Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Cybersecurity researchers discovered 16 malicious Mozilla Firefox extensions impersonating legitimate cryptocurrency wallets such as Rabby and OKX. These extensions disguise themselves as wallet portals, desktop utilities, and browser tools. Their underlying code intercepts recovery phrases and private keys during wallet import flows. The stolen secrets are then transmitted to attacker-controlled infrastructure. The campaign targets cryptocurrency users who install what appear to be legitimate browser-based wallet tools. The use of well-known wallet brand names increases the likelihood of user deception. This represents a significant threat to cryptocurrency holders who rely on browser extensions for wallet management.
Bekijk origineel advisory →The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks attributed to the HAFNIUM threat group. The reward was reported by NTD news outlet. Zhang Yu is believed to be involved in the widespread exploitation of Microsoft Exchange Server vulnerabilities in 2021. The HAFNIUM campaign targeted thousands of organizations globally, compromising email servers and exfiltrating sensitive data. This bounty is part of the U.S. government's ongoing efforts to hold state-sponsored hackers accountable.
Bekijk origineel advisory →On the second day of Pwn2Own Ireland 2026, security researchers successfully exploited 45 unique zero-day vulnerabilities and collected $232,500 in cash awards. The Samsung Galaxy S26 was hacked three additional times during this event. Pwn2Own is a well-known competitive hacking contest where researchers demonstrate previously unknown vulnerabilities in popular devices and software. The event highlights ongoing security challenges in mobile device security. Multiple successful exploits against the Samsung Galaxy S26 underscore the presence of significant zero-day vulnerabilities in the device. The competition incentivizes responsible disclosure by rewarding researchers for their findings. These results are likely to prompt Samsung to release security patches addressing the discovered vulnerabilities. The event serves as a critical barometer for the state of mobile and device security in 2026.
Bekijk origineel advisory →The npm package 'tensorlake', a TypeScript SDK for Tensorlake applications and cloud services, was compromised as part of a supply chain attack known as ChainDrop/Shai-Hulud. The malicious version 0.5.144 was injected with obfuscated malware capable of harvesting credentials, exfiltrating secrets, establishing persistence, and executing remotely supplied code. The attack was identified and reported by Socket. This incident represents a classic software supply chain compromise targeting developer ecosystems through a widely-used SDK package. The Shai-Hulud worm component adds a self-propagating and credential-stealing dimension to the threat, making it particularly dangerous for organizations using the affected package in their development pipelines.
Bekijk origineel advisory →The Tensorlake npm package was compromised through a malicious release built directly from the project's own main branch. The attack included an npm provenance attestation, lending it false legitimacy. A particularly dangerous feature of this malware is a 'hostage token' mechanism that will wipe the victim's machine if the token is revoked. The malware also exhibits worm-like behavior, allowing it to spread. This represents a sophisticated supply chain attack targeting npm ecosystem users. The use of provenance attestation to bypass trust mechanisms marks an escalation in supply chain attack sophistication.
Bekijk origineel advisory →Socket detected a compromised release of the tensorlake npm SDK (version 0.5.144) as part of the ongoing ChainDrop / Shai-Hulud supply chain attack campaign. The malicious version was published on October 8, 2026 and flagged by Socket just 11 minutes later. It uses a preinstall hook to execute obfuscated malware that harvests credentials from npm, GitHub, AWS, Kubernetes, HashiCorp Vault, SSH keys, .env files, and AI development tools. The payload is a self-propagating worm that spreads by republishing compromised versions to other packages under the victim's npm identity. Command-and-control endpoints are resolved dynamically via an Ethereum smart contract rather than hardcoded domains. A 'dead man's switch' monitors stolen GitHub tokens and executes attacker-supplied code upon token revocation, with threats to wipe the victim's computer. The attack pattern matches previously documented Shai-Hulud compromises of keyv, cacheable, and related packages. Teams using tensorlake@0.5.144 are advised to treat affected hosts as compromised, revoke credentials, and audit connected accounts.
Bekijk origineel advisory →CVE-2015-3306 is an improper access control vulnerability in ProFTPD, an open-source FTP server. Remote attackers can exploit this flaw using the SITE CPFR and SITE CPTO commands to read and write arbitrary files on the affected system. This vulnerability poses a significant risk as it allows unauthorized file manipulation without proper authentication controls. It affects ProFTPD and potentially any product or system that incorporates it as a component or dependency. The vulnerability has been acknowledged by CISA and is listed under BOD 26-04 for prioritized security updates. Debian and OpenSUSE have both issued security advisories addressing this issue. Organizations using ProFTPD are strongly advised to apply available patches immediately to mitigate the risk of exploitation.
