Overview of incoming advisories.
2018 results found
A command injection vulnerability has been discovered in Comfast CF-N1-S firmware version 2.6.0.1. The flaw resides in the system function accessible via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Attackers can exploit this by manipulating the 'timestr' argument to inject arbitrary OS commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been released, significantly increasing the risk of active exploitation. The affected product is a network device (likely a wireless access point or router), making this a network infrastructure concern. The CVE has been tracked and documented on NVD, VulDB, and GitHub. Given the public exploit availability and remote exploitability, this vulnerability poses a high risk to organizations using the affected hardware. Users are advised to apply patches or mitigations as soon as they become available.
View original advisory →A critical improper input validation vulnerability (CVE-2026-77234) has been identified in FreeRTOS-Kernel versions prior to 11.3.1. The flaw affects MPU-enabled ports and could allow an unprivileged task to execute arbitrary code in a privileged kernel context, effectively bypassing memory protection unit boundaries. This represents a significant privilege escalation risk in embedded and real-time operating system environments. The vulnerability is particularly concerning given FreeRTOS's widespread use in IoT and embedded systems. AWS has issued a security bulletin (2026-086-aws) acknowledging the issue. The remediation requires upgrading to FreeRTOS-Kernel version 11.3.1 or later, which is available on the official GitHub repository. No workarounds are mentioned; patching is the recommended course of action.
View original advisory →CVE-2026-48753 affects Incus, a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal attacks. This vulnerability allows attackers to create arbitrary files on the host system. The ability to write arbitrary files can lead to arbitrary command execution on the host. The vulnerability is fixed in Incus version 7.1.0. Users are advised to upgrade to version 7.1.0 or later to remediate the issue. The flaw is documented in both the NVD and a GitHub Security Advisory.
View original advisory →The arrayref crate version 0.3.10 for Rust has been identified as containing a rogue dependency that constitutes a supply chain attack. When developers compile a project that includes this crate, malicious code can be triggered during the build process. The rogue dependency registers with a command-and-control (C2) server, enabling arbitrary code execution on the victim's machine at compile time. This is a build-time malware attack, meaning developers do not need to run the software for compromise to occur. The attack was disclosed in August 2026 and has been documented across multiple security advisories including RustSec and the Rust language blog. The incident highlights risks associated with open-source dependency ecosystems and the potential for malicious packages to be introduced into trusted registries. Security researchers from SafeDep and StepSecurity have published analyses of the attack vector. The affected crate is listed in the RustSec advisory database under RUSTSEC-2026-0260.
View original advisory →CVE-2026-62674 affects Omnigent, an open-source AI agent framework for orchestrating coding agents, in versions prior to 0.3.0. The vulnerability exists in the PUT /sessions/{session_id}/agent endpoint, which checks LEVEL_EDIT permissions but fails to reject bound shared or template agents with a null agent.session_id. An authenticated user with edit access to a session can replace a shared agent bundle, inject a malicious stdio MCP server, and cause subsequent sessions using that shared agent to execute attacker-controlled commands. The commands run with Omnigent runner process permissions, potentially exposing files, credentials, workspace data, and internal services. The attack vector requires authentication but allows privilege escalation through the shared agent mechanism. Affected code paths include omnigent/server/routes/sessions.py and omnigent/tools/mcp.py. The vulnerability has been fixed in version 0.3.0 via a patch available on GitHub.
View original advisory →Combodo iTop, a web-based IT service management tool, was found to contain a Reflected Cross-Site Scripting (XSS) vulnerability in its foreign key search criteria API. The vulnerability affects versions prior to 3.2.3. Reflected XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, credential theft, or other client-side attacks. The issue has been assigned CVE-2026-33240 and was fixed in version 3.2.3. A patch commit is available on GitHub along with a security advisory. Users are advised to upgrade to iTop 3.2.3 or later to mitigate this risk.
View original advisory →A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Combodo iTop, a web-based IT service management tool. The vulnerability exists in the dashboard save functionality and affects versions prior to 3.2.3. Reflected XSS vulnerabilities allow attackers to inject malicious scripts that are reflected off the web server to the victim's browser. The flaw could be exploited to steal session cookies, redirect users, or perform actions on behalf of authenticated users. The issue has been addressed and patched in iTop version 3.2.3. A fix has been committed to the official GitHub repository and a security advisory has been published. Users are strongly advised to upgrade to version 3.2.3 or later. The vulnerability is tracked under CVE-2026-30865 and has an associated GitHub Security Advisory GHSA-8j4q-ccr6-wpmj.
