Overview of incoming advisories.
2019 results found
Japanese car-sharing service Times Car has confirmed a significant data breach affecting approximately 6.6 million user accounts. The breach was disclosed late last week following a cyberattack on the company's systems. Times Car is a well-known car-sharing platform in Japan. The compromised data involves user account information, though the full extent of the exposed data types has not been detailed in the article. This is a large-scale breach impacting millions of customers. The incident highlights ongoing cybersecurity risks facing mobility and transportation service providers. Users of the Times Car platform may be at risk of identity theft or fraud as a result of the breach.
View original advisory →Apple has released security updates addressing CVE-2026-86950, an out-of-bounds write vulnerability in the CoreGraphics component affecting older versions of iOS, iPadOS, and macOS. The flaw can lead to arbitrary code execution when a maliciously crafted file is processed. Apple indicated the vulnerability may have been exploited in targeted attacks, suggesting potential zero-day or limited exploitation in the wild. The patches were issued to protect users from potential compromise via specially crafted files. The vulnerability impacts Apple's CoreGraphics framework, a fundamental graphics rendering component across Apple platforms. Users of affected older OS versions are urged to apply the updates promptly given the possibility of active exploitation.
View original advisory →Microsoft has published a technical analysis detailing a malware family called NeedyMantis used by threat actors to maintain persistent, long-term access to previously breached networks. The malware has been observed in a limited number of targeted intrusions affecting a range of sectors including telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors. The campaign appears to be highly targeted rather than widespread, suggesting a sophisticated and deliberate threat actor. NeedyMantis activity has been tracked back to at least an unspecified earlier date, indicating an ongoing and established operation. The targeting of diverse but sensitive sectors suggests espionage or intelligence-gathering motivations. Microsoft's involvement in the analysis points to significant concern over the malware's capabilities and persistence mechanisms. The malware's design appears focused on stealth and longevity within compromised environments.
View original advisory →Cryptocurrency exchange Bitget suffered a major security breach resulting in the theft of approximately $388 million. The attacker exploited a vulnerability in a third-party security product used by Bitget. By leveraging this flaw, the attacker obtained high-level internal credentials. On September 24, the stolen credentials were used to issue fraudulent withdrawal commands to Bitget's wallet system. The incident highlights the risks of supply chain and third-party security dependencies in financial platforms. Bitget publicly disclosed the attack vector on Monday following the incident. The breach underscores vulnerabilities in how exchanges protect hot wallet systems and manage privileged access credentials.
View original advisory →RatHat is an Android banking trojan operating under a malware-as-a-service (MaaS) model, discovered and analyzed by security company Cleafy. The malware operators build and publish the Android banking trojan and manage infected devices through a web-based console. Cleafy has traced nearly 100 deployments of the console since April 2026, with each customer running a separate instance. The console stores data collected from compromised phones. A notable feature of the RatHat console is its integration with Google's Gemini AI to help operators identify higher-value victims among infected devices. This AI-assisted targeting represents an evolution in mobile banking malware sophistication, enabling more efficient and targeted financial fraud campaigns.
View original advisory →The JadePuffer ransomware operator is conducting agentic AI-driven attacks specifically targeting Microsoft Azure tenants. The attacks leverage autonomous AI agents to perform multi-stage intrusions including reconnaissance, credential theft, and destruction of core cloud infrastructure components. This represents a novel use of agentic AI in ransomware operations, combining automation with intelligent decision-making to maximize impact. The campaign poses a significant threat to organizations relying on Azure cloud services, as attackers can rapidly move through environments and cause irreversible damage to cloud resources. The use of AI-driven agents marks an evolution in ransomware tactics, potentially enabling faster and more effective attacks at scale.
View original advisory →Unit 42 has identified active zero-day exploitation targeting NetScaler devices, attributed to two vulnerabilities reported by Citrix: CVE-2026-88771 and CVE-2026-88772. Both vulnerabilities have been confirmed as exploited in the wild. The threat brief was published by Palo Alto Networks' Unit 42 threat intelligence team. NetScaler (formerly Citrix ADC/Gateway) is a widely deployed network infrastructure product, making this a high-severity concern for enterprise environments. Organizations using NetScaler devices are advised to monitor for indicators of compromise and apply any available patches or mitigations immediately. The active exploitation status elevates the urgency for defenders to respond quickly.
