Overview of incoming advisories.
2019 results found
The FBI has arrested another suspected member of the ShinyHunters hacking and extortion group. The arrest was announced by FBI Director Kash Patel and is connected to a recent breach of FBI systems. ShinyHunters is a well-known cybercriminal group responsible for numerous high-profile data breaches and extortion campaigns. This arrest follows previous law enforcement actions against the group. The case highlights ongoing efforts by federal authorities to dismantle organized cybercriminal organizations. The breach of FBI systems by the group represents a significant and bold attack against a major law enforcement agency.
View original advisory →Cybersecurity researchers have uncovered a new variant of the DarkSword iOS exploit kit, designated P7 DarkSword. This variant reduces its on-device footprint compared to previously observed versions. P7 DarkSword adds new capabilities including on-device keychain theft and crypto wallet data exfiltration. It also introduces two-way C2 (command and control) communication with attacker infrastructure. The discovery was reported by iVerify in a newly published report. The addition of remote command capabilities marks a significant evolution in the kit's functionality. The targeting of iOS devices and cryptocurrency wallets suggests financially motivated threat actors. This variant represents an escalation in mobile-focused exploit tooling.
View original advisory →Germany has arrested a Russian national suspected of being a core member of the Qilin ransomware group. The suspect was extradited from Japan earlier in October 2026. Qilin is a ransomware-as-a-service (RaaS) operation known for targeting organizations across multiple sectors. The arrest represents a significant law enforcement action against the group's leadership. This follows international cooperation between Japanese and German authorities. Qilin has been linked to numerous high-profile ransomware attacks globally. The arrest may disrupt operations of the ransomware group, at least temporarily. The case highlights growing international collaboration in tackling ransomware threat actors.
View original advisory →GhostAction, a known threat campaign, has returned with a new attack vector targeting GitHub repositories. Compromised maintainers are pushing a fake 'security-audit.yml' workflow file into repositories. This malicious workflow is designed to steal CI/CD secrets and cloud credentials from GitHub Actions environments. The attack mines credentials from entire Git histories, significantly expanding the scope of potential data exfiltration. The campaign targets developers and organizations relying on GitHub Actions for their CI/CD pipelines. The use of a legitimate-sounding filename ('security-audit.yml') is a social engineering tactic to evade suspicion. This represents a supply chain attack vector, as compromised maintainers serve as the initial access point. Organizations using GitHub Actions for cloud deployments are at elevated risk of credential compromise and subsequent cloud infrastructure breach.
View original advisory →Security researchers have published a fully working exploit for a pre-authentication remote code execution vulnerability in AnyDesk for Linux. The flaw allows attackers to gain root access before any connection is approved by the user. AnyDesk silently patched the vulnerability in version 8.0.3 in June, describing it only as a bug fix causing crashes, with no CVE assigned. The lack of transparency around the patch left users unaware of the critical nature of the flaw. The publication of a working exploit significantly raises the risk for unpatched systems. Organizations using AnyDesk on Linux are strongly urged to update to version 8.0.3 or later immediately.
View original advisory →Threat actors are actively exploiting vulnerabilities in the AhsayCBS backup utility to compromise affected systems. The attack chain involves leveraging two recently disclosed flaws, including CVE-2026-105133, an improper authentication vulnerability in the checkSysPwd() function within the AhsayCBS Java codebase. Successful exploitation allows attackers to seize control of targeted devices. Post-exploitation activity includes deployment of web shells for persistent access and remote control. Attackers also deploy XMRig cryptocurrency miners disguised as Microsoft Edge to evade detection. The use of a legitimate application name as a disguise indicates deliberate obfuscation techniques. The campaign targets organizations using the AhsayCBS backup solution. The CVSS v4 score of 5.5 for the known CVE suggests moderate severity, but active exploitation elevates the overall risk.
View original advisory →A maximum-severity vulnerability tracked as CVE-2026-102255 affecting SonicWall SMA1000 appliances is being actively exploited in the wild. The flaw was patched just three days prior to confirmed exploitation being reported. SonicWall SMA1000 are secure remote access appliances widely used in enterprise environments. The active exploitation of a just-patched critical vulnerability indicates threat actors are moving quickly to leverage the flaw before organizations can apply updates. Organizations using SonicWall SMA1000 devices are urged to apply the patch immediately given the critical severity rating and confirmed in-the-wild exploitation.
