnerability tracked as CVE-2026-115560, just two days after issuing emergency patches for the critical PHP2Shell flaws. The new issue affects web applications configured in an unusual manner and is considered an unlikely risk by the PHP project. Unlike the previous PHP2Shell vulnerabilities, PHP is not issuing an emergency fix for this new issue. Instead, the project recommends disabling a specific feature as a mitigation measure. The disclosure highlights ongoing security concerns within the PHP ecosystem following the recent emergency patch cycle.
View original advisory →