View original advisory →This weekly cybersecurity recap covers multiple high-impact threats including a $387M cryptocurrency hack, active exploitation of Citrix vulnerabilities, and AI agents behaving unexpectedly. A notable incident involved a domain used as placeholder text appearing in ~1,700 repositories that was later registered and weaponized to serve malicious content. Additional threats include weak service accounts, unpatched legacy bugs, exposed systems, phishing kits, and easy exploit paths being leveraged by attackers. The recap highlights how forgotten or overlooked assumptions can quickly become active attack surfaces. The article underscores a broad and diverse threat landscape for the week.
View original advisory →A new botnet malware called Carbonato has been discovered targeting exposed Docker daemons to deploy an open-source AI agent framework called Hermes Agent. The malware installs the framework and overwrites its SOUL.md persona file with a custom 39-line prompt. The compromised hosts are then controlled via Telegram, enabling attackers to issue commands through the messaging platform. This represents a novel attack vector combining botnet infrastructure with AI agent frameworks for malicious purposes. The campaign highlights the growing risk of exposed Docker APIs and the emerging trend of threat actors leveraging AI tooling in their operations.
View original advisory →Cryptocurrency exchange Bitget suffered a major security breach attributed to suspected North Korean hackers, resulting in the theft of over $350-387.5 million in cryptocurrency. The exchange suspended Bitcoin withdrawals following the incident and has since resumed them. The attack is part of a broader pattern of North Korean state-sponsored threat actors targeting cryptocurrency platforms to fund regime operations. The breach highlights ongoing risks to centralized crypto exchanges from sophisticated nation-state actors. Bitget has taken steps to restore operations and secure its systems following the incident.
View original advisory →The threat actor JADEPUFFER, tracked by Microsoft as Storm-3168, conducted destructive operations within a Microsoft Azure environment using compromised service principals. The attack occurred in early June 2026 over approximately 18 hours. This activity represents an evolution in the threat actor's tradecraft, leveraging legitimate Azure service principals to carry out destructive actions. The compromise of service principals allowed the attackers to operate with elevated privileges within the Azure environment. The incident highlights risks associated with identity and access management in cloud environments, particularly the abuse of service principals for malicious purposes.
View original advisory →CISA has issued an emergency directive ordering U.S. federal agencies to patch two critical vulnerabilities in Citrix NetScaler products. The directive was issued over the weekend, requiring agencies to secure their systems by Wednesday. The vulnerabilities are being actively exploited in the wild, prompting the urgent response from CISA. Citrix NetScaler is widely used across government and enterprise environments for networking and application delivery. The order reflects CISA's authority under Binding Operational Directive 22-01 to compel federal civilian agencies to remediate known exploited vulnerabilities. Failure to patch these flaws could expose government systems to significant compromise. The tight deadline underscores the severity and active exploitation status of these vulnerabilities.
View original advisory →Citrix has patched 8 vulnerabilities in NetScaler ADC and NetScaler Gateway affecting versions 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, including FIPS variants. Three vulnerabilities are rated critical: CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution via insufficient input validation affecting all deployments; CVE-2026-88772 (CVSS 9.5) is a memory overflow enabling RCE or DoS when DTLS is enabled (on by default for VPN); CVE-2026-88773 (CVSS 9.3) enables HTTP Request Smuggling without authentication. Five additional high-severity vulnerabilities (CVSS 7.0-8.8) cover policy bypass, memory overflows, and predictable TCP ISNs. Citrix has confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772 in the wild. The advisory applies only to customer-managed deployments; Citrix-managed cloud services are updated separately. Secure Private Access Hybrid deployments using NetScaler instances are also affected.
View original advisory →Citrix has confirmed two critical remote code execution zero-day vulnerabilities in NetScaler, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited in attacks. The company has released security updates to address both flaws. Administrators are urged to apply patches immediately or shut down vulnerable NetScaler instances to prevent compromise. The vulnerabilities are classified as critical severity, indicating they can be exploited without authentication or with minimal user interaction. Active exploitation in the wild significantly raises the risk for organizations running unpatched NetScaler deployments. NetScaler is widely used for application delivery and VPN access in enterprise environments, making it a high-value target for threat actors. Citrix has advised immediate remediation steps to protect affected systems.
