Overzicht van binnengekomen advisories.
2053 resultaten gevonden
CISA has issued a warning that threat actors are actively exploiting a critical vulnerability in the Brotli compression library, referred to as Node2Shell, Broccoli2Shell, and HTTP2Shell. The flaw is considered critical and has moved from theoretical risk to active exploitation in the wild. CISA's alert signals that organizations using affected Node.js or HTTP/2 implementations leveraging Brotli should treat this as an urgent remediation priority. The vulnerability allows attackers to potentially gain shell-level access to affected systems, hence the 'Shell' suffix in its common names. This type of advisory typically precedes broader exploitation campaigns and ransomware or espionage activity. Organizations are advised to patch immediately and review CISA's Known Exploited Vulnerabilities catalog for guidance.
Bekijk origineel advisory →Anthropic's unreleased AI model autonomously discovered security vulnerabilities in major platforms including Chrome, Safari, Android, Windows, and Linux, and chained them into working proof-of-concept exploits. The exploits were generated in a controlled lab environment after the model was prompted, and were not observed in any real-world attacks. Anthropic responsibly disclosed all discovered flaws to the respective vendors before publication, and all vulnerabilities have since been patched. This marks a significant demonstration of AI-assisted vulnerability research and exploit development capabilities. The findings raise important questions about the dual-use nature of advanced AI models in cybersecurity contexts.
Bekijk origineel advisory →Tailscale has released version 1.104.4 to address critical security flaws in its built-in SSH server. The vulnerabilities reside in how Tailscale SSH handles network connection forwarding, a process executed with root privileges by the Tailscale background daemon. An attacker who has already compromised a device within a Tailscale network could potentially exploit these flaws to gain unauthorized access to services and files on other servers that should only be accessible by the root user. The flaws represent a significant privilege escalation and lateral movement risk within Tailscale-managed networks. Users are strongly advised to update to version 1.104.4 immediately to mitigate the risk.
Bekijk origineel advisory →A critical vulnerability in Oracle PeopleSoft, initially thought to be a single zero-day, has been revealed as three chained flaws. The vulnerability chain, tracked under CVE-2026-35273, has been actively exploited by the threat actor ShinyHunters since May 2026. Oracle patched all three flaws under a single CVE identifier in June 2026. The root cause is a server-side request forgery (SSRF) vulnerability that allows attackers to reach an internal management interface by exploiting PeopleSoft's trust of its own loopback address. Researchers who reported the vulnerabilities disclosed the chained nature of the exploit this week, highlighting the complexity of the attack vector.
Bekijk origineel advisory →CISA has added two vulnerabilities affecting Adobe Commerce, Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities catalog. The primary vulnerability CVE-2026-111497 carries a critical CVSS score of 9.2 and is described as an unchecked return value vulnerability. Hundreds of Adobe Commerce and Magento stores have reportedly been breached via PolyShell attacks. Brotli exploit traffic has also emerged as a related threat vector. The active exploitation of these vulnerabilities prompted CISA to issue the KEV catalog update, urging organizations to patch immediately.
Bekijk origineel advisory →Japan's GMO Group has issued an urgent warning to customers to disconnect their systems from the internet and shut down their computers. A threat actor who breached GMO's Onamae Desktop Cloud service has threatened to launch a ransomware attack. The company is taking a proactive defensive stance by advising customers to power down PCs to prevent potential ransomware deployment. The incident highlights the risks associated with cloud-hosted desktop services. GMO Group operates one of Japan's largest internet services, making this a significant incident affecting a broad customer base. The threat appears imminent as the attacker set a specific date for the ransomware launch.
Bekijk origineel advisory →The University of New Mexico Health Sciences Center suffered a ransomware attack that caused significant system outages. The attack disrupted patient care operations and academic activities at the institution. Surgeries and other medical procedures were impacted as a result of the cyberattack. The incident highlights the growing threat of ransomware targeting healthcare organizations. System outages forced staff to revert to manual processes, affecting the quality and continuity of care. The attack underscores the vulnerability of healthcare infrastructure to cyber threats.
