Overview of incoming advisories.
2019 results found
Cybersecurity researchers from CrowdStrike Intelligence have uncovered a targeted campaign against South Korean financial organizations using an AI-powered penetration testing tool called ARTEX. The campaign was active from late September to early October 2026 and resulted in successful data exfiltration. Threat actors leveraged ARTEX, an AI-based pen testing tool, to conduct offensive operations against financial sector targets. The attacks highlight the emerging risk of AI-assisted offensive security tools being repurposed for malicious data theft campaigns. The financial sector in South Korea appears to have been specifically targeted, raising concerns about sector-specific threat activity in the region.
View original advisory →CISA published an ICS advisory (ICSA-26-281-01) disclosing seven vulnerabilities in Red Lion Controls N-Tron 700 Series industrial switches affecting firmware versions up to 3.11.0 and bootloader versions up to 2.0.6.1. The vulnerabilities include hard-coded credentials, plaintext password storage, weak credential encryption, missing authentication for SNMP-based administrative functions, unauthenticated firmware update capability, a reachable assertion enabling DoS via URL-triggered reboots, and an authentication bypass via physical access. Successful exploitation could allow attackers to gain administrative access, view/edit/upload configuration files, push malicious firmware, or cause continuous device reboots. CVSS v3 scores range from 4.9 to 8.3, with CVSS v4 scores reaching up to 9.3 (Critical). The vulnerabilities affect critical infrastructure sectors including Commercial Facilities, Communications, Critical Manufacturing, and Information Technology, with worldwide deployment. Remediation includes upgrading to firmware version 3.11.1 or greater, disabling/configuring SNMP communities, and disabling web GUI access. The vulnerabilities were reported by Gabrianna (Ria) Milloway of Idaho National Laboratory. No known public exploitation has been reported at the time of publication.
View original advisory →CISA has published ICS advisory ICSA-26-281-02 detailing six vulnerabilities affecting Grid Protection Alliance's openPDC and openHistorian products used in the energy sector. The most critical vulnerability (CVE-2026-100730, CVSS 9.8) involves deserialization of untrusted data enabling remote code execution. CVE-2026-105278 (CVSS 9.8) affects the Docker image with hard-coded administrative credentials allowing full application takeover. CVE-2026-104629 (CVSS 8.8) enables unsafe reflection allowing authenticated attackers to run arbitrary constructor code. Two missing authentication vulnerabilities (CVE-2026-105281 and CVE-2026-85479) expose internal data publisher and STTP-based data publisher interfaces to unauthenticated network attackers. CVE-2026-101022 is an SSRF vulnerability in the Modbus connection feature allowing internal network mapping. Fixes are available in openPDC 2.9.477/2.9.482 and openHistorian 2.8.580/2.8.585, though Docker images have no fix planned. These vulnerabilities were reported by Shubham Raj of Causal Security.
View original advisory →CISA published an ICS advisory for Satel Netco Design software versions prior to v2.1.7, disclosing four vulnerabilities. The vulnerabilities include a stored cross-site scripting flaw (CVE-2026-105269), an inefficient regular expression complexity issue (CVE-2026-104628), and two relative path traversal vulnerabilities in data import and export functionality (CVE-2026-105275 and CVE-2026-101024). The most severe vulnerability, CVE-2026-101024, carries a CVSS v3.1 score of 8.8 (HIGH) and could allow authenticated users with Viewer privileges to write attacker-influenced content to the file system, potentially enabling arbitrary code execution. The affected product is deployed worldwide in the Communications critical infrastructure sector, with the vendor headquartered in Finland. Satel recommends updating to version v2.1.7 to remediate all identified vulnerabilities. No known public exploitation has been reported to CISA at the time of publication. The vulnerabilities were reported by Alex Williams of Pellera Technologies.
View original advisory →ANY.RUN researchers have identified a new phishing kit called Wazza targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. Unlike traditional phishing kits that simply clone login pages, Wazza incorporates advanced capabilities including traffic filtering, session management, and infrastructure-level controls. The kit is designed to evade detection while harvesting credentials from victims in multiple sectors. Its multi-regional targeting scope suggests a well-resourced threat actor or group. The phishing infrastructure includes built-in mechanisms to manage victim sessions and filter out unwanted traffic such as bots or researchers. This represents a broader trend of increasingly sophisticated phishing-as-a-service tooling available to attackers. The targeting of critical sectors like banking and government elevates the potential impact of successful campaigns.
