Overview of incoming advisories.
2018 results found
A cyberattack targeting BAE Systems, a major government contractor, has disrupted operations at US federal bankruptcy courts. The Administrative Office of the US Courts confirmed that the attack took down the notice system used by federal bankruptcy courts. BAE Systems is a defense and security contractor with significant ties to US government operations. The disruption affects court notification infrastructure, potentially impacting case communications and proceedings. This incident highlights the risks of third-party contractor dependencies within critical government systems. The attack demonstrates how supply chain vulnerabilities can cascade into public sector disruptions. Details on the nature of the attack, attribution, and extent of the damage are limited in the current reporting.
View original advisory →The China-nexus cyber espionage group Armory Castle (formerly UNC5221 or Warp Panda) exploited a zero-day vulnerability in BeyondTrust Remote Support (formerly Bomgar) in late August 2026. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, involves improper origin validation in an internal messaging component. Exploitation of this vulnerability allowed attackers to take over remote support servers. The group has been previously tracked under multiple aliases, indicating a sophisticated and persistent threat actor. This incident highlights ongoing risks posed by China-linked espionage operations targeting enterprise remote support infrastructure. The high CVSS score underscores the critical severity of the vulnerability and the potential for widespread impact.
View original advisory →BeyondTrust disclosed and patched a critical zero-day vulnerability in its Remote Support (RS) product that has been actively exploited in attacks since late August. The flaw was identified as being exploited in the wild before a patch was available, classifying it as a zero-day. BeyondTrust issued an urgent warning to customers to apply the patch immediately. The vulnerability poses significant risk given BeyondTrust's widespread use in enterprise privileged access and remote support environments. No additional CVE identifier was mentioned in the excerpt, but the severity and active exploitation make this a high-priority remediation item. Organizations using BeyondTrust Remote Support are urged to update immediately to mitigate risk of compromise.
View original advisory →A suspected advanced threat actor has been exploiting CVE-2025-61624, a path traversal vulnerability (CVSS 5.4) in Fortinet FortiOS's command line interpreter, to deploy a previously unreported memory-resident ARM64 malware dubbed PEERSTITCH. The vulnerability also affects FortiPAM, FortiProxy, and FortiSwitchManager. The malware is notable for its ability to bypass security checks on tagged VPN sessions, making detection and remediation more difficult. PEERSTITCH resides in memory, leaving minimal forensic artifacts on disk. The attack chain highlights the continued targeting of network edge devices by sophisticated threat actors. Organizations using affected Fortinet products are urged to apply patches and monitor for indicators of compromise.
View original advisory →A path traversal vulnerability has been identified in multiple Fortinet products including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The vulnerability allows an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. The flaw is tracked as CVE-2025-61624 and has been assigned a high criticality rating. CISA has referenced this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Fortinet has published an advisory under FG-IR-26-122. Organizations using affected Fortinet products are advised to apply patches promptly. The vulnerability poses a significant risk as it can lead to unauthorized file manipulation on affected systems.
View original advisory →CVE-2026-102764 is an authentication bypass by spoofing vulnerability affecting BeyondTrust Remote Support. A remote attacker could exploit this flaw to perform unauthorized file operations on the affected appliance. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. BeyondTrust has published a security advisory with remediation guidance. CISA has also provided forensics triage requirements as part of the directive's implementation guidance. The vulnerability is tracked in the NVD and carries a high criticality rating. Organizations using BeyondTrust Remote Support are urged to apply patches promptly.
View original advisory →Unit 42 researchers have analyzed an AI-powered espionage campaign specifically targeting government Linux infrastructure. The campaign employs custom malware, web shells, and advanced credential theft techniques. The use of AI to enhance espionage operations represents an evolving threat landscape. Government entities running Linux systems are the primary targets, suggesting a nation-state or sophisticated threat actor involvement. The attack methodology combines multiple techniques including web shell deployment and credential harvesting. The campaign demonstrates increasing sophistication in threat actor capabilities by leveraging AI technologies. Custom malware tailored for Linux environments indicates deep technical expertise and targeted intent.
View original advisory →Threat actors are actively exploiting a critical remote code execution vulnerability tracked as CVE-2026-110447 in the Collabora Online Built-in CODE Server (richdocumentscode) plugin for Nextcloud. The flaw allows attackers to execute arbitrary commands on affected servers. Successful exploitation enables threat actors to install backdoors on compromised Nextcloud instances. The vulnerability is present in the richdocumentscode app, which is widely used to provide document editing capabilities within Nextcloud deployments. Organizations running Nextcloud with the Collabora Online integration are at significant risk. The active exploitation makes this a high-priority issue requiring immediate patching or mitigation. Nextcloud server administrators should review their installations and apply available security updates as soon as possible.
