Overview of incoming advisories.
2019 results found
A suspected China-linked threat actor known as Warlock is actively exploiting Microsoft SharePoint vulnerabilities to target organizations in Portuguese- and Spanish-speaking countries. The campaign has been observed by Symantec and Carbon Black Threat Hunter Team. Targeted sectors include critical infrastructure, government, and education. The actor is leveraging both old and new SharePoint flaws. The attacks involve disabling security tools as part of the intrusion chain before deploying ransomware. The campaign represents a continued and ongoing threat rather than a one-time incident.
View original advisory →The China-linked ransomware group Warlock has conducted targeted attacks against critical infrastructure and public sector organizations, including a water utility, a telecom provider, a regional government body, and a university. The group exploited vulnerabilities in Microsoft SharePoint to gain initial access to victim networks. The campaign demonstrates a pattern of targeting critical infrastructure sectors with sophisticated ransomware attacks. The attacks highlight the ongoing threat posed by state-linked ransomware groups against essential services. Exploitation of SharePoint vulnerabilities as an initial access vector represents a significant risk for organizations relying on the platform.
View original advisory →A critical vulnerability (CVSS 9.9) was discovered in GitLab's AI Gateway, which serves as the connector between GitLab instances and AI models. The flaw allows a logged-in user with Duo Agent Platform access to execute arbitrary commands on the gateway under certain conditions. Only organizations self-hosting their own AI Gateway are affected; GitLab-hosted instances are not impacted. GitLab has released patches in gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the vulnerability. Affected organizations are urged to update immediately to mitigate the risk of unauthorized command execution on their infrastructure.
View original advisory →A China-nexus threat actor has been conducting an espionage campaign targeting government and policy organizations across multiple Asian countries including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. The campaign involves the deployment of a previously undocumented backdoor named Antino. The threat actor leverages Microsoft Outlook and OneDrive as command-and-control (C2) infrastructure, a technique that helps blend malicious traffic with legitimate cloud service communications. Cisco Talos is tracking this activity cluster. The use of trusted cloud services for C2 makes detection more challenging for defenders. The campaign is focused on intelligence gathering from government and policy-related targets, consistent with state-sponsored espionage objectives.
View original advisory →Dell has released security updates addressing multiple critical vulnerabilities in Dell Container Storage Modules (CSM). The most severe flaw, CVE-2026-63688, carries a CVSS score of 10.0 and involves a missing authentication vulnerability in the csm-authorization-storage gRPC server. These vulnerabilities could allow unauthenticated attackers to gain administrative access and achieve root-level privileges on Kubernetes nodes. The flaws represent a significant risk to organizations using Dell CSM in containerized environments. Dell has urged users to apply the security patches immediately to mitigate potential exploitation.
View original advisory →GitLab has issued an urgent warning to customers about a critical remote code execution (RCE) vulnerability affecting its AI Gateway service. The flaw could allow attackers to execute arbitrary commands on vulnerable GitLab instances. GitLab is urging all users to apply patches immediately to mitigate the risk. The vulnerability resides specifically in the AI Gateway component, which is part of GitLab's AI-powered features. No specific CVE identifier was mentioned in the article excerpt. The critical severity rating indicates a high risk of exploitation if left unpatched. Organizations running self-managed GitLab instances with AI Gateway enabled are particularly at risk.
View original advisory →Dell has disclosed and patched two maximum severity vulnerabilities affecting its Container Storage Modules (CSM), which are used to connect Dell enterprise storage arrays to Kubernetes environments. The flaws could allow attackers to gain administrative privileges. Dell is urging administrators to apply the patches as soon as possible given the critical nature of the vulnerabilities. The vulnerabilities represent a significant risk to enterprise environments using Dell storage infrastructure integrated with Kubernetes. No specific CVE identifiers were mentioned in the available content. The urgency of the advisory suggests potential for serious exploitation if left unpatched.
View original advisory →CISA has added a critical Fortinet FortiMail vulnerability (CVE-2026-104286) to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The flaw carries a CVSS score of 9.8 and allows unauthenticated attackers to write arbitrary files on the underlying system. The vulnerability is classified as an improper file write issue. Its presence in the KEV catalog indicates it is being actively leveraged in real-world attacks. Organizations using FortiMail are urged to apply patches or mitigations promptly. The zero-day nature of the flaw means it was exploited before a patch was widely available. This follows a pattern of threat actors targeting Fortinet products for initial access and persistence.
