Overview of incoming advisories.
2019 results found
Threat actors are using ClickFix-style lures to distribute a previously undocumented remote access trojan (RAT) named ChainScript. The malware has appeared under multiple build names including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams to trick users into execution. ChainScript leverages the Polygon blockchain network to rotate its command-and-control (C2) infrastructure, making takedowns more difficult. The campaign was uncovered and reported by Blackpoint's Adversary Pursuit Group (APG). The use of blockchain for C2 rotation represents an advanced evasion technique increasing the resilience of the malware's infrastructure. ClickFix lures typically trick users into executing malicious scripts under the guise of fixing a software issue. This threat is considered high impact due to its novel infrastructure abuse and active deployment.
View original advisory →North Korean threat actor Jade Sleet has been linked to the compromise of a small India-based IT services organization. The attack involved the deployment of two backdoors named FLATROOF and ROOFDECK. SentinelOne disclosed the activity and attributed it to Jade Sleet. The adversary continues its pattern of targeting developers to gain access to broader networks. The attack reportedly involved Apple-related tooling or lures, though the full content was truncated. This incident highlights the ongoing supply chain and IT services targeting by North Korean APT groups. The breach underscores the risk posed to smaller IT firms that may serve as stepping stones to larger targets.
View original advisory →A stack-based buffer overflow vulnerability (CVE-2026-7273) has been identified in Zyxel GS1900 series switches within the CGI program. The flaw allows a LAN-based, unauthenticated attacker to potentially execute OS commands by sending a crafted HTTP request. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Zyxel has published a security advisory with details and patch information. The vulnerability requires no authentication, lowering the bar for exploitation significantly. Organizations using GS1900 series switches on their networks should prioritize patching immediately. CISA has also outlined forensic triage requirements for affected systems under BOD 26-04 implementation guidance.
View original advisory →Oracle has patched 153 vulnerabilities across multiple Oracle Fusion Middleware products including WebLogic Server, Access Manager, Forms, Internet Directory, and Platform Security for Java. Of these, 66 are rated critical and 78 can be exploited remotely without authentication. Five vulnerabilities (CVE-2026-71133, CVE-2026-83099, CVE-2026-83059, CVE-2026-83020, CVE-2026-83021) carry the maximum CVSS score of 10.0. Successful exploitation can lead to arbitrary code execution, authentication bypass, unauthorized data access, data modification or deletion, and Denial-of-Service. The NCSC advises organizations to prioritize applying security updates for the critical vulnerabilities immediately.
View original advisory →Google released its September 2026 security update addressing 110 vulnerabilities across Pixel devices. Among these, one zero-day vulnerability was identified as actively exploited in targeted attacks. The patches are specifically directed at Google Pixel devices. The zero-day was being leveraged in real-world attacks prior to the patch release. This update underscores the ongoing threat landscape targeting Android mobile devices. Users of Pixel devices are urged to apply the security patches immediately. The scale of the patch batch (110 vulnerabilities) indicates a broad range of security issues addressed. Targeted exploitation of the zero-day suggests possible involvement of sophisticated threat actors.
View original advisory →Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The flaw allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, leading to remote code execution on affected sites. Wordfence, a WordPress security company, identified and disclosed the vulnerability and has reported blocking numerous exploitation attempts. The plugin's widespread use makes this a significant threat to WordPress-based e-commerce sites. Attackers are leveraging the flaw to plant PHP web shells, enabling persistent access and further compromise of affected servers. Site owners using this plugin are urged to apply patches or mitigations immediately.
View original advisory →A critical vulnerability tracked as CVE-2026-5430 (CVSS 9.8) has been discovered in WSO2 API Manager. The flaw involves improper verification of cryptographic signatures in JWT authentication, allowing attackers to forge admin tokens and perform account takeover. The vulnerability was discovered and reported by the Hacktron Team and has been credited to watchTowr for identifying active exploitation in the wild. Attackers are actively attempting to exploit this flaw to gain unauthorized administrative access. The severity and active exploitation status make this a high-priority patching concern for organizations using WSO2 API Manager.