View original advisory →Socket has expanded its security coverage to Firefox, scanning over 97,000 extensions in Mozilla's official directory for malicious behavior, risky updates, and supply chain threats. Research identified 77 linked malicious Firefox extension identities active from March through August 2026, with 40 confirmed malicious and 37 deceptive shells. These extensions delivered wallet-phishing pages, stole crypto recovery phrases and private keys, and exfiltrated credentials and clipboard contents. A key attack pattern involved legitimate-looking extensions being repurposed via automatic updates to deliver malware without triggering new permission prompts. Some malicious extensions transitioned from sports-score or utility tools to Rabby-style wallet stealers. Socket's platform provides visibility, threat detection, update monitoring, and ecosystem context to help enterprise security teams track extension behavior changes. The Firefox extension protection feature is now available in experimental status for Socket enterprise customers.
View original advisory →Three suspected Russian cyber espionage clusters — UNC6293, UNC7005, and UNC5976 — have been observed abusing legitimate authentication flows, including Google OAuth and WhatsApp linking, to hijack accounts. The threat actors are targeting individuals in academia, aerospace and defense, government, and think tanks across Europe and the United States. The clusters engage in persistent and adaptive tactics to gain unauthorized access. The use of legitimate authentication mechanisms makes detection significantly more difficult. This campaign reflects a broader trend of state-sponsored actors exploiting trusted platforms to conduct espionage operations.
View original advisory →Attackers compromised the maintainer account of the widely used Rust crate 'arrayref' to inject malicious code that executes during the compilation process on developers' systems. The attack represents a supply chain compromise targeting the Rust ecosystem, where developers unknowingly pull in malicious code as a dependency. The malware delivered is classified as an infostealer, designed to harvest sensitive information from affected developer machines. This type of attack is particularly dangerous because it targets the build pipeline, meaning any project depending on arrayref could have been silently compromised. The incident highlights ongoing risks in open-source package ecosystems where account takeover can lead to widespread downstream impact. Developers using the arrayref crate are advised to audit their dependencies and check for unauthorized changes to the package.
View original advisory →This weekly cybersecurity roundup covers multiple high-impact threats including a remote code execution vulnerability in Gogs 10.0, workflow-to-RCE in n8n, a $10M reward announcement, and AI-assisted exploit research using GLM-5.3. The article highlights a recurring theme of trusted components being weaponized, including signed drivers turned against defenses and legitimate applications used to blend in malware. A weak header check vulnerability is noted as enabling code execution. The piece also references exposed systems, unpatched legacy bugs, and novel evasion techniques. AI-assisted exploit research is identified as a key trend lowering the barrier for attackers. The overall tone signals a broad and diverse threat landscape with multiple active attack surfaces.
View original advisory →The U.S. government issued a warning about an active threat campaign targeting critical infrastructure using AI-generated exploit scripts. The activity focuses on Siemens S7 Series Programmable Logic Controllers (PLCs), conducting reconnaissance and capability development. The threat actors are using AI-generated scripts disguised as legitimate monitoring tools to evade detection. The campaign represents a novel use of AI in offensive cyber operations against industrial control systems. The targeting of PLCs in critical infrastructure raises significant concerns about potential disruption to essential services. This activity highlights the growing intersection of AI technology and nation-state or sophisticated threat actor operations.
View original advisory →Malicious versions of the arrayref Rust crate and other packages were found executing a backdoor at compile time, targeting developers through the Rust ecosystem. The campaign's infrastructure shows significant overlap with known North Korean (DPRK) supply chain attacks, including those involving the Mastra and axios packages. The attack is a compile-time supply chain compromise, meaning the malicious code runs during the build process rather than at runtime. This technique makes detection harder as traditional runtime security tools may miss it. The campaign is attributed to DPRK-linked threat actors based on infrastructure overlaps with prior operations. Developers using affected crates may have unknowingly executed malicious code during their build pipelines.
