Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Threat actors are actively exploiting vulnerabilities in the AhsayCBS backup utility to compromise affected systems. The attack chain involves leveraging two recently disclosed flaws, including CVE-2026-105133, an improper authentication vulnerability in the checkSysPwd() function within the AhsayCBS Java codebase. Successful exploitation allows attackers to seize control of targeted devices. Post-exploitation activity includes deployment of web shells for persistent access and remote control. Attackers also deploy XMRig cryptocurrency miners disguised as Microsoft Edge to evade detection. The use of a legitimate application name as a disguise indicates deliberate obfuscation techniques. The campaign targets organizations using the AhsayCBS backup solution. The CVSS v4 score of 5.5 for the known CVE suggests moderate severity, but active exploitation elevates the overall risk.
Bekijk origineel advisory →A maximum-severity vulnerability tracked as CVE-2026-102255 affecting SonicWall SMA1000 appliances is being actively exploited in the wild. The flaw was patched just three days prior to confirmed exploitation being reported. SonicWall SMA1000 are secure remote access appliances widely used in enterprise environments. The active exploitation of a just-patched critical vulnerability indicates threat actors are moving quickly to leverage the flaw before organizations can apply updates. Organizations using SonicWall SMA1000 devices are urged to apply the patch immediately given the critical severity rating and confirmed in-the-wild exploitation.
Bekijk origineel advisory →CISA added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following active exploitation by Flax Typhoon, a China-linked threat actor. One of the key vulnerabilities is CVE-2015-3306 (CVSS 10.0), an improper access control flaw in ProFTPD. CISA set an October 11 deadline for federal agencies to remediate the identified vulnerabilities. Flax Typhoon is a state-sponsored Chinese threat group known for targeting critical infrastructure and government entities. The addition to the KEV catalog signals active in-the-wild exploitation of these flaws. Federal agencies are required to patch or mitigate the listed vulnerabilities before the deadline. The article highlights the ongoing threat posed by Chinese APT groups leveraging known vulnerabilities in widely used software.
Bekijk origineel advisory →On October 8, 2026, the GhostAction campaign returned with a new wave targeting 346 GitHub repositories by compromising two maintainer accounts (henrywoo and kitao) and injecting a malicious workflow file named security-audit.yml. The campaign expanded beyond its original GitHub Actions secret theft to also sweep working trees and full git history for cloud provider and AI service credentials using 13 regex patterns. Stolen data was exfiltrated via HTTP POST to a hardcoded C2 IP address (193.32.204.199). High-profile repositories affected include uber/athenadriver and kitao/pyxel (18,420 stars), with publishing credentials for PyPI and crates.io at risk. The attack was highly automated, processing 346 repos across two accounts in short time windows. The new variant adds fetch-depth:0 to retrieve complete git history including credentials developers believed were deleted. Targeted credential types include AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys, Slack tokens, and SendGrid keys. No malicious package versions were observed published to PyPI or crates.io at time of writing.
Bekijk origineel advisory →A critical vulnerability in GoBalance, a load-balancing tool used by dark-web sites, allows attackers to recover secret keys controlling .onion addresses using only public information. The flaw was disclosed by Searchlight Cyber on October 8, 2026. An attacker who successfully recovers the key can redirect a site's visitors to a malicious copy under their control. This effectively enables full hijacking of .onion addresses, posing serious risks to dark-web site operators and their users. The vulnerability undermines the integrity and trustworthiness of Tor hidden services that rely on GoBalance for availability during attacks.
Bekijk origineel advisory →Citrix has issued an urgent warning to IT administrators to immediately patch a critical remote code execution (RCE) vulnerability affecting NetScaler ADC and NetScaler Gateway products. The flaw impacts NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. Citrix is urging immediate remediation due to the critical severity of the vulnerability. No specific CVE identifier is mentioned in the available content snippet. The vulnerability could allow attackers to execute arbitrary code remotely on affected systems. NetScaler products are widely deployed in enterprise environments, making this a high-priority issue. Administrators are advised to apply patches without delay to reduce exposure.
Bekijk origineel advisory →At Pwn2Own Ireland 2026 in Cork, three research teams successfully demonstrated remote exploits against a fully patched Google Pixel 10 smartphone. The contest, organized by Trend Micro's Zero Day Initiative, requires all targets to be fully patched before exploitation attempts. One of the three exploits, demonstrated by Ikotas Labs, earned the team a $300,000 prize, the highest award of the contest, and secured them the overall winner title. The flaws discovered during the contest are responsibly disclosed to vendors following the competition. The event highlights ongoing security concerns for Android devices even when fully updated.
