Overzicht van binnengekomen advisories.
2014 resultaten gevonden
The JadePuffer ransomware operator is conducting agentic AI-driven attacks specifically targeting Microsoft Azure tenants. The attacks leverage autonomous AI agents to perform multi-stage intrusions including reconnaissance, credential theft, and destruction of core cloud infrastructure components. This represents a novel use of agentic AI in ransomware operations, combining automation with intelligent decision-making to maximize impact. The campaign poses a significant threat to organizations relying on Azure cloud services, as attackers can rapidly move through environments and cause irreversible damage to cloud resources. The use of AI-driven agents marks an evolution in ransomware tactics, potentially enabling faster and more effective attacks at scale.
Bekijk origineel advisory →Unit 42 has identified active zero-day exploitation targeting NetScaler devices, attributed to two vulnerabilities reported by Citrix: CVE-2026-88771 and CVE-2026-88772. Both vulnerabilities have been confirmed as exploited in the wild. The threat brief was published by Palo Alto Networks' Unit 42 threat intelligence team. NetScaler (formerly Citrix ADC/Gateway) is a widely deployed network infrastructure product, making this a high-severity concern for enterprise environments. Organizations using NetScaler devices are advised to monitor for indicators of compromise and apply any available patches or mitigations immediately. The active exploitation status elevates the urgency for defenders to respond quickly.
Bekijk origineel advisory →This weekly cybersecurity recap covers multiple high-impact threats including a $387M cryptocurrency hack, active exploitation of Citrix vulnerabilities, and AI agents behaving unexpectedly. A notable incident involved a domain used as placeholder text appearing in ~1,700 repositories that was later registered and weaponized to serve malicious content. Additional threats include weak service accounts, unpatched legacy bugs, exposed systems, phishing kits, and easy exploit paths being leveraged by attackers. The recap highlights how forgotten or overlooked assumptions can quickly become active attack surfaces. The article underscores a broad and diverse threat landscape for the week.
Bekijk origineel advisory →A new botnet malware called Carbonato has been discovered targeting exposed Docker daemons to deploy an open-source AI agent framework called Hermes Agent. The malware installs the framework and overwrites its SOUL.md persona file with a custom 39-line prompt. The compromised hosts are then controlled via Telegram, enabling attackers to issue commands through the messaging platform. This represents a novel attack vector combining botnet infrastructure with AI agent frameworks for malicious purposes. The campaign highlights the growing risk of exposed Docker APIs and the emerging trend of threat actors leveraging AI tooling in their operations.
Bekijk origineel advisory →Cryptocurrency exchange Bitget suffered a major security breach attributed to suspected North Korean hackers, resulting in the theft of over $350-387.5 million in cryptocurrency. The exchange suspended Bitcoin withdrawals following the incident and has since resumed them. The attack is part of a broader pattern of North Korean state-sponsored threat actors targeting cryptocurrency platforms to fund regime operations. The breach highlights ongoing risks to centralized crypto exchanges from sophisticated nation-state actors. Bitget has taken steps to restore operations and secure its systems following the incident.
Bekijk origineel advisory →The threat actor JADEPUFFER, tracked by Microsoft as Storm-3168, conducted destructive operations within a Microsoft Azure environment using compromised service principals. The attack occurred in early June 2026 over approximately 18 hours. This activity represents an evolution in the threat actor's tradecraft, leveraging legitimate Azure service principals to carry out destructive actions. The compromise of service principals allowed the attackers to operate with elevated privileges within the Azure environment. The incident highlights risks associated with identity and access management in cloud environments, particularly the abuse of service principals for malicious purposes.
Bekijk origineel advisory →CISA has issued an emergency directive ordering U.S. federal agencies to patch two critical vulnerabilities in Citrix NetScaler products. The directive was issued over the weekend, requiring agencies to secure their systems by Wednesday. The vulnerabilities are being actively exploited in the wild, prompting the urgent response from CISA. Citrix NetScaler is widely used across government and enterprise environments for networking and application delivery. The order reflects CISA's authority under Binding Operational Directive 22-01 to compel federal civilian agencies to remediate known exploited vulnerabilities. Failure to patch these flaws could expose government systems to significant compromise. The tight deadline underscores the severity and active exploitation status of these vulnerabilities.