View original advisory →A critical Linux kernel vulnerability dubbed PwnEscape (CVE-2026-99999) has been disclosed, allowing code running inside a virtual machine to read memory on the host system. The flaw resides in the Linux kernel's networking code, making it broadly applicable across cloud environments rather than specific to any single provider's configuration. A security researcher demonstrated the vulnerability against Vercel's live cloud sandboxes, and Vercel confirmed the successful exploit. Because the issue is in the kernel itself, any cloud or hosting provider using affected Linux kernel versions may be at risk. This type of VM escape or cross-boundary memory read is considered critical as it undermines the fundamental isolation guarantees of virtualization. The vulnerability has been assigned a CVE identifier and is actively being tracked by the security community. Patches or mitigations are expected from Linux kernel maintainers and downstream distributions.
View original advisory →This weekly security roundup covers multiple significant threats including an Adobe Remote Code Execution vulnerability, DNS-based cryptocurrency wallet theft, NVIDIA container escape vulnerability, and a self-healing backdoor malware. The article also references 23 additional security stories. Key themes include data theft tools with victim intimidation features, privilege escalation via small permissions, trusted authentication bypass, exploitation of old vulnerabilities against new targets, and abuse of legitimate tools for malicious purposes. The roundup suggests a broad and active threat landscape across multiple product categories and attack vectors.
View original advisory →A threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular AUR helper tools yay and paru. The fake packages were designed to push malware with root privileges onto victim systems. AUR is a community-driven repository for Arch Linux users, making it a high-value target for supply chain attacks. Because AUR packages can request elevated privileges during installation, malicious packages can gain root-level access. This attack highlights the risks associated with community-maintained package repositories where packages are not officially vetted. Users who installed the trojanized versions of yay or paru may have had their systems fully compromised. The incident underscores the importance of verifying package authenticity and reviewing PKGBUILDs before installation on Arch Linux systems.
View original advisory →Citizen Lab researchers revealed that Candiru, an Israeli spyware vendor, infected devices at Al Jazeera through malicious online advertisements. The attacks required no user interaction, executing hidden code the moment an ad loaded on screen. In some cases, ads loaded invisibly in the background, making detection even harder. Candiru sells its spyware to government clients, raising serious concerns about state-sponsored surveillance targeting journalists. This represents a significant escalation in spyware delivery methods, weaponizing the online advertising ecosystem. The zero-click nature of the attack makes it extremely difficult for users to protect themselves. Citizen Lab's investigation links the infections directly to targeted ad campaigns, suggesting a sophisticated and deliberate targeting operation against the news network.
View original advisory →The threat actor known as Silent Lynx has been linked to a new wave of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The campaign, observed between June 2025 and August 2026, leverages four distinct infection chains. These include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and crafted WinRAR archives exploiting a known WinRAR vulnerability. The attacks aim to deploy reverse shells, enabling persistent remote access to compromised systems. The use of multiple infection vectors suggests a sophisticated and adaptable threat actor. The targeting of CIS government entities indicates likely espionage motivations. The exploitation of WinRAR flaws combined with living-off-the-land techniques makes detection challenging.
View original advisory →NGINX released versions 1.30.6 and 1.31.7 on October 14 to address five vulnerabilities. Three of the flaws are memory bugs that could crash worker processes or potentially allow remote code execution, each requiring specific configurations to exploit. A fourth vulnerability allows an attacker to forge a TLS session, potentially bypassing client certificate checks. One of the vulnerabilities has been present in every NGINX release since May 2005. F5, the company behind NGINX, disclosed these issues. The fixes are critical for organizations relying on NGINX for web serving, proxying, or TLS termination.
View original advisory →Next.js released an out-of-band security update on October 14 addressing two critical remote code execution vulnerabilities and one high-severity denial-of-service flaw. The first RCE flaw resides in React Server Components, potentially allowing unauthenticated attackers to execute arbitrary code. The second RCE vulnerability is in librsvg, an open-source library used by Next.js via the 'sharp' package for SVG image processing. Both flaws are critical severity and require no authentication to exploit. An out-of-band patch was issued outside the normal release cycle, indicating urgency. Administrators and developers using Next.js are urged to apply the fixes immediately. The combination of server-side and image-processing attack surfaces broadens the potential impact across Next.js deployments.