Bekijk origineel advisory →A credit card skimming group compromised a shared analytics script belonging to e-commerce platform Convertr. The attackers injected malicious code into the script to steal payment card data from shoppers during the checkout process. This is a supply chain attack targeting e-commerce sites that rely on Convertr's analytics. Multiple online stores using the compromised script were likely affected simultaneously. The attack follows a common Magecart-style approach where shared third-party scripts are weaponized to maximize reach. Payment data including card numbers and related checkout information was the primary target. The incident highlights risks associated with third-party script dependencies in e-commerce environments.
Bekijk origineel advisory →Cybersecurity researchers have uncovered details of three cyber attacks targeting Japanese organizations in which AI played a central role, either autonomously or assisting human operators. A threat actor group identified as CyberStrikeAI deployed 44 AI agents to automate malicious hacking operations. Research firm TrendAI analyzed three exposed server environments used by the threat actors. The operations are described as distinct from previously published threat actor behaviors. The use of AI agents marks a significant evolution in offensive cyber capabilities. This represents a notable case of AI being weaponized at scale for targeted cyber intrusions. The attacks highlight growing concerns about AI-augmented threat actors increasing the speed and scale of attacks.
Bekijk origineel advisory →Socket's Threat Research Team discovered a cluster of malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys. The extensions use Unicode homoglyphs to mimic legitimate wallet names and route stolen data to brand-named subdomains of a single C2 apex, bonto[.]io. The Phantom impersonator uses a two-stage approach: a loader fetches a remote payload at runtime, allowing operators to swap the stealer after Mozilla's review. All three extensions also bundle complete stealers in their signed packages. The Phantom package additionally contains a Node.js drainer backend that forwards stolen secrets via Telegram and auto-sweeps funds to hardcoded wallet addresses across multiple blockchains. Infrastructure provisioned for Coinbase and Exodus subdomains suggests the campaign is broader than the three confirmed listings. Rating manipulation was observed on the Phantom listing to suppress negative reviews from victims reporting fund losses. All three listings have been removed from Firefox Add-ons as of publication.
Bekijk origineel advisory →Tailscale's security team has disclosed nearly a dozen vulnerabilities in its SSH implementation that pose serious risks to users. The flaws could be exploited by attackers to steal credentials, crash servers, and gain root privileges on affected systems. Tailscale is actively working to patch these vulnerabilities. The issues are particularly concerning given Tailscale's wide use as a secure networking and remote access tool. Root privilege escalation vulnerabilities are considered high-severity as they allow attackers full control over compromised systems. No specific CVE identifiers were mentioned in the article snippet. Users of Tailscale SSH functionality are advised to monitor for patches and apply them promptly. The breadth of vulnerabilities (approximately a dozen) suggests systemic issues in the SSH feature implementation.
Bekijk origineel advisory →Apple has backported a fix for a high-severity vulnerability tracked as CVE-2026-86950 to older iPhones and iPads. The flaw, scoring 8.8 on the CVSS scale, is an out-of-bounds write issue in the CoreGraphics framework. Exploitation of this vulnerability can lead to arbitrary code execution when a maliciously crafted file is processed. The flaw was confirmed to have been exploited in real-world cyberattacks. Apple had originally released patches last month for newer devices and has now extended coverage to legacy hardware. The backport underscores the active exploitation risk associated with this vulnerability. Users of older Apple devices are strongly encouraged to apply the update immediately.
Bekijk origineel advisory →Microsoft has patched a vulnerability in its Authenticator app for Android, tracked as CVE-2026-80097. The flaw allowed a malicious app with no special permissions to impersonate trusted Microsoft applications such as Teams. By exploiting this vulnerability, an attacker could collect sign-in tokens associated with a victim's work account. The fix was released in Microsoft Authenticator for Android version 6.2606.4246. Users are strongly advised to update to the patched version immediately. The vulnerability posed a significant risk to enterprise environments relying on Microsoft Authenticator for multi-factor authentication. No permissions were required for the malicious app to carry out the attack, lowering the barrier for exploitation significantly.