View original advisory →CVE-2026-92299 affects @jitsi/electron-sdk versions before 10.0.5, where the getDesktopSources() API is exposed via Electron's contextBridge without requiring an active getDisplayMedia() picker. This allows any script running in the meeting page to enumerate screens and windows without user consent. Attackers can invoke the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution, bypassing operating system permission prompts entirely. The vulnerability poses a significant privacy risk as it enables silent screen capture of a victim's desktop during a Jitsi meeting session. The fix was introduced in version 10.0.5, which adds proper gating logic to restrict access to screen sources. Proof-of-concept references and patch details are available via the official GitHub repository and commit history. The issue was also documented by VulnCheck in their advisory database.
View original advisory →A server-side request forgery (SSRF) vulnerability has been identified in the a2ui-project a2ui software up to version 0.10.7. The vulnerability exists in the httpx.get function within the FileResolver component, specifically in the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py. Remote attackers can exploit this vulnerability without authentication to perform SSRF attacks, potentially allowing them to make the server issue requests to internal or external resources. A patch has been identified with commit ID 2bb8423060308bbdea8ba468dabed4fc256d18ea and users are advised to deploy it immediately. The issue was tracked and reported via GitHub issues and pull requests, and is also documented on VulDB.
View original advisory →CVE-2026-73447 affects Arista EOS-based products via the gRPC Network Security Interface (gNSI) Certz service. An authenticated but privileged attacker can send a crafted Certz Rotate request to escalate privileges and execute arbitrary OS commands with root-level access. This leads to full device compromise. The Bootz service on affected devices is also vulnerable. The vulnerability requires prior authentication, limiting the attack surface somewhat, but the impact of successful exploitation is critical. Arista has published a security advisory (SA-0162) detailing affected versions and mitigations. Network infrastructure devices running Arista EOS should be patched or mitigated promptly.
View original advisory →CVE-2026-27565 describes a critical vulnerability allowing an unauthenticated remote attacker to upload a malicious IODD file to a vulnerable device. The uploaded file places and executes a shell script with root privileges, granting full system control. The persistence mechanism ensures the malicious shell script survives reboots, making remediation more complex. No authentication is required to exploit this vulnerability, significantly lowering the barrier for attackers. The vulnerability affects industrial or IoT devices that support IODD file uploads. Multiple advisories have been published by CERT VDE covering related devices and vendors. The impact is rated High given the combination of unauthenticated access, root-level code execution, and persistent compromise. Organizations using affected devices should apply patches or mitigations immediately and audit for signs of exploitation.
View original advisory →CVE-2026-27546 describes a critical authentication bypass vulnerability in the _account_log function that allows unauthenticated remote attackers to gain administrative access. The flaw can be exploited even when accounts are properly configured, meaning standard security hardening does not mitigate the risk. No authentication credentials are required, making this trivially exploitable by any remote attacker. The vulnerability has been reported via NVD and multiple CERT-VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), suggesting it affects multiple product versions or vendors. The ability to log in as admin without credentials represents a complete authentication control failure. This type of vulnerability typically leads to full system compromise, data exfiltration, and lateral movement. The involvement of CERT-VDE indicates the affected products are likely industrial or embedded systems.
View original advisory →The TrueBooker Appointment Booking and Scheduler System plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to and including 1.2.3. The flaw stems from the plugin failing to properly verify user authorization before performing sensitive actions. Unauthenticated attackers can exploit this to modify the email address of any user account, including administrator accounts. Once the email is changed, attackers can trigger a password reset to fully compromise the account. This effectively allows complete account takeover without any prior authentication. The vulnerability has been patched in version 1.2.4. The fix is visible in the changeset for the function_ajax.php file. The issue is tracked under CVE-2026-14349 and documented by both NVD and Wordfence.
