Overzicht van binnengekomen advisories.
2014 resultaten gevonden
CVE-2026-71362 is an incorrect authorization vulnerability affecting Adobe Commerce and Magento platforms. The flaw allows attackers to gain elevated access to sensitive resources without requiring any user interaction, making it particularly dangerous. The vulnerability has been catalogued by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Adobe has published an official security advisory (APSB26-92) with remediation guidance. The issue is also tracked in the NVD. CISA has provided forensic triage requirements as part of implementation guidance for the BOD 26-04 directive. The vulnerability is rated High severity. Organizations using Adobe Commerce or Magento are urged to apply security updates promptly to mitigate the risk of unauthorized privilege escalation.
Bekijk origineel advisory →A path traversal vulnerability has been identified in multiple WSO2 products including API Control Plane, API Manager, Traffic Manager, and Universal Gateway. The vulnerability could allow attackers to perform unrestricted file uploads, which may lead to remote code execution. It has been catalogued as CVE-2026-5430 and is listed in CISA's Known Exploited Vulnerabilities. CISA's Binding Operational Directive BOD 26-04 mandates prioritizing security updates based on risk. WSO2 has published a security advisory with remediation guidance. Organizations using affected WSO2 products are urged to apply patches immediately. The vulnerability is rated High severity given its potential for full system compromise via RCE.
Bekijk origineel advisory →Socket's Threat Research team discovered a malicious Firefox extension named 'pdf-para-texto@extensao.local', posing as a PDF identity verification tool. Published September 3, 2026, the extension ships with no hardcoded malicious code, evading static analysis and store reviewers. After installation, it fetches a remote payload from attacker-controlled infrastructure (pdf[.]gusercontent[.]com) and arms itself with a configuration object enabling full Google account takeover. The extension injects scripts into real accounts.google.com pages, steals Google oauth_token session cookies via webRequest interception, and can silently change the victim's Google account password. It uses FedCM API calls to identify victims, streams live session telemetry to the attacker every 500ms, and targets Portuguese- and Spanish-speaking users. The campaign's significance lies in its sophisticated detection-evasion architecture rather than its current scale, which remains limited.
Bekijk origineel advisory →A new Android malware-as-a-service (MaaS) platform named RemControl has been identified targeting users in Europe and Canada. The malware is distributed through malvertising campaigns that impersonate the TVTap IPTV application. RemControl operates as a MaaS offering, suggesting it is available for use by multiple threat actors. The campaign focuses on banking-related fraud, likely harvesting credentials or performing unauthorized financial transactions. The use of a legitimate-looking IPTV app as a lure increases the likelihood of successful infections. The geographic targeting of Europe and Canada suggests a focused operation on regions with high banking digitization. Users are advised to avoid downloading apps from unofficial sources and to verify app authenticity before installation.
Bekijk origineel advisory →Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability affecting the VPN certificate-handling functionality in its Security Gateway product. The flaw allows unauthenticated attackers to execute arbitrary code remotely, making it particularly dangerous. Active exploitation in the wild has been observed, prompting Check Point to issue an urgent warning to its customers. Organizations using Check Point Security Gateway with VPN functionality are advised to apply patches or mitigations immediately. The vulnerability's pre-authentication nature significantly raises its severity and exploitation risk.
Bekijk origineel advisory →Threat actors have escalated from probing to actively exploiting CVE-2026-87902, a critical vulnerability in WordPress. The flaw allows attackers to write files to disk that execute shell commands when accessed, effectively enabling remote code execution. The exploitation represents a significant threat to WordPress site owners worldwide. Security researchers have observed a clear progression from reconnaissance activity to active exploitation. Site administrators are urged to patch immediately to prevent unauthorized code execution and potential full site compromise.
Bekijk origineel advisory →Cybersecurity researchers have uncovered Go-based malware distributed through malicious Terraform providers and Go modules hosted on the HashiCorp registry. This marks the first known instance of threat actors leveraging the HashiCorp centralized repository as a distribution vector for malicious payloads. The identified malicious packages include 'gocommunity-io/dockerd' and 'kreuzwenker/' among others. The attack represents a novel supply chain threat targeting developers and infrastructure-as-code workflows. The malware was written in Go, consistent with a growing trend of attackers using Go for cross-platform malicious tooling. The use of a trusted, widely-used registry like HashiCorp's increases the likelihood of successful compromise. Developers and DevOps teams using Terraform are advised to audit their provider dependencies immediately.