Bekijk origineel advisory →Citrix has patched 8 vulnerabilities in NetScaler ADC and NetScaler Gateway affecting versions 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, including FIPS variants. Three vulnerabilities are rated critical: CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution via insufficient input validation affecting all deployments; CVE-2026-88772 (CVSS 9.5) is a memory overflow enabling RCE or DoS when DTLS is enabled (on by default for VPN); CVE-2026-88773 (CVSS 9.3) enables HTTP Request Smuggling without authentication. Five additional high-severity vulnerabilities (CVSS 7.0-8.8) cover policy bypass, memory overflows, and predictable TCP ISNs. Citrix has confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772 in the wild. The advisory applies only to customer-managed deployments; Citrix-managed cloud services are updated separately. Secure Private Access Hybrid deployments using NetScaler instances are also affected.
Bekijk origineel advisory →Citrix has confirmed two critical remote code execution zero-day vulnerabilities in NetScaler, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited in attacks. The company has released security updates to address both flaws. Administrators are urged to apply patches immediately or shut down vulnerable NetScaler instances to prevent compromise. The vulnerabilities are classified as critical severity, indicating they can be exploited without authentication or with minimal user interaction. Active exploitation in the wild significantly raises the risk for organizations running unpatched NetScaler deployments. NetScaler is widely used for application delivery and VPN access in enterprise environments, making it a high-value target for threat actors. Citrix has advised immediate remediation steps to protect affected systems.
Bekijk origineel advisory →Two unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances have been identified and are being actively exploited in the wild. The flaws allow remote code execution (RCE) and were disclosed by security firm watchTowr on September 26, 2026. Citrix has not yet confirmed the vulnerabilities or released any patches. In response to the active exploitation and lack of vendor guidance, some administrators have chosen to take their affected appliances offline. The situation represents a critical risk for organizations relying on these network appliances for application delivery and secure remote access. No CVE identifiers have been assigned yet based on available information.
Bekijk origineel advisory →Citrix NetScaler ADC and NetScaler Gateway contain a critical improper input validation vulnerability (CVE-2026-88771) that allows unauthenticated attackers to execute arbitrary commands. The vulnerability is part of a broader set of CVEs (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler products. CISA has issued guidance requiring affected organizations to conduct forensic triage per BOD 26-04. Organizations are advised to run provided IOCs in the NetScaler console to identify indicators of exploitation. Citrix has published mitigation guidance and security bulletins addressing the vulnerability. The issue is considered high severity given its unauthenticated remote code execution potential. Customers must follow both Citrix's published guidance and CISA's BOD 26-04 directives for remediation and forensic triage.
Bekijk origineel advisory →Citrix NetScaler ADC and NetScaler Gateway contain a critical memory buffer bounds restriction vulnerability (CVE-2026-88772) that could allow remote code execution or denial of service. The vulnerability is tracked by CISA and is part of a broader set of CVEs (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler products. Organizations are directed to run provided IOCs in the NetScaler console to identify indicators of exploitation. Customers must conduct forensic triage as mandated by BOD 26-04 and follow Citrix's published mitigation guidance. CISA has assigned a high criticality rating to this vulnerability given its potential for remote code execution. Multiple remediation and forensic resources have been published by both Citrix and CISA to assist affected organizations.
Bekijk origineel advisory →The ShinyHunters extortion group is actively exploiting Oracle PeopleSoft systems using a URL-encoding technique to bypass web application firewall (WAF) protections. The bypass circumvents mitigations for CVE-2026-35273, allowing attackers to resume widespread exploitation of vulnerable servers. This technique enables the threat actors to evade defensive controls that organizations may have deployed as a temporary fix while awaiting patching. The campaign highlights the risk of relying solely on WAF rules as a compensating control for known vulnerabilities. Organizations running Oracle PeopleSoft are urged to apply official patches immediately rather than depending on WAF-based mitigations. ShinyHunters is a well-known financially motivated threat actor with a history of large-scale data theft and extortion operations.