View original advisory →Three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9) maintained by David Roundy were compromised by a threat actor who injected a malicious dependency called proc-macro1, a typosquat of the legitimate proc-macro2 crate. The malicious build.rs script executed automatically during Cargo builds, downloading and executing cross-platform malware targeting Linux, macOS, and Windows. The stage-2 backdoor profiled hosts, inventoried browsers, established persistence, and beaconed to a C2 at 23.254.165.112. The threat actor also yanked older legitimate arrayref releases to steer dependency resolution toward the malicious version. Socket's AI Scanner detected the attack on August 20, 2026, and the Rust Security Response Team removed affected releases and locked the maintainer account. Any system that built one of the malicious versions should be treated as potentially compromised, with credentials rotated and persistence mechanisms investigated.
View original advisory →A critical vulnerability has been discovered in the Elementor Pro WordPress plugin that could allow attackers to upload executable files to vulnerable servers. This flaw enables remote code execution (RCE), posing a severe risk to WordPress sites using the plugin. Attackers exploiting this vulnerability could gain full control over affected servers. The issue is classified as critical due to the ease of exploitation and the widespread use of Elementor Pro across WordPress installations. Website administrators are urged to update the plugin immediately to mitigate the risk. No CVE identifier is explicitly mentioned in the available content.
View original advisory →A critical security vulnerability (GHSA-864f-rcv7-6rh4) has been disclosed in isolated-vm, a widely-used open-source JavaScript sandbox library with over 2,900 GitHub stars. The flaw affects all versions up to and including 7.0.0 and has not yet been assigned a CVE identifier. The vulnerability allows attackers to escape the isolated sandbox environment and potentially execute code on the host system, enabling remote code execution (RCE). Isolated-vm is commonly used by developers to safely run untrusted JavaScript code in Node.js applications. The sandbox escape nature of this flaw makes it particularly severe, as it undermines the core security guarantee of the library. Users and organizations relying on isolated-vm for security isolation are urged to review their usage and apply patches as they become available.
View original advisory →Citrix has released security updates addressing two vulnerabilities in NetScaler ADC and NetScaler Gateway. The most severe is a critical authentication bypass flaw affecting customer-managed deployments. The vulnerability impacts certain FIPS and NDcPP builds as well as SecurAccess configurations. Both NetScaler ADC and NetScaler Gateway products are affected. The flaws are specific to customer-managed environments rather than Citrix-managed cloud services. Organizations running affected versions are urged to apply the patches immediately given the critical severity rating. Authentication bypass vulnerabilities in gateway and AAA servers pose significant risk as they can allow unauthorized access to protected resources.
View original advisory →A patched security vulnerability in Zimbra Collaboration (ZCS), tracked as CVE-2026-73570 with a CVSS score of 8.9, is being actively exploited in the wild. The flaw is a command injection vulnerability that enables unauthenticated remote code execution. The active exploitation was reported by CERT Polska (Polish Computer Emergency Response Team). The vulnerability resides in Zimbra's SNMP component and allows remote attackers to execute arbitrary commands without authentication. Organizations running affected versions of Zimbra Collaboration are urged to apply the available patch immediately. The high CVSS score reflects the critical nature of the flaw, given its unauthenticated and remote exploitability.
View original advisory →Researchers disclosed two denial-of-service attacks dubbed 'CDN Tsunami' that exploit how major CDNs translate HTTP/3 client traffic into HTTP/1.1 requests forwarded to origin servers. The attack achieves up to 350x amplification of low-bandwidth request streams against origin servers. The vulnerability was evaluated against major CDN providers including Alibaba and Baidu. The attack abuses the protocol translation layer inherent in CDN architectures, allowing attackers to generate disproportionately large traffic volumes at the origin with minimal effort. This represents a significant threat to websites relying on CDNs for traffic management and DDoS protection. The findings highlight a systemic weakness in how CDNs handle HTTP/3 to HTTP/1.1 conversion, potentially affecting a wide range of CDN-dependent services globally.
View original advisory →A new Android malware strain called Manic has been discovered actively targeting Ukrainian banks, government agencies, identity services, and messaging apps, as well as Russian and European financial institutions, global fintech and cryptocurrency platforms, and military communications. Manic combines capabilities of both banking malware and mobile spyware, enabling financial fraud alongside surveillance. A particularly notable feature is its ability to exfiltrate data from offline phones by leveraging nearby infected devices, suggesting advanced peer-to-peer or proximity-based communication mechanisms. The malware represents a sophisticated threat actor operation with geopolitical dimensions, given its focus on Ukrainian and Russian targets amid ongoing conflict. Its dual-purpose nature makes it especially dangerous for both financial and national security contexts.
View original advisory →