Bekijk origineel advisory →CVE-2021-3199 is a path traversal vulnerability in ONLYOFFICE Docs Server that can be exploited when JWT authentication is in use. The vulnerability is triggered via a '/.. sequence' in an image upload parameter, potentially allowing remote code execution. The flaw affects the ONLYOFFICE DocumentServer and was patched in version 5.6.3. As an open-source component, it may also affect third-party products or libraries that incorporate ONLYOFFICE. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, assigning it a high criticality rating. Organizations using ONLYOFFICE Docs are urged to apply security updates as prioritized under BOD 26-04. Forensics triage requirements may apply for affected federal agencies.
Bekijk origineel advisory →Strapi, a popular open-source headless CMS, contains a cleartext storage vulnerability (CVE-2023-22894) that exposes sensitive user information to attackers with admin panel access via query filters. The vulnerability allows discovery of sensitive user details including passwords and tokens in plaintext. Affected versions may be end-of-life or end-of-service, and users are advised to upgrade to a supported version immediately. This vulnerability is particularly dangerous as it can be chained with CVE-2023-22621 to achieve remote code execution. CISA has listed this in its Known Exploited Vulnerabilities catalog under BOD 26-04 prioritization directives. The flaw affects not only Strapi directly but potentially any product or service relying on Strapi as a component or dependency. Organizations using Strapi are urged to apply available patches or migrate to supported versions without delay.
Bekijk origineel advisory →CVE-2016-3081 is a command injection vulnerability in Apache Struts that allows remote attackers to execute arbitrary code. The vulnerability is exploited via the 'method:' prefix when Dynamic Method Invocation (DMI) is enabled. It is tracked under the Struts advisory S2-032. The issue affects open-source components and third-party libraries that may be embedded in various products. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog. It is referenced under BOD 26-04, which prioritizes security updates based on risk. Organizations using Apache Struts with DMI enabled are urged to apply patches or mitigations immediately. The vulnerability carries a high criticality rating due to its potential for full remote code execution.
Bekijk origineel advisory →CVE-2015-5477 is a data processing error vulnerability in ISC BIND that allows remote attackers to cause a denial of service via specially crafted TKEY queries. The vulnerability affects the BIND DNS server software, which is widely used across many platforms and distributions. Exploitation can result in a crash of the named daemon, disrupting DNS resolution services. The vulnerability is notable for its potential broad impact given BIND's widespread use as an open-source component embedded in various products, including those from Juniper Networks. Red Hat issued a security errata (RHSA-2015:1513) addressing the flaw. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, and it falls under BOD 26-04 prioritization requirements. The vulnerability is remotely exploitable without authentication, making it particularly dangerous for internet-facing DNS infrastructure.
Bekijk origineel advisory →Unit 42 researchers from Palo Alto Networks have published an analysis detailing how threat actors are leveraging Web3 infrastructure to conduct open-source supply chain attacks targeting enterprise cloud environments. The article explores the evolution of attack techniques that combine decentralized Web3 technologies with traditional supply chain compromise methods. Threat actors are exploiting the decentralized and often less-monitored nature of Web3 platforms to host malicious payloads or command-and-control infrastructure. These attacks are designed to breach enterprise cloud environments by compromising dependencies and open-source packages. The research highlights a growing trend of sophisticated attackers adapting emerging technologies to evade detection and maintain persistence in cloud systems.
Bekijk origineel advisory →The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. Threat actors are exploiting vulnerabilities in these devices to lock out legitimate administrators, preventing them from regaining access. The attacks are actively targeting organizations using Fortinet products for network perimeter defense. FortiBleed refers to a known vulnerability affecting FortiGate appliances that allows attackers to read sensitive data from memory. The FBI urges affected organizations to patch their systems immediately and review access logs for signs of compromise. Administrators who have been locked out should follow Fortinet's remediation guidance to restore access. The ongoing nature of these attacks suggests a coordinated and persistent threat campaign. Organizations relying on FortiGate VPN solutions are particularly at risk and should prioritize mitigation efforts.