Bekijk origineel advisory →Lunex is a malware-as-a-service (MaaS) platform that distributes a component called Psychedelic Stealer through compromised Ukrainian websites. The attack uses ClickFix-style fake Cloudflare CAPTCHA verification pages to trick Ukrainian-speaking users into executing malware. Researchers at Ontinue identified a four-stage attack chain beginning with the fake CAPTCHA page. The malware abuses an AMD driver to disable security monitoring tools, allowing it to operate undetected. Once active, Lunex Stealer harvests browser credentials and other sensitive data. The campaign specifically targets Ukrainian-speaking users, suggesting a geopolitical motivation. The use of legitimate driver abuse (BYOVD technique) indicates a technically sophisticated threat actor. The MaaS model suggests the tooling is available to multiple threat actors beyond the original developers.
Bekijk origineel advisory →Two third-party GitHub Actions that were previously compromised as part of the Mini Shai-Hulud supply chain campaign were re-enabled by their maintainers despite still containing malicious code. The compromised Actions remained publicly accessible for over a week, exposing any repositories or CI/CD pipelines that referenced them to potential malicious payloads. This incident highlights the risk of supply chain attacks targeting GitHub Actions workflows. The re-enablement of the compromised Actions without remediation suggests a lack of awareness or verification by the maintainers. The Shai-Hulud campaign represents a broader threat to the software supply chain ecosystem, particularly targeting automated build and deployment pipelines.
Bekijk origineel advisory →Google has issued a warning about mass exploitation of CVE-2026-35273, a critical vulnerability (CVSS 9.8) in Oracle PeopleSoft. The flaw allows unauthenticated remote code execution and is being actively weaponized by threat actors linked to ShinyHunters. Attackers are bypassing Web Application Firewalls (WAFs) to exploit the vulnerability and deploy web shells on compromised systems. The campaign targets multiple sectors globally and the vulnerability was initially exploited as a zero-day. The activity represents a significant threat to organizations using Oracle PeopleSoft across various industries.
Bekijk origineel advisory →A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been discovered in the Elementor Website Builder WordPress plugin. The flaw carries a CVSS score of 8.8 out of 10.0 and allows unauthenticated attackers to create rogue administrator accounts and take full control of affected websites. Exploitation requires an admin user to click a specially crafted link. No CVE identifier has been assigned yet at the time of publication. The vulnerability affects specific versions of the plugin, though full version details were not included in the available content. Given the widespread use of Elementor across millions of WordPress sites, the potential impact is significant. Site administrators are advised to monitor for patches and apply updates promptly.
Bekijk origineel advisory →WordPress Core contains a remote file inclusion vulnerability tracked as CVE-2026-87902. An unauthenticated attacker can exploit this flaw to manipulate page-template resolution, forcing it to include arbitrary readable local PHP files outside the active theme directories. This can lead to remote code execution without requiring authentication. The vulnerability has been documented in a GitHub Security Advisory (GHSA-7hp8-65ch-5whp) and listed in the NVD. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under the BOD 26-04 implementation guidance. The current risk level is rated High due to the potential for unauthenticated remote code execution on WordPress installations.
Bekijk origineel advisory →A code injection vulnerability has been identified in Microsoft SharePoint, tracked as CVE-2026-65660. The vulnerability allows an authorized attacker to execute arbitrary code over a network. It has been listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which prioritizes security updates based on risk. Microsoft has published guidance through its Security Response Center. CISA has also published forensic triage requirements as part of BOD 26-04 implementation guidance. The vulnerability is rated High criticality. Organizations using Microsoft SharePoint are advised to apply available security updates promptly. The vulnerability is also tracked in the NVD database.
Bekijk origineel advisory →CVE-2026-67279 is a vulnerability in Mikrotik RouterOS involving improper enforcement of behavioral workflow. It allows an unauthenticated client to open a session channel and send an exec request without authentication. This vulnerability can be chained with CVE-2026-86060 to achieve full unauthenticated exploitation of affected devices. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements are also outlined under the BOD 26-04 implementation guidance. Mikrotik has published a security advisory for September 2026 addressing this issue. The vulnerability is tracked in the NVD under CVE-2026-67279. The current risk level is assessed as High, indicating active concern and urgency for patching.
Bekijk origineel advisory →