View original advisory →Socket Threat Research uncovered a cluster of malicious VS Code theme extensions linked to the GlassWorm supply chain campaign, spanning both the Visual Studio Marketplace and Open VSX Registry. Two extensions, Aurora Nocturne Night Theme and Cosmic Nebula Themes, were confirmed malicious. Aurora Nocturne used a heavily obfuscated Windows downloader contacting fingercakes4sale[.]store to drop and execute a batch file, linked to XWorm RAT infrastructure. Cosmic Nebula Themes employed a staged AES-256-CBC encrypted loader that avoids Russian-language/timezone systems, uses a Solana blockchain dead-drop to dynamically resolve payload URLs, and executes remotely supplied JavaScript in memory. Additional cluster-linked extensions including Coca-Cola Christmas and Aurora Borealis Studio Theme retain executable code and remain high-risk despite not being currently weaponized. Git history, shared Russian-language developer comments, and source code fingerprints tie all extensions to a coordinated development lineage. The cluster accumulated over 8,000 VS Code Marketplace installs and tens of thousands of Open VSX downloads. A coordinated disruption of GlassWorm infrastructure was conducted by CrowdStrike, Google, and Shadowserver Foundation in May 2026, but the supply chain footholds remain.
View original advisory →Zammad GmbH's Zammad helpdesk/ticketing application contains a session fixation vulnerability tracked as CVE-2026-102489 that can lead to remote code execution as the zammad user. This vulnerability can be chained with a local privilege escalation vulnerability CVE-2026-102490, which is reported as being actively exploited in the wild. The chained exploitation allows attackers to escalate from session fixation to full system compromise. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in BOD 26-04 implementation guidance. Users are advised to apply the latest patches referenced in Zammad's official releases page. The Zammad community forum has posted an alert regarding active exploitation of the privilege escalation component. NVD has published details for CVE-2026-102489.
View original advisory →Zammad GmbH's Zammad helpdesk application contains an improper privilege management vulnerability tracked as CVE-2026-102490. The flaw allows a local zammad user to escalate privileges to root level on the affected system. This vulnerability is reported as being actively exploited in the wild. It can be chained with a related vulnerability CVE-2026-102489 to further increase attack impact. CISA has listed this vulnerability and it falls under BOD 26-04 directives requiring prioritized security updates. Zammad has released patches available via their official releases page. Organizations running Zammad are urged to apply updates immediately and conduct forensic triage as outlined in BOD 26-04 implementation guidance. The vulnerability is also documented in NVD.
View original advisory →Fortinet has issued a warning about a critical vulnerability in FortiMail, tracked as CVE-2026-104286, which is being actively exploited in zero-day attacks. The flaw allows attackers to execute unauthorized code or commands on vulnerable devices. Fortinet customers are urged to apply mitigations or patches immediately. The exploitation in the wild classifies this as a high-severity, actively exploited vulnerability. Zero-day exploitation indicates that attacks may have begun before a patch was available. FortiMail is widely used in enterprise environments for email security, increasing the potential impact. Organizations using FortiMail should prioritize remediation to prevent unauthorized access or code execution.
View original advisory →This weekly cybersecurity roundup covers multiple high-impact topics including AI-powered zero-day exploit chains, over 543,000 exposed live secrets found publicly, and remote code execution vulnerabilities triggered during model inspection processes. The article highlights how seemingly mundane operations such as inspecting, caching, compiling, storing, and trusting data can become attack vectors when systems behave beyond user expectations. It emphasizes that attackers often leverage existing, overlooked mechanisms rather than novel techniques. The piece serves as a digest of 16 or more security stories from the week, touching on supply chain risks, secrets management failures, and AI-assisted offensive capabilities. It underscores the persistent danger of publicly exposed credentials remaining exploitable for extended periods.
View original advisory →Cybersecurity researchers have uncovered a sophisticated WordPress backdoor dubbed 'SC' (named after 'SC_' markers in injected content) that employs multiple persistence mechanisms to survive cleanup attempts. The malware, analyzed by Sucuri, has been described as a 'self-healing mesh' capable of rebuilding itself after removal. It leverages a combination of file-based, database-level, and shared memory persistence techniques to ensure the payload continues operating even after remediation efforts. This multi-layered approach makes it particularly difficult to fully eradicate from compromised WordPress installations. The backdoor represents an advanced threat to WordPress site owners and administrators, as standard cleanup procedures are insufficient to remove it completely.