View original advisory →Two unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances have been identified and are being actively exploited in the wild. The flaws allow remote code execution (RCE) and were disclosed by security firm watchTowr on September 26, 2026. Citrix has not yet confirmed the vulnerabilities or released any patches. In response to the active exploitation and lack of vendor guidance, some administrators have chosen to take their affected appliances offline. The situation represents a critical risk for organizations relying on these network appliances for application delivery and secure remote access. No CVE identifiers have been assigned yet based on available information.
View original advisory →Citrix NetScaler ADC and NetScaler Gateway contain a critical improper input validation vulnerability (CVE-2026-88771) that allows unauthenticated attackers to execute arbitrary commands. The vulnerability is part of a broader set of CVEs (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler products. CISA has issued guidance requiring affected organizations to conduct forensic triage per BOD 26-04. Organizations are advised to run provided IOCs in the NetScaler console to identify indicators of exploitation. Citrix has published mitigation guidance and security bulletins addressing the vulnerability. The issue is considered high severity given its unauthenticated remote code execution potential. Customers must follow both Citrix's published guidance and CISA's BOD 26-04 directives for remediation and forensic triage.
View original advisory →Citrix NetScaler ADC and NetScaler Gateway contain a critical memory buffer bounds restriction vulnerability (CVE-2026-88772) that could allow remote code execution or denial of service. The vulnerability is tracked by CISA and is part of a broader set of CVEs (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler products. Organizations are directed to run provided IOCs in the NetScaler console to identify indicators of exploitation. Customers must conduct forensic triage as mandated by BOD 26-04 and follow Citrix's published mitigation guidance. CISA has assigned a high criticality rating to this vulnerability given its potential for remote code execution. Multiple remediation and forensic resources have been published by both Citrix and CISA to assist affected organizations.
View original advisory →The ShinyHunters extortion group is actively exploiting Oracle PeopleSoft systems using a URL-encoding technique to bypass web application firewall (WAF) protections. The bypass circumvents mitigations for CVE-2026-35273, allowing attackers to resume widespread exploitation of vulnerable servers. This technique enables the threat actors to evade defensive controls that organizations may have deployed as a temporary fix while awaiting patching. The campaign highlights the risk of relying solely on WAF rules as a compensating control for known vulnerabilities. Organizations running Oracle PeopleSoft are urged to apply official patches immediately rather than depending on WAF-based mitigations. ShinyHunters is a well-known financially motivated threat actor with a history of large-scale data theft and extortion operations.
View original advisory →Lunex is a malware-as-a-service (MaaS) platform that distributes a component called Psychedelic Stealer through compromised Ukrainian websites. The attack uses ClickFix-style fake Cloudflare CAPTCHA verification pages to trick Ukrainian-speaking users into executing malware. Researchers at Ontinue identified a four-stage attack chain beginning with the fake CAPTCHA page. The malware abuses an AMD driver to disable security monitoring tools, allowing it to operate undetected. Once active, Lunex Stealer harvests browser credentials and other sensitive data. The campaign specifically targets Ukrainian-speaking users, suggesting a geopolitical motivation. The use of legitimate driver abuse (BYOVD technique) indicates a technically sophisticated threat actor. The MaaS model suggests the tooling is available to multiple threat actors beyond the original developers.
View original advisory →Two third-party GitHub Actions that were previously compromised as part of the Mini Shai-Hulud supply chain campaign were re-enabled by their maintainers despite still containing malicious code. The compromised Actions remained publicly accessible for over a week, exposing any repositories or CI/CD pipelines that referenced them to potential malicious payloads. This incident highlights the risk of supply chain attacks targeting GitHub Actions workflows. The re-enablement of the compromised Actions without remediation suggests a lack of awareness or verification by the maintainers. The Shai-Hulud campaign represents a broader threat to the software supply chain ecosystem, particularly targeting automated build and deployment pipelines.
View original advisory →