View original advisory →Drupal has disclosed a critical remote code execution vulnerability in its Field UI module affecting Drupal core. The flaw was patched on October 14 in versions Drupal 11.4.10, 11.3.19, and 10.6.19. While the vulnerability cannot be exploited through core alone, multiple exploit paths exist via contributed modules. At least one known exploit path requires no authentication, making it especially dangerous. The Drupal Security Team issued an advisory urging users to update immediately. Sites running contributed modules that interact with Field UI are at highest risk. The unauthenticated path significantly raises the severity of this vulnerability.
View original advisory →CISA issued an ICS advisory (ICSA-26-280-01) disclosing seven vulnerabilities in CISA Malcolm, a network traffic analysis tool used in critical infrastructure sectors including Energy, IT, and Water/Wastewater. Affected versions include Malcolm <=v26.07.1 and <=v26.08.0. The vulnerabilities include Authentication Bypass by Spoofing (CVE-2026-107336), Incorrect Authorization via URL path normalization (CVE-2026-107333, CVE-2026-107334), Server-Side Request Forgery via FilePond PHP server (CVE-2026-107362), Authentication Bypass through Arkime's direct port exposure (CVE-2026-107361), Cross-Site Request Forgery on the kiosk Flask app (CVE-2026-107337), and a Gzip bomb / data amplification vulnerability (CVE-2026-107335). The highest CVSS v3.1 score is 8.1 (HIGH) for CVE-2026-107333. Patches are available in Malcolm v26.08.0 and v26.09.0 depending on the CVE. The vulnerabilities were reported by Seth Grover of Idaho National Laboratory. No known public exploitation has been reported at this time.
View original advisory →CISA has published an ICS advisory for Guangzhou Juan IoT Technology EseeCloud, affecting both the EseeCloud App (<=4.9.6) and EseeCloud Firmware (<=4.9.86.0). Three vulnerabilities were identified: CVE-2026-107617 (Use of Hard-coded Credentials, CVSS 9.8 Critical), CVE-2026-97858 (Improperly Controlled Modification of Dynamically-Determined Object Attributes, CVSS 5.3 Medium), and CVE-2026-105664 (Observable Response Discrepancy enabling device enumeration, CVSS 5.3/8.7). Successful exploitation could allow attackers to gain full control over affected IP cameras, hijack device ownership, or enumerate registered devices at scale. The vulnerabilities affect critical infrastructure sectors worldwide including Energy, Communications, Transportation, Financial Services, and Government. The vendor did not respond to CISA's coordination attempts, leaving no official patch available. Users are advised to minimize network exposure, use firewalls, and employ VPNs for remote access. Vulnerabilities were reported by Donghyeon Lee of Tokyo University of Science and GMO Flatt Security.
View original advisory →CISA has published an ICS medical advisory (ICSMA-26-288-02) detailing six vulnerabilities in J4Care dcm4chee-arc-light version 5.35.1, a medical imaging archive platform used worldwide in healthcare. The vulnerabilities include Missing Authorization (CVE-2026-97851), two Infinite Loop issues in JPEG and MP4 parsers (CVE-2026-107621, CVE-2026-105273), Inefficient Algorithmic Complexity in multipart stream handling (CVE-2026-101021), and two Missing Authentication for Critical Function flaws affecting DICOM associations and HL7 listener (CVE-2026-105279, CVE-2026-105667). Successful exploitation could allow attackers to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause denial-of-service. The highest CVSS v3.1 score is 9.1 (Critical), with some CVEs reaching 9.3 under CVSS v4.0. J4Care has released version 5.35.2 as the fix. These vulnerabilities were reported by Abhinav Agarwal to CISA, and no known active exploitation has been reported at the time of publication.
View original advisory →The GhostAction credential-theft campaign has significantly escalated, targeting over 30,000 repositories across 3,000 users and organizations on GitHub. The surge was observed on October 8 and 9, 2026, according to security firm GitGuardian. Approximately 1,900 GitHub accounts were compromised during the campaign. Attackers attempted to extract 3,174 secrets from public repositories' CI pipelines. The campaign represents a large-scale supply chain threat targeting developer credentials and sensitive secrets stored in CI/CD environments. The scale of the attack highlights ongoing risks to open-source and developer ecosystems hosted on GitHub.
View original advisory →