Bekijk origineel advisory →Hackers compromised third-party operators managing country-code top-level domain (ccTLD) registries for Ghana, American Samoa, and Sierra Leone. By gaining unauthorized access, attackers were able to modify authoritative DNS records for Google domains within these ccTLDs. The attackers also obtained unauthorized HTTPS certificates for several Google domains, enabling potential man-in-the-middle attacks. This attack highlights the risks associated with third-party ccTLD registry operators and DNS infrastructure security. The incident demonstrates how compromising upstream DNS authorities can have cascading effects on major platforms like Google. Unauthorized certificate issuance further compounds the severity by undermining trust in HTTPS for affected domains.
Bekijk origineel advisory →Attackers compromised three country-code top-level domain (ccTLD) registries — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) — and obtained unauthorized HTTPS certificates for several Google domains. While Google's own infrastructure was not directly breached, the compromise of these registries put all domains under those ccTLDs at risk. With fraudulent certificates in hand, attackers could impersonate legitimate Google sites over encrypted HTTPS connections, potentially enabling man-in-the-middle attacks or credential theft. The incident highlights the systemic risk posed by weakly secured national domain registries. Google disclosed the issue on October 6, 2026, and the attack represents a significant abuse of the certificate issuance process tied to domain control validation.
Bekijk origineel advisory →Cybersecurity researchers from CloudSEK and Checkmarx have uncovered a long-running npm supply chain malware campaign dubbed MALFEX. A lone threat actor has published 12 malicious npm packages since August 2023, eight of which have been downloaded over 40,767 times. The packages deliver the Overlord RAT and an information stealer to compromised hosts. The campaign represents a sustained effort to abuse the npm ecosystem for malware distribution. The malicious packages masquerade as legitimate ones to trick developers into installing them. Once installed, they establish remote access and exfiltrate sensitive information from victim systems.
Bekijk origineel advisory →SonicWall has released hotfixes addressing four vulnerabilities in its SMA1000 appliances, which are used to provide remote workers access to corporate networks and applications. The most critical flaw has been rated CVSS 10.0, the highest possible severity score. This vulnerability is a Server-Side Request Forgery (SSRF) flaw that can be exploited without authentication, allowing attackers to send requests through the appliance and access internal functions. SonicWall has stated there is no evidence of active exploitation of any of the four vulnerabilities at the time of disclosure. The patches were released as hotfixes, indicating urgency in remediation. Organizations using SMA1000 appliances are strongly advised to apply the hotfixes immediately given the critical nature of the vulnerability.
Bekijk origineel advisory →Socket Threat Research identified a coordinated campaign of 16 malicious Firefox extensions targeting cryptocurrency wallet users, specifically impersonating Rabby Wallet and OKX Wallet. The extensions intercept recovery phrases and private keys during wallet import flows and exfiltrate them to attacker-controlled Cloudflare Workers. Four extensions clone Rabby Wallet under the misspelled brand 'Raabby WaIIet', while twelve clone OKX Wallet under a 'Portal WALLET' facade. All extensions share a common campaign marker 'EQOx7EIPZSNi' and primarily use the same Cloudflare Worker infrastructure at 'icy-star-f45c.workers.dev'. The campaign uses multiple exfiltration transports including GET requests, POST JSON, sendBeacon, and image-pixel fallbacks. Mozilla unpublished all 16 extensions as of October 5th. This campaign is assessed with high confidence to be a continuation of a crypto-theft extension campaign Socket previously identified in August 2026. Affected users should treat exposed wallets as fully compromised and immediately migrate assets to new wallets.
Bekijk origineel advisory →A critical unpatched vulnerability has been discovered in LMCache, an open-source caching layer designed to accelerate large language model (LLM) servers like vLLM. The flaw resides in LMCache's multiprocess mode, where the cache operates as a standalone server communicating with LLM workers via the ZeroMQ messaging library. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the cache server without any credentials. No fixed version is currently available, leaving all users of the affected component exposed. The vulnerability is particularly concerning given the growing adoption of LLM infrastructure in enterprise and cloud environments. The use of ZeroMQ without proper authentication mechanisms appears to be the root cause of the issue. Organizations running LMCache in multiprocess mode are advised to isolate the service from untrusted networks as a temporary mitigation.
Bekijk origineel advisory →A new malware family named PoeLLM has been identified targeting exposed AI and large language model (LLM) infrastructure. The financially motivated campaign, dubbed Canto Incognito, has compromised over 3,400 servers. The malware deploys cryptocurrency miners and expands a botnet by leveraging vulnerable AI/LLM endpoints. Cybersecurity researchers are raising alarms about the scale and sophistication of the operation. The campaign highlights growing risks to AI infrastructure as it becomes an increasingly attractive attack surface for threat actors seeking computational resources for crypto mining.
Bekijk origineel advisory →