View original advisory →CISA added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following active exploitation by Flax Typhoon, a China-linked threat actor. One of the key vulnerabilities is CVE-2015-3306 (CVSS 10.0), an improper access control flaw in ProFTPD. CISA set an October 11 deadline for federal agencies to remediate the identified vulnerabilities. Flax Typhoon is a state-sponsored Chinese threat group known for targeting critical infrastructure and government entities. The addition to the KEV catalog signals active in-the-wild exploitation of these flaws. Federal agencies are required to patch or mitigate the listed vulnerabilities before the deadline. The article highlights the ongoing threat posed by Chinese APT groups leveraging known vulnerabilities in widely used software.
View original advisory →On October 8, 2026, the GhostAction campaign returned with a new wave targeting 346 GitHub repositories by compromising two maintainer accounts (henrywoo and kitao) and injecting a malicious workflow file named security-audit.yml. The campaign expanded beyond its original GitHub Actions secret theft to also sweep working trees and full git history for cloud provider and AI service credentials using 13 regex patterns. Stolen data was exfiltrated via HTTP POST to a hardcoded C2 IP address (193.32.204.199). High-profile repositories affected include uber/athenadriver and kitao/pyxel (18,420 stars), with publishing credentials for PyPI and crates.io at risk. The attack was highly automated, processing 346 repos across two accounts in short time windows. The new variant adds fetch-depth:0 to retrieve complete git history including credentials developers believed were deleted. Targeted credential types include AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys, Slack tokens, and SendGrid keys. No malicious package versions were observed published to PyPI or crates.io at time of writing.
View original advisory →A critical vulnerability in GoBalance, a load-balancing tool used by dark-web sites, allows attackers to recover secret keys controlling .onion addresses using only public information. The flaw was disclosed by Searchlight Cyber on October 8, 2026. An attacker who successfully recovers the key can redirect a site's visitors to a malicious copy under their control. This effectively enables full hijacking of .onion addresses, posing serious risks to dark-web site operators and their users. The vulnerability undermines the integrity and trustworthiness of Tor hidden services that rely on GoBalance for availability during attacks.
View original advisory →Citrix has issued an urgent warning to IT administrators to immediately patch a critical remote code execution (RCE) vulnerability affecting NetScaler ADC and NetScaler Gateway products. The flaw impacts NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. Citrix is urging immediate remediation due to the critical severity of the vulnerability. No specific CVE identifier is mentioned in the available content snippet. The vulnerability could allow attackers to execute arbitrary code remotely on affected systems. NetScaler products are widely deployed in enterprise environments, making this a high-priority issue. Administrators are advised to apply patches without delay to reduce exposure.
View original advisory →At Pwn2Own Ireland 2026 in Cork, three research teams successfully demonstrated remote exploits against a fully patched Google Pixel 10 smartphone. The contest, organized by Trend Micro's Zero Day Initiative, requires all targets to be fully patched before exploitation attempts. One of the three exploits, demonstrated by Ikotas Labs, earned the team a $300,000 prize, the highest award of the contest, and secured them the overall winner title. The flaws discovered during the contest are responsibly disclosed to vendors following the competition. The event highlights ongoing security concerns for Android devices even when fully updated.
View original advisory →Citrix has released patches for a critical security vulnerability tracked as CVE-2026-107406 affecting NetScaler ADC and NetScaler Gateway. The flaw is a memory overflow vulnerability that can lead to remote code execution (RCE) or denial-of-service (DoS) under specific configuration conditions. The vulnerability is particularly relevant to deployments using SAML authentication. Citrix has urged administrators to apply the patches promptly. This follows a pattern of critical vulnerabilities affecting Citrix NetScaler products in recent years.
