Overzicht van binnengekomen advisories.
2014 resultaten gevonden
The FBI has removed an Accenture contractor following their alleged role in a ShinyHunters-linked data breach that resulted in the theft of personal information belonging to thousands of FBI employees. The incident was reported by Reuters, citing two sources familiar with the matter. The breach was attributed to a security failure, reportedly stemming from a patch not being applied in a timely manner. ShinyHunters is a well-known threat actor group responsible for numerous high-profile data breaches. The removal of the contractor signals accountability measures taken by the FBI in response to the incident. The full scope of the breach and the specific data compromised have not been fully disclosed in the article excerpt.
Bekijk origineel advisory →Unauthorized parties accessed the names, addresses, and personal identification numbers (CPR numbers) of approximately 8.8 million people in Denmark's Central Person Register (CPR), including both living and deceased individuals. The breach was disclosed by Denmark's digitalization ministry on October 5, 2026. The attackers exploited a private Danish company's lawful access rights to the CPR system to retrieve the data. This represents a near-complete exposure of Denmark's entire population data. The ministry has issued guidance advising people on precautionary measures. The incident raises serious concerns about third-party access controls to sensitive national identity databases. No technical vulnerability per se was exploited; rather, legitimate access credentials or permissions of a private company were abused.
Bekijk origineel advisory →A new variant of the ClickFix attack technique has been identified, where compromised websites pre-fetch malicious script payloads into the browser cache, disguised as PNG files. Unlike traditional ClickFix attacks that download and execute remote payloads, this method leverages the browser cache to bypass Windows execution restrictions. The technique tricks users into executing the cached malicious payload. The attack was reported by Microsoft Threat Intelligence team. This represents an evolution in the ClickFix attack pattern, making detection and prevention more challenging by abusing legitimate browser caching mechanisms.
Bekijk origineel advisory →Hackers are actively scanning for a critical vulnerability in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500. The flaw involves a weak signing key that enables session forgery, account takeover, and remote code execution (RCE). Active scanning indicates threat actors are probing for vulnerable instances in the wild. Rejetto HFS is a widely used file-sharing server, making this vulnerability particularly impactful. Organizations running HFS servers are urged to patch or mitigate immediately given the active exploitation risk.
Bekijk origineel advisory →Microsoft has released out-of-band security updates to address a high-severity vulnerability in Microsoft Exchange Server tracked as CVE-2026-96940. The flaw carries a CVSS score of 8.8 and stems from weak authorization controls within Exchange Server. An authenticated attacker can exploit this vulnerability to escalate privileges and potentially read other users' mailboxes. The out-of-band nature of the patch release indicates urgency on Microsoft's part. The vulnerability poses a significant risk in enterprise environments where Exchange Server is widely deployed for email communication.
Bekijk origineel advisory →Denmark's Central Population Register (CPR) has suffered a data breach exposing personal information of approximately 8.8 million registered individuals. The breach affects virtually the entire Danish population, making it a significant national-scale incident. The CPR is a critical government registry containing sensitive personal data on all residents of Denmark. Authorities are warning affected individuals and investigating the scope of the exposure. The incident highlights the risks associated with centralized government databases holding sensitive population-level data. No specific threat actor or attack vector has been detailed in the available content.
Bekijk origineel advisory →Dell has issued a warning to customers about a critical vulnerability in the Dell System Update (DSU) command-line interface (CLI) deployment tool. The flaw allows attackers to gain root privileges on affected systems. Dell is urging customers to apply patches as soon as possible to mitigate the risk. The vulnerability is considered critical due to the potential for full system compromise. DSU is a widely used tool for managing firmware and driver updates on Dell hardware. Exploitation of this flaw could allow an attacker to take complete control of the affected system. No specific CVE identifier was mentioned in the available content, but the severity warrants immediate attention.
Bekijk origineel advisory →South Korea's Financial Services Commission (FSC) convened an emergency meeting in response to a series of cyberattacks targeting the country's financial institutions. The attacks are suspected to be powered by artificial intelligence, raising concerns about the evolving sophistication of threats against the banking sector. The FSC is actively investigating the breaches to determine the scope, origin, and methods used. This incident highlights growing risks posed by AI-enhanced attack techniques against critical financial infrastructure. The probe reflects heightened regulatory and government attention to cybersecurity resilience in South Korea's banking system.
Bekijk origineel advisory →This weekly cybersecurity recap covers multiple high-impact threats including actively exploited zero-day vulnerabilities in NetScaler and FortiMail products. The article highlights AI coding-related data leaks, the resurgence of Spectre v2 side-channel attacks, and recent ransomware-related arrests. Attackers are leveraging small overlooked exposures such as public repositories, blank fields, and exposed services to gain footholds. The piece notes that intrusion paths are becoming cleaner and automation more sophisticated. A significant patch backlog is mentioned, suggesting widespread unpatched systems remain at risk. The overall theme is that seemingly minor misconfigurations and oversights are being weaponized at scale.
Bekijk origineel advisory →On October 5, 2026, StepSecurity discovered that the npm package @subql/common version 5.8.3 was compromised with a malicious hidden payload. The payload is activated both during package installation and when the package is imported, making it particularly dangerous. The malicious code is designed to steal credentials from developer workstations and CI/CD environments. It specifically targets GitHub Actions runners and accessible cloud services. The attack represents a supply chain compromise affecting the SubQuery ecosystem. Remote shell access capabilities were also embedded in the package, allowing attackers persistent backdoor access. The attack vector is consistent with software supply chain attacks targeting developer tooling.