Bekijk origineel advisory →Citrix has released patches for a critical security vulnerability tracked as CVE-2026-107406 affecting NetScaler ADC and NetScaler Gateway. The flaw is a memory overflow vulnerability that can lead to remote code execution (RCE) or denial-of-service (DoS) under specific configuration conditions. The vulnerability is particularly relevant to deployments using SAML authentication. Citrix has urged administrators to apply the patches promptly. This follows a pattern of critical vulnerabilities affecting Citrix NetScaler products in recent years.
Bekijk origineel advisory →The FBI and Department of Justice announced the disruption of malicious tools used by Flax Typhoon, a China-linked advanced persistent threat (APT) group. As part of the operation, authorities seized seven domains and blocked access to platforms used by the threat actor. These platforms were leveraged to scan and in some cases infiltrate U.S. critical infrastructure. The action represents a significant law enforcement effort against Chinese state-sponsored cyber espionage targeting American infrastructure. Flax Typhoon is a well-documented APT group known for targeting government, defense, and critical infrastructure sectors. The seizure of domains is intended to disrupt the group's operational capabilities and command-and-control infrastructure.
Bekijk origineel advisory →IDC Frontier, a major Japanese cloud and digital infrastructure provider, suffered a ransomware attack targeting its IDCF Cloud service. The attack caused a significant outage at a data center cluster serving eastern Japan. The incident is particularly notable as IDCF Cloud is used by government clients, raising concerns about public sector data and service continuity. The disruption highlights the vulnerability of cloud infrastructure providers to ransomware attacks. Details on the specific ransomware group responsible or the extent of data compromise have not been fully disclosed. The attack underscores the risks faced by critical cloud infrastructure serving both private and governmental organizations.
Bekijk origineel advisory →A malware campaign called 'Midnight Mimosa' has been found pre-installed in the firmware of low-cost Android smartphones. The malware is embedded at the supply chain level, meaning devices arrive compromised before reaching end users. Once active, it allows attackers to silently install additional applications without user knowledge. The campaign also enables ad fraud operations leveraging the infected devices. Additionally, compromised devices are enrolled as residential proxies, routing third-party traffic through victims' internet connections. The stealthy nature of firmware-level embedding makes detection and removal extremely difficult for average users. This represents a significant supply chain security concern for budget Android device consumers.
Bekijk origineel advisory →The FBI and agencies from six other countries revealed that hackers linked to Chinese cybersecurity firm Integrity Technology Group conducted a campaign targeting government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia. The attackers stole emails from these organizations and operated a portal that allowed third parties to access the stolen data. The hackers used a scanning tool to identify vulnerabilities in target websites. Integrity Technology Group has been sanctioned by both the U.S. and the UK in response to these activities. The operation represents a significant state-affiliated cyber espionage effort with broad international implications.
Bekijk origineel advisory →The FakeGit malware campaign has returned with over 17,610 malicious repositories on GitHub designed to distribute the SmartLoader malware. The campaign reactivated earlier in October 2026 and is being used to push the StealC infostealer to unsuspecting users. SmartLoader acts as a delivery mechanism, loading additional malicious payloads onto compromised systems. The scale of the campaign is significant, with tens of thousands of fake repositories mimicking legitimate projects. StealC is a well-known information-stealing malware capable of harvesting credentials, browser data, and other sensitive information. The use of GitHub as a distribution platform lends a false sense of legitimacy to the malicious repositories. Users and developers are advised to exercise caution when cloning or using repositories from unknown sources. The campaign highlights the ongoing abuse of trusted developer platforms for malware distribution.
Bekijk origineel advisory →The Russia-aligned threat actor UAC-0099, also tracked as Earth Sirrush, has been attributed to a newly discovered malware family called ASHVEIN. ASHVEIN is a .NET-based infostealer and remote access trojan (RAT) that conceals commands within HTML content. The malware has been deployed in targeted attacks against Ukrainian government personnel. The campaign was identified and analyzed by TrendAI, which previously tracked the cluster under the name SHADOW-EARTH-065. ASHVEIN represents a previously undocumented toolset associated with UAC-0099 operations. The use of HTML-based command hiding suggests an effort to evade detection by security tools. This activity aligns with broader Russian cyber operations targeting Ukrainian government infrastructure during the ongoing conflict.
Bekijk origineel advisory →Cisco released security advisories addressing five critical vulnerabilities in its NX-OS operating system, which powers Nexus data center switches. These flaws could be exploited by attackers to execute arbitrary code with root-level privileges on affected devices. The vulnerabilities represent a significant risk to enterprise and data center network infrastructure. Successful exploitation could result in full device takeover, enabling attackers to intercept, manipulate, or disrupt network traffic. Cisco has urged administrators to apply patches promptly. The advisories highlight ongoing security challenges in network operating systems used in critical environments.