View original advisory →The JetFormBuilder Dynamic Blocks Form Builder plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 3.6.2. The flaw stems from the plugin failing to validate that a submitted form ID actually belongs to a JetFormBuilder form before parsing the referenced post content as a form schema and executing Advanced Validation server-side callbacks. This oversight allows unauthenticated remote attackers to exploit the plugin to create new administrator-level user accounts, effectively granting full site control. The vulnerability requires no authentication or special privileges to exploit, making it particularly dangerous for WordPress sites running the affected plugin versions. A patch has been released and is available via the WordPress plugin repository changeset 3575346.
View original advisory →Acronis has disclosed a high-severity local privilege escalation (LPE) vulnerability affecting its backup plugin for cPanel, WebHost Manager (WHM), and Plesk on Linux systems. The flaw is reported to be actively exploited in the wild, raising urgency for affected users to apply patches. The vulnerability allows local attackers to escalate privileges on Linux-based hosting environments. Acronis has issued a warning to users of the affected plugin to update immediately. The issue highlights ongoing risks in third-party backup and hosting management integrations. Hosting providers using Acronis backup solutions with cPanel or Plesk are particularly at risk. No specific CVE identifier was mentioned in the available content snippet.
View original advisory →A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and pushed malicious updates to over 200 customers. The tampered plugin versions created hidden user accounts, effectively backdooring more than 1,500 WordPress sites. This is a supply chain attack targeting WordPress plugin infrastructure. The attacker leveraged the legitimate update distribution mechanism to propagate the malicious code. Site administrators using the affected plugin versions are at risk of unauthorized administrative access. The attack highlights risks associated with third-party plugin ecosystems and the importance of verifying plugin integrity.
View original advisory →Cybersecurity researchers at Elastic Security Labs have uncovered a previously undocumented Brazilian banking malware operation known as KREMLIN, tracked under the activity cluster REF9334. Active since at least May 2025, the threat actor uses lures impersonating over a dozen Brazilian banks to distribute a malicious browser extension targeting Google Chrome and Microsoft Edge. The malware is designed to hijack browser sessions, steal credentials, and capture session tokens from victims. The toolkit represents a sophisticated threat to Brazilian banking customers and financial institutions. The operation highlights the continued evolution of browser-based credential theft techniques employed by Latin American cybercriminal groups.
View original advisory →Cybersecurity agencies from the United States, United Kingdom, and Netherlands have jointly detailed a Windows-based malware attributed to Iran's intelligence service. The malware is controlled through the Telegram messaging application, enabling covert command and control. It targets dissidents, journalists, and activists globally. Capabilities include copying emails and chat messages, taking screenshots, and activating the microphone to record audio. The operation represents a state-sponsored surveillance campaign against political opponents and civil society members. The use of a legitimate messaging platform like Telegram as a C2 channel helps evade traditional network detection. The joint advisory underscores the international concern over Iranian cyber espionage activities.
View original advisory →Cybersecurity researchers have uncovered a multi-platform malware campaign leveraging the MQTT protocol as a covert command-and-control communication channel. The malware family, dubbed BambooToken, targets both Windows and Linux systems. Active since at least February 2023, the campaign has been observed targeting organizations across Asia and South America. MQTT, typically used in IoT and lightweight messaging scenarios, is being abused to blend malicious traffic with legitimate network communications. The use of MQTT as a C2 channel represents an emerging evasion technique that may bypass traditional network security controls. The campaign's cross-platform capability indicates a sophisticated threat actor with resources to develop and maintain malware for multiple operating systems.
View original advisory →BambooToken is a previously unknown malware framework that has been active since at least 2023. It targets both Windows and Linux systems, using the Message Queuing Telemetry Transport (MQTT) protocol as its command-and-control communication channel. MQTT is typically used in IoT environments, making this an unconventional choice that may help evade traditional network detection tools. The malware represents a cross-platform threat capable of compromising a wide range of enterprise and server environments. Its use of a lightweight messaging protocol suggests the authors are attempting to blend malicious traffic with legitimate IoT or industrial communications. The framework's capabilities and full infection chain are still being investigated, but its dual-OS targeting and protocol abuse make it a notable and potentially high-impact threat.
View original advisory →