Bekijk origineel advisory →A critical vulnerability tracked as CVE-2026-61500 (CVSS 9.3) has been discovered in Rejetto HTTP File Server (HFS). The flaw stems from the use of a weak pseudo-random number generator (PRNG) that produces predictable session keys, enabling attackers to forge admin sessions. Successful exploitation can lead to unauthorized administrative access and remote code execution (RCE). Active exploitation attempts have been observed in the wild, as reported by VulnCheck. The vulnerability is classified as a session forgery issue, making it particularly dangerous for organizations hosting files via Rejetto HFS. Users are urged to patch or mitigate the flaw immediately given the active exploitation and high CVSS score.
Bekijk origineel advisory →Citrix has released security updates addressing a high-severity vulnerability, CVE-2026-88779, affecting NetScaler ADC and Citrix NetScaler Gateway. The flaw is a memory overflow vulnerability with a CVSS score of 8.7 out of 10. It has been actively exploited in targeted zero-day attacks. The vulnerability can disrupt SAML-based authentication deployments, potentially knocking them offline. Organizations using NetScaler ADC or Gateway with SAML configurations are at elevated risk. Citrix urges immediate patching to mitigate exploitation risk.
Bekijk origineel advisory →Citrix has released emergency security updates addressing a new denial-of-service vulnerability in NetScaler, tracked as CVE-2026-88779. The vulnerability has been actively exploited in zero-day attacks. Researchers are also investigating whether the flaw can be leveraged for remote code execution beyond denial-of-service. The patch was issued on an emergency basis given the active exploitation. Organizations using NetScaler are urged to apply the updates immediately to mitigate risk.
Bekijk origineel advisory →A China-nexus cyber espionage group designated TA419 has been linked to multiple credential phishing campaigns targeting AI experts at U.S. think tanks, universities, and legal organizations. The group employs Adversary-in-the-Middle (AitM) phishing techniques against Microsoft accounts to steal credentials. TA419 has impersonated prominent economists, AI policymakers, and at least one Anthropic employee to lure victims. The primary targets appear to be individuals working on AI policy in the United States. The campaigns represent a focused intelligence-gathering effort by a state-aligned threat actor against the U.S. AI research and policy community. The use of AitM phishing allows the attackers to bypass multi-factor authentication mechanisms. This activity highlights growing Chinese interest in U.S. AI policy development and strategic research.
Bekijk origineel advisory →CVE-2026-88779 affects Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). The vulnerability involves an improper restriction of operations within the bounds of a memory buffer, which could allow an attacker to cause a denial of service condition. The issue has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Citrix has published security advisories and knowledge base articles detailing the vulnerability and remediation steps. Organizations using affected Citrix NetScaler products are urged to apply patches promptly. The vulnerability has been assigned a high criticality rating. CISA has also outlined forensic triage requirements as part of the BOD 26-04 implementation guidance. The NVD entry provides additional technical details on the vulnerability.
Bekijk origineel advisory →A suspected China-linked threat actor known as Warlock is actively exploiting Microsoft SharePoint vulnerabilities to target organizations in Portuguese- and Spanish-speaking countries. The campaign has been observed by Symantec and Carbon Black Threat Hunter Team. Targeted sectors include critical infrastructure, government, and education. The actor is leveraging both old and new SharePoint flaws. The attacks involve disabling security tools as part of the intrusion chain before deploying ransomware. The campaign represents a continued and ongoing threat rather than a one-time incident.
Bekijk origineel advisory →The China-linked ransomware group Warlock has conducted targeted attacks against critical infrastructure and public sector organizations, including a water utility, a telecom provider, a regional government body, and a university. The group exploited vulnerabilities in Microsoft SharePoint to gain initial access to victim networks. The campaign demonstrates a pattern of targeting critical infrastructure sectors with sophisticated ransomware attacks. The attacks highlight the ongoing threat posed by state-linked ransomware groups against essential services. Exploitation of SharePoint vulnerabilities as an initial access vector represents a significant risk for organizations relying on the platform.
Bekijk origineel advisory →A critical vulnerability (CVSS 9.9) was discovered in GitLab's AI Gateway, which serves as the connector between GitLab instances and AI models. The flaw allows a logged-in user with Duo Agent Platform access to execute arbitrary commands on the gateway under certain conditions. Only organizations self-hosting their own AI Gateway are affected; GitLab-hosted instances are not impacted. GitLab has released patches in gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the vulnerability. Affected organizations are urged to update immediately to mitigate the risk of unauthorized command execution on their infrastructure.
Bekijk origineel advisory →A China-nexus threat actor has been conducting an espionage campaign targeting government and policy organizations across multiple Asian countries including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. The campaign involves the deployment of a previously undocumented backdoor named Antino. The threat actor leverages Microsoft Outlook and OneDrive as command-and-control (C2) infrastructure, a technique that helps blend malicious traffic with legitimate cloud service communications. Cisco Talos is tracking this activity cluster. The use of trusted cloud services for C2 makes detection more challenging for defenders. The campaign is focused on intelligence gathering from government and policy-related targets, consistent with state-sponsored espionage objectives.
Bekijk origineel advisory →Dell has released security updates addressing multiple critical vulnerabilities in Dell Container Storage Modules (CSM). The most severe flaw, CVE-2026-63688, carries a CVSS score of 10.0 and involves a missing authentication vulnerability in the csm-authorization-storage gRPC server. These vulnerabilities could allow unauthenticated attackers to gain administrative access and achieve root-level privileges on Kubernetes nodes. The flaws represent a significant risk to organizations using Dell CSM in containerized environments. Dell has urged users to apply the security patches immediately to mitigate potential exploitation.
Bekijk origineel advisory →