Bekijk origineel advisory →Cybersecurity researchers from CrowdStrike Intelligence have uncovered a targeted campaign against South Korean financial organizations using an AI-powered penetration testing tool called ARTEX. The campaign was active from late September to early October 2026 and resulted in successful data exfiltration. Threat actors leveraged ARTEX, an AI-based pen testing tool, to conduct offensive operations against financial sector targets. The attacks highlight the emerging risk of AI-assisted offensive security tools being repurposed for malicious data theft campaigns. The financial sector in South Korea appears to have been specifically targeted, raising concerns about sector-specific threat activity in the region.
Bekijk origineel advisory →CISA published an ICS advisory (ICSA-26-281-01) disclosing seven vulnerabilities in Red Lion Controls N-Tron 700 Series industrial switches affecting firmware versions up to 3.11.0 and bootloader versions up to 2.0.6.1. The vulnerabilities include hard-coded credentials, plaintext password storage, weak credential encryption, missing authentication for SNMP-based administrative functions, unauthenticated firmware update capability, a reachable assertion enabling DoS via URL-triggered reboots, and an authentication bypass via physical access. Successful exploitation could allow attackers to gain administrative access, view/edit/upload configuration files, push malicious firmware, or cause continuous device reboots. CVSS v3 scores range from 4.9 to 8.3, with CVSS v4 scores reaching up to 9.3 (Critical). The vulnerabilities affect critical infrastructure sectors including Commercial Facilities, Communications, Critical Manufacturing, and Information Technology, with worldwide deployment. Remediation includes upgrading to firmware version 3.11.1 or greater, disabling/configuring SNMP communities, and disabling web GUI access. The vulnerabilities were reported by Gabrianna (Ria) Milloway of Idaho National Laboratory. No known public exploitation has been reported at the time of publication.
Bekijk origineel advisory →CISA has published ICS advisory ICSA-26-281-02 detailing six vulnerabilities affecting Grid Protection Alliance's openPDC and openHistorian products used in the energy sector. The most critical vulnerability (CVE-2026-100730, CVSS 9.8) involves deserialization of untrusted data enabling remote code execution. CVE-2026-105278 (CVSS 9.8) affects the Docker image with hard-coded administrative credentials allowing full application takeover. CVE-2026-104629 (CVSS 8.8) enables unsafe reflection allowing authenticated attackers to run arbitrary constructor code. Two missing authentication vulnerabilities (CVE-2026-105281 and CVE-2026-85479) expose internal data publisher and STTP-based data publisher interfaces to unauthenticated network attackers. CVE-2026-101022 is an SSRF vulnerability in the Modbus connection feature allowing internal network mapping. Fixes are available in openPDC 2.9.477/2.9.482 and openHistorian 2.8.580/2.8.585, though Docker images have no fix planned. These vulnerabilities were reported by Shubham Raj of Causal Security.
Bekijk origineel advisory →CISA published an ICS advisory for Satel Netco Design software versions prior to v2.1.7, disclosing four vulnerabilities. The vulnerabilities include a stored cross-site scripting flaw (CVE-2026-105269), an inefficient regular expression complexity issue (CVE-2026-104628), and two relative path traversal vulnerabilities in data import and export functionality (CVE-2026-105275 and CVE-2026-101024). The most severe vulnerability, CVE-2026-101024, carries a CVSS v3.1 score of 8.8 (HIGH) and could allow authenticated users with Viewer privileges to write attacker-influenced content to the file system, potentially enabling arbitrary code execution. The affected product is deployed worldwide in the Communications critical infrastructure sector, with the vendor headquartered in Finland. Satel recommends updating to version v2.1.7 to remediate all identified vulnerabilities. No known public exploitation has been reported to CISA at the time of publication. The vulnerabilities were reported by Alex Williams of Pellera Technologies.
Bekijk origineel advisory →ANY.RUN researchers have identified a new phishing kit called Wazza targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. Unlike traditional phishing kits that simply clone login pages, Wazza incorporates advanced capabilities including traffic filtering, session management, and infrastructure-level controls. The kit is designed to evade detection while harvesting credentials from victims in multiple sectors. Its multi-regional targeting scope suggests a well-resourced threat actor or group. The phishing infrastructure includes built-in mechanisms to manage victim sessions and filter out unwanted traffic such as bots or researchers. This represents a broader trend of increasingly sophisticated phishing-as-a-service tooling available to attackers. The targeting of critical sectors like banking and government elevates the potential impact of successful campaigns.
Bekijk origineel advisory →