Bekijk origineel advisory →CISA published ICS advisory ICSA-26-300-01 covering four vulnerabilities in EPICS Base versions 7.0.10 and prior, used in critical manufacturing infrastructure worldwide. The highest severity CVE-2026-114595 scores 9.8 (CRITICAL) on CVSS v3.1 and involves an integer overflow in network request processing that can lead to memory corruption, denial of service, or remote code execution. CVE-2026-114596 (CVSS 8.2 HIGH) involves improper validation of message length values causing integer overflow and out-of-bounds memory write. CVE-2026-114597 (CVSS 7.5 HIGH) and CVE-2026-114598 (CVSS 7.5 HIGH) involve insufficient validation of element/length values enabling out-of-bounds reads, potential DoS, and memory disclosure. All vulnerabilities are remotely exploitable with no authentication or user interaction required. The EPICS Community has released version 7.0.11 as the fix. These vulnerabilities were reported by Shubham Raj of Cipher/Causal Security. No known public exploitation has been reported at this time.
Bekijk origineel advisory →CISA published an ICS advisory (ICSA-26-300-02) detailing four vulnerabilities in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz products. CVE-2023-4863 is a critical out-of-bounds write vulnerability (CWE-787) in the libwebp component affecting GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2, with CVSS v4.0 score of 9.3. CVE-2026-16436 is a weak password recovery mechanism (CWE-640) allowing remote attackers to bypass authentication using a fixed common challenge response, scoring 9.2 on CVSS v4.0. CVE-2026-16437 is a related authentication bypass via local file tampering of the challenge response management file, scoring 7.1 on CVSS v4.0. CVE-2026-16438 is an incorrect privilege assignment (CWE-266) vulnerability allowing DCOM object abuse, with a critical CVSS v4.0 score of 9.4. Successful exploitation could lead to arbitrary code execution, authentication bypass, information disclosure, data tampering, or denial-of-service. No fixes are planned for legacy products MC Works64, GENESIS32, and BizViz; vendors recommend replacement with newer products.
Bekijk origineel advisory →An attacker gained access to Keystone's website and stole the cryptographic key used by Keystone hardware wallets to verify their authenticity. This key is used in an online verification process that allows owners to confirm their device is genuine. With this key, an attacker could create counterfeit Keystone hardware wallets that pass the legitimacy check, potentially tricking buyers into trusting fake devices. If a user trusts a counterfeit device, their cryptocurrency could be stolen. In response, Keystone announced it will destroy all 18,835 affected hardware wallets. The incident highlights the risk of supply-chain and device-integrity attacks targeting cryptocurrency hardware wallet manufacturers.
Bekijk origineel advisory →The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign called Operation FlashHole targeting at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing sectors. The campaign has been active since at least July 2025 and was identified by Kaspersky. A notable characteristic of this campaign is the abuse of legitimate South Korean security software to deploy malware. The malware deployed uses post-quantum encryption, representing an advanced and forward-looking operational security measure by the threat actor. This campaign reflects Lazarus Group's continued focus on South Korean targets across multiple industry verticals.
Bekijk origineel advisory →Apple has backported security patches to older iPhones and iPads, addressing a zero-day vulnerability in the CoreGraphics framework. The flaw was originally patched last month for newer devices. The vulnerability was reportedly exploited in 'extremely sophisticated' targeted attacks against iOS devices. By backporting the fix, Apple aims to protect users on older hardware who cannot upgrade to the latest iOS versions. This highlights the ongoing risk of targeted zero-day exploitation against Apple mobile devices and the importance of patch coverage across legacy device ecosystems.
Bekijk origineel advisory →The Australian Signals Directorate (ASD) successfully infiltrated the backend infrastructure of an Amadey malware operation. The agency cut off a criminal operator's access to approximately 180,000 infected computers worldwide, including some located in Australia. By gaining access to the malware's command-and-control backend, ASD effectively severed the connection between the attacker and all compromised machines. This action prevented further data theft or malicious activity from being conducted through the Amadey controller. The operation represents a significant proactive cyber defense action by an Australian government agency against a widespread malware campaign.
Bekijk origineel advisory →CISA has added PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies have been ordered to patch their systems by Thursday to mitigate the risk. The advisory underscores the urgency of addressing these flaws, which are being actively leveraged by threat actors. PHP2Shell vulnerabilities pose a significant risk to web-facing systems that rely on PHP-based environments. The move is part of CISA's ongoing effort to compel timely remediation of critical security issues across government infrastructure. Organizations beyond the federal sector are also encouraged to prioritize patching these vulnerabilities given their active exploitation status.
Bekijk origineel advisory →