View original advisory →Cybersecurity researchers discovered 16 malicious Mozilla Firefox extensions impersonating legitimate cryptocurrency wallets such as Rabby and OKX. These extensions disguise themselves as wallet portals, desktop utilities, and browser tools. Their underlying code intercepts recovery phrases and private keys during wallet import flows. The stolen secrets are then transmitted to attacker-controlled infrastructure. The campaign targets cryptocurrency users who install what appear to be legitimate browser-based wallet tools. The use of well-known wallet brand names increases the likelihood of user deception. This represents a significant threat to cryptocurrency holders who rely on browser extensions for wallet management.
View original advisory →The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks attributed to the HAFNIUM threat group. The reward was reported by NTD news outlet. Zhang Yu is believed to be involved in the widespread exploitation of Microsoft Exchange Server vulnerabilities in 2021. The HAFNIUM campaign targeted thousands of organizations globally, compromising email servers and exfiltrating sensitive data. This bounty is part of the U.S. government's ongoing efforts to hold state-sponsored hackers accountable.
View original advisory →On the second day of Pwn2Own Ireland 2026, security researchers successfully exploited 45 unique zero-day vulnerabilities and collected $232,500 in cash awards. The Samsung Galaxy S26 was hacked three additional times during this event. Pwn2Own is a well-known competitive hacking contest where researchers demonstrate previously unknown vulnerabilities in popular devices and software. The event highlights ongoing security challenges in mobile device security. Multiple successful exploits against the Samsung Galaxy S26 underscore the presence of significant zero-day vulnerabilities in the device. The competition incentivizes responsible disclosure by rewarding researchers for their findings. These results are likely to prompt Samsung to release security patches addressing the discovered vulnerabilities. The event serves as a critical barometer for the state of mobile and device security in 2026.
View original advisory →The npm package 'tensorlake', a TypeScript SDK for Tensorlake applications and cloud services, was compromised as part of a supply chain attack known as ChainDrop/Shai-Hulud. The malicious version 0.5.144 was injected with obfuscated malware capable of harvesting credentials, exfiltrating secrets, establishing persistence, and executing remotely supplied code. The attack was identified and reported by Socket. This incident represents a classic software supply chain compromise targeting developer ecosystems through a widely-used SDK package. The Shai-Hulud worm component adds a self-propagating and credential-stealing dimension to the threat, making it particularly dangerous for organizations using the affected package in their development pipelines.
View original advisory →The Tensorlake npm package was compromised through a malicious release built directly from the project's own main branch. The attack included an npm provenance attestation, lending it false legitimacy. A particularly dangerous feature of this malware is a 'hostage token' mechanism that will wipe the victim's machine if the token is revoked. The malware also exhibits worm-like behavior, allowing it to spread. This represents a sophisticated supply chain attack targeting npm ecosystem users. The use of provenance attestation to bypass trust mechanisms marks an escalation in supply chain attack sophistication.
View original advisory →Socket detected a compromised release of the tensorlake npm SDK (version 0.5.144) as part of the ongoing ChainDrop / Shai-Hulud supply chain attack campaign. The malicious version was published on October 8, 2026 and flagged by Socket just 11 minutes later. It uses a preinstall hook to execute obfuscated malware that harvests credentials from npm, GitHub, AWS, Kubernetes, HashiCorp Vault, SSH keys, .env files, and AI development tools. The payload is a self-propagating worm that spreads by republishing compromised versions to other packages under the victim's npm identity. Command-and-control endpoints are resolved dynamically via an Ethereum smart contract rather than hardcoded domains. A 'dead man's switch' monitors stolen GitHub tokens and executes attacker-supplied code upon token revocation, with threats to wipe the victim's computer. The attack pattern matches previously documented Shai-Hulud compromises of keyv, cacheable, and related packages. Teams using tensorlake@0.5.144 are advised to treat affected hosts as compromised, revoke credentials, and audit connected accounts.
View original advisory →CVE-2015-3306 is an improper access control vulnerability in ProFTPD, an open-source FTP server. Remote attackers can exploit this flaw using the SITE CPFR and SITE CPTO commands to read and write arbitrary files on the affected system. This vulnerability poses a significant risk as it allows unauthorized file manipulation without proper authentication controls. It affects ProFTPD and potentially any product or system that incorporates it as a component or dependency. The vulnerability has been acknowledged by CISA and is listed under BOD 26-04 for prioritized security updates. Debian and OpenSUSE have both issued security advisories addressing this issue. Organizations using ProFTPD are strongly advised to apply available patches immediately to mitigate the risk of exploitation.
View original advisory →CVE-2021-3199 is a path traversal vulnerability in ONLYOFFICE Docs Server that can be exploited when JWT authentication is in use. The vulnerability is triggered via a '/.. sequence' in an image upload parameter, potentially allowing remote code execution. The flaw affects the ONLYOFFICE DocumentServer and was patched in version 5.6.3. As an open-source component, it may also affect third-party products or libraries that incorporate ONLYOFFICE. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, assigning it a high criticality rating. Organizations using ONLYOFFICE Docs are urged to apply security updates as prioritized under BOD 26-04. Forensics triage requirements may apply for affected federal agencies.