Bekijk origineel advisory →GitLab provides each user a private email address for filing issues by email, but this address functions as a credential. If this address is leaked or discovered by a malicious actor, they can send emails that GitLab will commit as code patches in the victim's name to any branch the victim has push access to, including main/master branches. Additionally, attackers can trigger CI/CD pipeline jobs that execute under the victim's identity and permissions. The vulnerability stems from the fact that GitLab trusts the destination email address as sufficient authentication for performing sensitive repository operations. This represents a significant privilege escalation and identity impersonation risk within GitLab-hosted projects. The feature, labeled 'Email work item to this project,' is intended for convenience but inadvertently exposes users to serious security risks if the address is exposed in logs, forwarded emails, or other leakage vectors.
Bekijk origineel advisory →A financially motivated threat actor is leveraging open-source AI agent frameworks to conduct large-scale attacks against online retailers. The campaign has successfully compromised more than 100 e-commerce websites, deploying JavaScript credit card skimmers (Magecart-style) across them. Over 600,000 credit card records have been stolen as a result. The use of AI agents marks a significant escalation in automation and scale for skimming operations. This represents an emerging threat vector where AI tooling lowers the barrier and increases the efficiency of cybercriminal campaigns targeting payment data. The attack highlights the dual-use risk of open-source AI frameworks being weaponized for financial cybercrime.
Bekijk origineel advisory →Two MikroTik RouterOS SSH vulnerabilities, CVE-2026-67279 and CVE-2026-86060, have been chained together in an attack technique dubbed MikroTrick by CERT Polska. The exploit allows attackers to gain full administrative control over Internet-exposed MikroTik routers without requiring a password, SSH key, or any completed authentication. CVE-2026-67279 is an SSH state-machine flaw, while CVE-2026-86060 is an argument-injection bug in the RouterOS login process. Attack logs indicate exploitation activity has already been observed in the wild. The combination of these two flaws creates a critical unauthenticated remote compromise vector for a widely deployed networking device.
Bekijk origineel advisory →InfraTrust has released a report warning that attackers are increasingly targeting network management systems used to control enterprise infrastructure. Several critical vulnerabilities in these systems are being actively exploited, in some cases before or shortly after vendors publicly disclosed them. The attacks focus on the management plane of enterprise networks, which represents a high-value target due to the broad access such systems provide. The report highlights a trend of threat actors prioritizing infrastructure control systems as entry points. Organizations relying on these management platforms are urged to apply patches promptly and monitor for signs of compromise.
Bekijk origineel advisory →A security research by Varonis reveals a confused deputy attack vector where a Kubernetes user with limited permissions can escalate privileges to gain control of an entire Google Cloud (GCP) organization. The attack exploits the elevated authority granted to Google Kubernetes Config Connector, a component that bridges Kubernetes and GCP resources. By crafting a single malicious Kubernetes YAML file, an attacker can abuse the Config Connector's permissions to perform organization-wide privilege escalation. The vulnerability represents a significant misconfiguration and design risk in hybrid Kubernetes-GCP environments. Organizations using GCP with Kubernetes Config Connector should review and restrict the permissions granted to this component to minimize blast radius.
Bekijk origineel advisory →Unknown threat actors compromised two legitimate MemTensor packages hosted on npm and PyPI to distribute a Go-based implant called sckit. The malware is designed to steal credentials and targets Windows, Linux, and macOS platforms. The compromised package identified includes @memtensor/memos-cloud-openclaw-plugin. Multiple security firms including Aikido, SafeDep, Socket, and StepSecurity reported on the campaign. This represents a supply chain attack leveraging trusted open-source repositories. The implant is platform-specific and cross-platform in scope, broadening its potential victim pool. The use of legitimate package namespaces increases the likelihood of developer trust and accidental installation.
Bekijk origineel advisory →F5 Networks heeft een kritieke kwetsbaarheid verholpen in BIG-IP Access Policy Manager (APM). De kwetsbaarheid stelt een ongeauthenticeerde aanvaller in staat om op afstand malafide code uit te voeren via kwaadaardig netwerkverkeer. Systemen zijn kwetsbaar wanneer een access policy is geconfigureerd en het systeem fungeert als OAuth Authorisation Server. F5 Networks bevestigt dat het een zeroday-kwetsbaarheid betreft die actief wordt misbruikt in het wild. Organisaties die BIG-IP APM gebruiken als OAuth Authorisation Server worden dringend geadviseerd de patch onmiddellijk toe te passen.
