Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Elastic Security Labs analyzed CVE-2026-73570, a command injection vulnerability in Zimbra that can be exploited to achieve remote code execution. Researchers reproduced the vulnerability and discovered that several publicly available proof-of-concept (PoC) exploits are flawed, writing payloads that Swatchdog never matches. This means a failed exploit attempt may incorrectly appear as though the server is patched, leading to false confidence in security posture. The attack vector involves the manipulation of Zimbra log files, which are processed by Swatchdog, a log monitoring utility. The article provides technical detail on how the exploit chain works and highlights the pitfalls in existing public PoCs. Organizations running Zimbra should treat this as a high-severity issue requiring immediate patching and validation.
Bekijk origineel advisory →Japanese gaming company Capcom has confirmed a data breach affecting its CAPCOM ID membership service. The breach exposed over 11.7 million customer email addresses along with associated personal information. The incident involved unauthorized access by hackers to Capcom's membership platform. This is a significant breach given the large number of affected users. The breach impacts customers who had registered accounts with CAPCOM ID. Capcom has publicly disclosed the incident following investigation. The exposed data includes at minimum email addresses and potentially other account-related information. This breach raises concerns about the security of gaming platform user data.
Bekijk origineel advisory →eMudhra's emSign intermediate Certificate Authority keys were compromised, putting Python package downloads and CI/CD pipelines at significant risk. The compromise affects tools like pip and uv that rely on certificate trust chains for secure dependency downloads. Users of Python virtual environments and CI/CD images that bundle affected certificates need to take immediate action. The article provides details on which tools and environments are affected, along with verified certificate-trust test results. Remediation steps are provided for pip, uv, virtual environments, and CI/CD images to remove or distrust the compromised certificates. This is a supply chain security issue with broad implications for Python developers and DevOps engineers worldwide.
Bekijk origineel advisory →Hackers compromised the LiteLLM project's release pipeline, resulting in the publication of malicious PyPI packages and Docker images. The malicious payload was designed to steal credentials, secrets, and environment variables from affected systems. LiteLLM is a popular open-source library used to interact with large language model APIs, making this a significant supply chain attack targeting AI/ML developers. The attack involved tampering with the CI/CD pipeline to inject malicious code into legitimate release artifacts. Victims who installed the compromised package or pulled the malicious Docker images would have had sensitive data exfiltrated. This incident highlights the growing risk of supply chain attacks targeting AI tooling ecosystems.
Bekijk origineel advisory →Arista has issued an advisory warning of an actively exploited zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO), the central management platform for VeloCloud SD-WAN networks. The flaw allows any authenticated user, even those with read-only customer accounts, to escalate privileges to operator level, the highest control tier. The advisory was published on October 22. No CVE identifier is mentioned in the available content. The vulnerability poses significant risk to organizations relying on VeloCloud SD-WAN infrastructure for network management. Active exploitation has been confirmed, making this a critical and urgent issue for affected deployments.
Bekijk origineel advisory →This weekly cybersecurity roundup covers a wide range of critical security incidents and vulnerabilities. Highlights include critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. Additional issues include AI secrets leakage, source code theft targeting PingCAP, a Signal application hang-up flaw, and a Laravel authentication bypass vulnerability. The article also references stolen passwords and other exposed credentials. In total, the roundup covers 25 or more distinct cybersecurity threats and incidents from the week, spanning multiple platforms, services, and vulnerability types.
Bekijk origineel advisory →Arista Networks has released security updates to address an actively exploited zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. The vulnerability is being exploited in the wild, making it a high-priority patching concern for organizations running on-premises VCO installations. Arista has responded by issuing patches to mitigate the risk. The article highlights the urgency for administrators to apply the updates immediately given the active exploitation. VeloCloud Orchestrator is a network management platform used in SD-WAN environments, making this a significant concern for enterprise network infrastructure.