View original advisory →Strapi, a popular open-source headless CMS, contains a cleartext storage vulnerability (CVE-2023-22894) that exposes sensitive user information to attackers with admin panel access via query filters. The vulnerability allows discovery of sensitive user details including passwords and tokens in plaintext. Affected versions may be end-of-life or end-of-service, and users are advised to upgrade to a supported version immediately. This vulnerability is particularly dangerous as it can be chained with CVE-2023-22621 to achieve remote code execution. CISA has listed this in its Known Exploited Vulnerabilities catalog under BOD 26-04 prioritization directives. The flaw affects not only Strapi directly but potentially any product or service relying on Strapi as a component or dependency. Organizations using Strapi are urged to apply available patches or migrate to supported versions without delay.
View original advisory →CVE-2016-3081 is a command injection vulnerability in Apache Struts that allows remote attackers to execute arbitrary code. The vulnerability is exploited via the 'method:' prefix when Dynamic Method Invocation (DMI) is enabled. It is tracked under the Struts advisory S2-032. The issue affects open-source components and third-party libraries that may be embedded in various products. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog. It is referenced under BOD 26-04, which prioritizes security updates based on risk. Organizations using Apache Struts with DMI enabled are urged to apply patches or mitigations immediately. The vulnerability carries a high criticality rating due to its potential for full remote code execution.
View original advisory →CVE-2015-5477 is a data processing error vulnerability in ISC BIND that allows remote attackers to cause a denial of service via specially crafted TKEY queries. The vulnerability affects the BIND DNS server software, which is widely used across many platforms and distributions. Exploitation can result in a crash of the named daemon, disrupting DNS resolution services. The vulnerability is notable for its potential broad impact given BIND's widespread use as an open-source component embedded in various products, including those from Juniper Networks. Red Hat issued a security errata (RHSA-2015:1513) addressing the flaw. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, and it falls under BOD 26-04 prioritization requirements. The vulnerability is remotely exploitable without authentication, making it particularly dangerous for internet-facing DNS infrastructure.
View original advisory →Unit 42 researchers from Palo Alto Networks have published an analysis detailing how threat actors are leveraging Web3 infrastructure to conduct open-source supply chain attacks targeting enterprise cloud environments. The article explores the evolution of attack techniques that combine decentralized Web3 technologies with traditional supply chain compromise methods. Threat actors are exploiting the decentralized and often less-monitored nature of Web3 platforms to host malicious payloads or command-and-control infrastructure. These attacks are designed to breach enterprise cloud environments by compromising dependencies and open-source packages. The research highlights a growing trend of sophisticated attackers adapting emerging technologies to evade detection and maintain persistence in cloud systems.
View original advisory →The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. Threat actors are exploiting vulnerabilities in these devices to lock out legitimate administrators, preventing them from regaining access. The attacks are actively targeting organizations using Fortinet products for network perimeter defense. FortiBleed refers to a known vulnerability affecting FortiGate appliances that allows attackers to read sensitive data from memory. The FBI urges affected organizations to patch their systems immediately and review access logs for signs of compromise. Administrators who have been locked out should follow Fortinet's remediation guidance to restore access. The ongoing nature of these attacks suggests a coordinated and persistent threat campaign. Organizations relying on FortiGate VPN solutions are particularly at risk and should prioritize mitigation efforts.
View original advisory →Hackers compromised third-party operators managing country-code top-level domain (ccTLD) registries for Ghana, American Samoa, and Sierra Leone. By gaining unauthorized access, attackers were able to modify authoritative DNS records for Google domains within these ccTLDs. The attackers also obtained unauthorized HTTPS certificates for several Google domains, enabling potential man-in-the-middle attacks. This attack highlights the risks associated with third-party ccTLD registry operators and DNS infrastructure security. The incident demonstrates how compromising upstream DNS authorities can have cascading effects on major platforms like Google. Unauthorized certificate issuance further compounds the severity by undermining trust in HTTPS for affected domains.
View original advisory →Attackers compromised three country-code top-level domain (ccTLD) registries — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) — and obtained unauthorized HTTPS certificates for several Google domains. While Google's own infrastructure was not directly breached, the compromise of these registries put all domains under those ccTLDs at risk. With fraudulent certificates in hand, attackers could impersonate legitimate Google sites over encrypted HTTPS connections, potentially enabling man-in-the-middle attacks or credential theft. The incident highlights the systemic risk posed by weakly secured national domain registries. Google disclosed the issue on October 6, 2026, and the attack represents a significant abuse of the certificate issuance process tied to domain control validation.
View original advisory →