View original advisory →Kiteworks, a secure file-sharing software company, has released security updates addressing 126 vulnerabilities across its products. The most critical flaw is a maximum-severity code injection vulnerability affecting its Email Protection Gateway (EPG) security solution. The sheer number of vulnerabilities patched (126) and the maximum severity rating of the EPG flaw indicate a significant security risk for organizations using Kiteworks products. Users and administrators are urged to apply the security updates immediately to mitigate potential exploitation. The Email Protection Gateway is a security-focused product, making this vulnerability particularly concerning as attackers could potentially leverage it to bypass email security controls.
View original advisory →CISA has published an advisory regarding two Missing Authorization vulnerabilities (CVE-2026-101104 and CVE-2026-96613) affecting the Meari IoT Cloud Platform OpenAPI Service across all versions. CVE-2026-101104 allows authenticated users to manipulate configurations of devices they do not own, enabling unauthorized control of device settings and behaviors. CVE-2026-96613 allows authenticated users to access full device shadow data of any device by specifying its device ID, exposing credentials, owner details, and network data. Both vulnerabilities stem from CWE-862 (Missing Authorization) and require only low privileges with no user interaction. Meari did not respond to CISA coordination attempts and no fix is planned. The vulnerabilities affect critical infrastructure sectors including Commercial Facilities and Information Technology worldwide. CISA recommends network isolation, firewall segmentation, and VPN usage as mitigations.
View original advisory →CISA has issued an ICS advisory for Monta monta.app, an EV charging station management platform, disclosing four vulnerabilities affecting all versions. The most critical (CVE-2026-95102, CVSS 9.4) involves missing authentication on WebSocket endpoints, allowing attackers to impersonate charging stations and gain unauthorized administrative control. CVE-2026-97363 involves lack of rate limiting on authentication requests, enabling brute-force and denial-of-service attacks. CVE-2026-97212 involves insufficient session expiration with predictable session identifiers, allowing session hijacking and DoS. CVE-2026-93474 involves publicly accessible charging station authentication identifiers via web-based mapping platforms. Successful exploitation could allow unauthorized administrative control over charging stations or disruption of charging services. The affected product is deployed worldwide in Energy and Transportation sectors. Monta is mitigating through rate limiting, connection throttling, and encouraging adoption of OCPP 1.6 Security Profile 2 with TLS. No known active exploitation has been reported at this time.
View original advisory →CISA has released ICS advisory ICSA-26-274-01 for Armatura LLC Armatura One, a physical access-control system. Five vulnerabilities are disclosed affecting versions prior to 4.7.2 (and 4.6.1 for the USA release). The most critical is CVE-2023-46604 (CVSS 9.8), a deserialization flaw in embedded Apache ActiveMQ allowing unauthenticated remote code execution with highest privileges. CVE-2026-94591 involves a hard-coded AES encryption key used to protect configuration credentials. CVE-2026-94592 is a hard-coded database superuser password present across all installations. CVE-2026-94593 and CVE-2026-94594 both involve plaintext credential exposure in log files. Affected sectors include Communications, Critical Manufacturing, Energy, and Transportation. Vendor fixes are available; users should upgrade to V4.7.2 or V4.6.1_USA. CVE-2023-46604 is listed in CISA's KEV catalog and has been used in ransomware campaigns against Apache ActiveMQ deployments.
View original advisory →The Pentagon's Defense Manpower Data Center (DMDC) suffered a significant data breach in October 2025, resulting in the theft of personnel records belonging to over 3 million military service members. The breach targeted the Pentagon's human resources management system. DMDC has begun notifying affected individuals. The scale of the breach makes it a major national security concern, as sensitive military personnel data was compromised. The incident highlights vulnerabilities in critical government HR infrastructure. The stolen data likely includes personally identifiable information (PII) of active and potentially former military personnel. This type of breach can have long-lasting counterintelligence and operational security implications for the U.S. military.
View original advisory →A public proof-of-concept (PoC) has been released for CVE-2026-86950, a vulnerability in Apple's CoreGraphics framework affecting iPhones and Macs. The flaw is triggered by a malicious PDF containing a crafted embedded font, causing memory corruption and a crash on unpatched devices. Apple has acknowledged the vulnerability may have been exploited in targeted attacks against specific individuals. WhatsApp's PDF handling behavior has been flagged as a potential delivery mechanism for the exploit. The PoC currently causes a crash rather than achieving full code execution, but researchers are working on converting the memory corruption into a functional exploit. The vulnerability is considered high severity given Apple's warning about active in-the-wild targeting. Users and organizations using unpatched Apple devices are advised to apply available patches promptly.
View original advisory →