Bekijk origineel advisory →Eight eMudhra intermediate Certificate Authority (CA) private keys were found to be compromised, posing significant risks to TLS certificate integrity. The compromise enables threat actors to perform unauthorized TLS certificate signing and man-in-the-middle (MitM) interception attacks. eMudhra is a licensed Certifying Authority, making this a high-impact PKI trust chain issue. Unit 42 published an analysis of the compromise along with a containment guide for affected organizations. The exposure of intermediate CA private keys can allow attackers to impersonate any domain covered under the affected CA hierarchy. This type of compromise undermines the foundational trust model of HTTPS and certificate-based authentication. Organizations relying on eMudhra-issued certificates are advised to review and revoke affected certificates immediately.
Bekijk origineel advisory →Two remote code execution vulnerabilities in Linux's built-in SMB server (KSMBD) have been publicly disclosed on mailing lists before mainline kernel patches are available. Both flaws carry a CVSS score of 9.0 and were reported by Trend Micro's Zero Day Initiative. ZDI-CAN-33774 is particularly dangerous as it can be triggered pre-authentication over the network. ZDI-CAN-33549 requires SMB Direct transport and an RDMA-capable network interface. Linux servers with KSMBD enabled are currently exposed with no official fix in the mainline kernel. The public disclosure before patching increases the risk of exploitation by threat actors.
Bekijk origineel advisory →INTERPOL announced the results of Operation Serengeti III, a coordinated global law enforcement action conducted between June 29 and August 31, 2026. The operation successfully disrupted 10,909 malicious cybercrime networks and recovered more than $105 million in illicit funds. Law enforcement agencies from 21 countries participated in the crackdown, resulting in the arrest of 1,462 suspects. This represents the third iteration of the Serengeti operation, reflecting ongoing international cooperation against cybercrime. The scale of disruptions and arrests underscores the growing effectiveness of multinational law enforcement collaboration in combating cyber threats.
Bekijk origineel advisory →Amazon Threat Intelligence researchers discovered that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were made available. The exploitation predates the official patch release, indicating a zero-day or near-zero-day attack window. Amazon was involved in tracking and reporting this threat activity. The article highlights the risk of pre-patch exploitation, where threat actors may have had prior knowledge of the vulnerabilities. This type of activity underscores the importance of rapid patch deployment and proactive threat monitoring. The PHP2Shell flaws were patched on a Wednesday, meaning exploitation began the preceding Saturday. The early exploitation window could have allowed attackers significant time to compromise systems before defenders had any mitigation available.
Bekijk origineel advisory →Wiz Research is tracking a threat actor overlapping with Storm-0940 that uses an AI-powered attack tool called ARTEX to target multiple software and IT vendors. The campaign focuses on identity providers and cloud authentication platforms including Okta, Microsoft Entra, and AWS Cognito. ARTEX functions as an AI agent capable of conducting automated attacks against identity and access management systems. The actor has expanded its targeting scope to include software vendors beyond its previously known victims. Forensic artifacts and log evidence were left behind during the intrusions, providing visibility into the attack methodology. This represents a notable escalation in the use of AI-assisted tooling by a state-linked threat actor in enterprise cloud environments.
Bekijk origineel advisory →GitLab has released security patches addressing a maximum-severity vulnerability in its Regular Expression Compiler component. The flaw allows remote attackers to execute arbitrary code on vulnerable GitLab servers without authentication. The vulnerability has been assigned the highest possible severity rating, indicating significant risk to organizations running unpatched GitLab instances. GitLab has urged administrators to apply the patches immediately. The issue affects GitLab's server-side processing and could be exploited remotely, making it a critical threat to DevOps pipelines and source code repositories hosted on GitLab infrastructure.
Bekijk origineel advisory →The litellm 1.107.0 package on PyPI was compromised with malicious code embedded in its wheels and Docker images. The attack introduced a .pth file-based credential stealer that activates on Python startup. An hourly remote code loader was also included, periodically fetching and executing code from litellm.dev. The malware exfiltrates credentials and sensitive data to an attacker-controlled domain. This is a supply chain attack targeting AI/LLM developers using the popular litellm library. The article provides indicators of compromise (IOCs) and remediation guidance for affected users.