Bekijk origineel advisory →Arista Networks has released security patches addressing a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw is being actively exploited in the wild, making it a high-priority security concern for organizations running on-premises VCO installations. Arista Networks has responded by issuing patches to remediate the vulnerability. The article highlights the urgency of applying these patches given the active exploitation status. No specific CVE identifier was mentioned in the available content snippet. Affected organizations are advised to update their VeloCloud Orchestrator deployments immediately to mitigate potential compromise. This incident underscores the risks associated with network orchestration platforms being targeted by threat actors.
Bekijk origineel advisory →On September 23, 2026, a threat actor compromised MemTensor's MemOS open source AI memory framework by publishing malicious releases on both npm and PyPI registries. Three versions of the npm package @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and one PyPI version of MemoryOS (2.0.34) were affected, with the malicious versions currently tagged as latest. Each compromised package bundles cross-platform Go binaries named 'sckit' built for Linux, macOS, and Windows on x64 and arm64 architectures. The payload searches developer home directories for credentials including npm/PyPI tokens, GitHub/GitLab tokens, AWS keys, SSH keys, Vault tokens, and various API keys, then exfiltrates them to C2 servers under skyleen[.]fr. The malicious code also appeared in commits to MemTensor's GitHub repositories, suggesting a deeper supply chain compromise potentially targeting the release pipeline itself. The binaries contain strings suggesting potential worm behavior, capable of republishing packages using stolen registry tokens. The npm plugin additionally exfiltrates user prompt text on every memory recall operation.
Bekijk origineel advisory →A critical zero-day vulnerability (CVE-2026-94127) has been discovered in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw specifically affects BIG-IP systems configured with APM acting as an OAuth authorization server. Attackers are actively exploiting this vulnerability in the wild to execute arbitrary code without authentication. F5 disclosed the vulnerability on September 22 and has released engineering hotfixes to address the issue. The vulnerability is limited to environments where APM is issuing access tokens to applications via OAuth. Organizations using BIG-IP APM in OAuth server mode are urged to apply the hotfixes immediately. The active exploitation status and unauthenticated RCE nature make this a critical-priority patch.
Bekijk origineel advisory →A Chinese threat actor identified as UTA0565 has been observed exploiting a chained zero-day exploit involving two Google Chrome vulnerabilities (CVE-2026-85046 and CVE-2026-87491) and one Windows Advanced Local Procedure Call vulnerability (CVE-2026-85880). The attacks were detected on September 3 and 4, 2026, and were delivered through fake websites. The exploit chain was used to deploy malware known as CLEANGULP. The combination of browser and OS-level vulnerabilities allowed attackers to break out of sandboxes and escalate privileges. This represents a sophisticated, multi-stage attack campaign attributed to a Chinese state-linked actor.
Bekijk origineel advisory →Check Point has patched two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8) in Quantum Security Gateway and Security Management products. CVE-2026-85102 involves improper certificate trust validation during VPN negotiation, allowing unauthenticated remote attackers to bypass authentication and execute arbitrary code. CVE-2026-85103 is a heap-based buffer overflow in ASN.1-decoding of VPN certificates, also enabling unauthenticated remote code execution. Both affect Security Gateway and Check Point Spark Firewall when Site-to-Site VPN or Remote Access VPN is enabled. Active exploitation of CVE-2026-85102 has already been observed in the wild. NCSC warns of imminent large-scale exploitation attempts and urges organizations to apply patches immediately. A partial mitigation for Site-to-Site VPN involves disabling implied VPN rules and restricting UDP/500 and UDP/4500 to specific peer IPs.
Bekijk origineel advisory →D-Link has issued a warning about a maximum-severity zero-day vulnerability tracked as CVE-2026-86296 affecting its legacy DIR-822A dual-band Wi-Fi routers. The vulnerability has a public proof-of-concept exploit available but no patch has been released. The flaw is classified as maximum severity, making it extremely dangerous for affected users. As a legacy device, the DIR-822A may not receive an official fix, leaving users exposed. D-Link customers are urged to review the advisory and consider replacing or isolating affected devices. The existence of public PoC exploit code significantly raises the risk of active exploitation in the wild.
Bekijk origineel advisory →