View original advisory →The FBI and Department of Justice announced the disruption of malicious tools used by Flax Typhoon, a China-linked advanced persistent threat (APT) group. As part of the operation, authorities seized seven domains and blocked access to platforms used by the threat actor. These platforms were leveraged to scan and in some cases infiltrate U.S. critical infrastructure. The action represents a significant law enforcement effort against Chinese state-sponsored cyber espionage targeting American infrastructure. Flax Typhoon is a well-documented APT group known for targeting government, defense, and critical infrastructure sectors. The seizure of domains is intended to disrupt the group's operational capabilities and command-and-control infrastructure.
View original advisory →IDC Frontier, a major Japanese cloud and digital infrastructure provider, suffered a ransomware attack targeting its IDCF Cloud service. The attack caused a significant outage at a data center cluster serving eastern Japan. The incident is particularly notable as IDCF Cloud is used by government clients, raising concerns about public sector data and service continuity. The disruption highlights the vulnerability of cloud infrastructure providers to ransomware attacks. Details on the specific ransomware group responsible or the extent of data compromise have not been fully disclosed. The attack underscores the risks faced by critical cloud infrastructure serving both private and governmental organizations.
View original advisory →A malware campaign called 'Midnight Mimosa' has been found pre-installed in the firmware of low-cost Android smartphones. The malware is embedded at the supply chain level, meaning devices arrive compromised before reaching end users. Once active, it allows attackers to silently install additional applications without user knowledge. The campaign also enables ad fraud operations leveraging the infected devices. Additionally, compromised devices are enrolled as residential proxies, routing third-party traffic through victims' internet connections. The stealthy nature of firmware-level embedding makes detection and removal extremely difficult for average users. This represents a significant supply chain security concern for budget Android device consumers.
View original advisory →The FBI and agencies from six other countries revealed that hackers linked to Chinese cybersecurity firm Integrity Technology Group conducted a campaign targeting government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia. The attackers stole emails from these organizations and operated a portal that allowed third parties to access the stolen data. The hackers used a scanning tool to identify vulnerabilities in target websites. Integrity Technology Group has been sanctioned by both the U.S. and the UK in response to these activities. The operation represents a significant state-affiliated cyber espionage effort with broad international implications.
View original advisory →The FakeGit malware campaign has returned with over 17,610 malicious repositories on GitHub designed to distribute the SmartLoader malware. The campaign reactivated earlier in October 2026 and is being used to push the StealC infostealer to unsuspecting users. SmartLoader acts as a delivery mechanism, loading additional malicious payloads onto compromised systems. The scale of the campaign is significant, with tens of thousands of fake repositories mimicking legitimate projects. StealC is a well-known information-stealing malware capable of harvesting credentials, browser data, and other sensitive information. The use of GitHub as a distribution platform lends a false sense of legitimacy to the malicious repositories. Users and developers are advised to exercise caution when cloning or using repositories from unknown sources. The campaign highlights the ongoing abuse of trusted developer platforms for malware distribution.
View original advisory →The Russia-aligned threat actor UAC-0099, also tracked as Earth Sirrush, has been attributed to a newly discovered malware family called ASHVEIN. ASHVEIN is a .NET-based infostealer and remote access trojan (RAT) that conceals commands within HTML content. The malware has been deployed in targeted attacks against Ukrainian government personnel. The campaign was identified and analyzed by TrendAI, which previously tracked the cluster under the name SHADOW-EARTH-065. ASHVEIN represents a previously undocumented toolset associated with UAC-0099 operations. The use of HTML-based command hiding suggests an effort to evade detection by security tools. This activity aligns with broader Russian cyber operations targeting Ukrainian government infrastructure during the ongoing conflict.
View original advisory →Cisco released security advisories addressing five critical vulnerabilities in its NX-OS operating system, which powers Nexus data center switches. These flaws could be exploited by attackers to execute arbitrary code with root-level privileges on affected devices. The vulnerabilities represent a significant risk to enterprise and data center network infrastructure. Successful exploitation could result in full device takeover, enabling attackers to intercept, manipulate, or disrupt network traffic. Cisco has urged administrators to apply patches promptly. The advisories highlight ongoing security challenges in network operating systems used in critical environments.
View original advisory →