Bekijk origineel advisory →Oracle has patched multiple vulnerabilities across several Fusion Middleware products including WebLogic Server, SOA Suite, Data Integrator, Identity Manager, Access Manager, WebCenter Content, Helidon, and HTTP Server. Vulnerabilities include unsafe deserialization, insufficient authentication and access controls, flaws in network protocols (HTTP, HTTP/2, SOAP, T3, IIOP, LDAP), and cryptographic library issues in Bouncy Castle and Jackson-databind. Attackers can exploit these to achieve arbitrary code execution, full system compromise, unauthorized data access, data manipulation, denial-of-service, privilege escalation, cross-site scripting, and spoofing. Exploitation is possible via network access, often without authentication, with some cases requiring user interaction. CVSS scores reach up to 10.0, indicating maximum severity. No proof-of-concept code is currently known, but NCSC anticipates increased scanning and exploitation activity due to the wide deployment of these products.
Bekijk origineel advisory →On October 21, 2026, LiteLLM's release pipeline was compromised, resulting in a malicious version (1.107.0) being pushed to both Docker Hub and PyPI. Threat actors bypassed multiple independent security controls to inject a credential stealer and backdoor into the package. LiteLLM suspects that a GitHub token leaked via AI gateway logs may have been the initial attack vector. The incident occurred around 4:00 a.m. and represents a significant supply chain attack targeting AI/ML tooling infrastructure. Users who downloaded or used the compromised version may have had credentials stolen or systems backdoored.
Bekijk origineel advisory →Node.js released security updates on October 21 addressing 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. The most critical flaw resides in the Brotli decompression code bundled with Node.js. This vulnerability could allow remote code execution, enabling attackers to run arbitrary code on affected systems. All currently supported Node.js versions are impacted. Fixed versions have been released for each supported release line. The severity of the RCE potential makes this a high-priority patch for organizations running Node.js in production environments.
Bekijk origineel advisory →Security firm FoxIO disclosed critical vulnerabilities in QPACK, the header compression mechanism used in HTTP/3, that allow unauthenticated remote attackers to crash web servers with a single connection. The attack exploits a memory amplification flaw where a small batch of compressed HTTP headers expands dramatically in memory, achieving up to 4,000-fold amplification. This can exhaust server memory on default configurations, effectively enabling denial-of-service attacks. Working proof-of-concept code has been released publicly. The vulnerability affects a wide range of HTTP/3 server implementations. No authentication or prior access is required to exploit the flaw. The disclosure highlights systemic risks in the QUIC/HTTP3 protocol stack's header compression design.
Bekijk origineel advisory →Amazon's Threat Intelligence team detected an exploitation attempt against PHP2Shell vulnerabilities on October 17, 2026, four days before they were publicly disclosed. The attempt was observed via Amazon's MadPot honeypot service. The exploit originated from an IP address linked to a commercial anonymization network. The vulnerabilities have since come under broad exploitation in the wild following patch release. The discovery highlights the existence of pre-disclosure exploitation activity, suggesting threat actors may have had prior knowledge of the flaws. CJ Moses from Amazon commented on the findings.
Bekijk origineel advisory →Microsoft disclosed that China state-aligned threat actor Storm-0940 was responsible for a supply chain compromise targeting the ConnectWise Cloud Backup application. The attackers leveraged ARTEX, a Go-based agentic AI penetration testing framework, to accelerate scanning operations during the attack. ARTEX was previously made closed-source following its abuse against South Korean financial institutions. The incident represents a notable use of AI-powered offensive tooling by a nation-state actor. This supply chain attack highlights the growing sophistication of Chinese state-sponsored cyber operations and their adoption of advanced AI-driven frameworks to enhance attack efficiency.
Bekijk origineel advisory →