Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Hackers compromised the infrastructure of Onamae Desktop Cloud, a major VPS service provider in Japan. The attackers installed malware on up to 26,739 customers' servers, representing a significant supply-chain-style infrastructure breach. The incident affected a large number of virtual private servers managed by the provider. Onamae is a well-known domain and hosting services company in Japan. The scale of the attack — nearly 27,000 servers — makes this a high-impact event for Japanese businesses and individuals relying on the platform. The nature of the malware installed has not been fully detailed in the article. This type of cloud infrastructure compromise can lead to data theft, further lateral movement, and deployment of additional payloads on customer environments.
Bekijk origineel advisory →North Korean state-sponsored hacking group Lazarus is employing post-quantum cryptographic mechanisms to secure the delivery of malicious payloads in new operations. The campaign combines both old and new malware families, demonstrating the group's continued evolution and sophistication. The use of post-quantum cryptography marks a notable advancement in their operational security, making interception and analysis of communications more difficult. This represents a proactive adaptation to future-proof their attack infrastructure against potential quantum computing decryption capabilities. The activity highlights Lazarus Group's ongoing threat to global cybersecurity and their investment in cutting-edge evasion techniques.
Bekijk origineel advisory →The PHP Foundation published a postmortem accusing Chainguard of breaking a coordinated security embargo by releasing patched PHP container images over six hours before the scheduled disclosure of two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Chainguard CEO Dan Lorenc defended the early release citing active exploitation reports from multiple security vendors and the ease of independently discovering the vulnerability. The disclosure process was further disrupted by leaked CVE identifiers, an accidentally published exploit demonstration video by Calif, and potentially leaked mitigation guidance. The underlying memory management vulnerability had been known since a 2024 Quarkslab audit but stalled due to complex trade-offs and limited developer resources. Researchers from Calif, OpenAI, and Wiz contributed to identifying attack vectors and RCE proofs of concept. PHP's security team is now moving to majority-vote decisions to prevent fixes from stalling, and the Foundation is calling for increased funding from companies dependent on PHP. The incident raised community concerns about whether other projects would trust Chainguard with embargoed patches in the future.
Bekijk origineel advisory →CISA has issued a warning regarding active exploitation of four vulnerabilities in Plex Media Server, collectively referred to as 'Plex2Shell' attacks. Attackers are chaining these flaws together to breach servers running Plex Media Server. The advisory highlights the risk of remote code execution or unauthorized access through the chained exploitation of these vulnerabilities. CISA is urging organizations and users running Plex Media Server to apply patches immediately. The campaign demonstrates the increasing trend of attackers combining multiple lower-severity vulnerabilities to achieve high-impact outcomes. This advisory underscores the importance of timely patching for media server software exposed to the internet.
Bekijk origineel advisory →The popular LiteLLM Python package was compromised in a software supply chain attack affecting version 1.107.0. The malicious package was distributed via PyPI wheels and Docker images, delivering both a credential stealer and a backdoor. The compromise was discovered and reported by multiple security firms including SafeDep, Socket, StepSecurity, and Upwind. PyPI has since quarantined the affected package to prevent further installations. This incident highlights ongoing risks in open-source package ecosystems, particularly for AI/LLM tooling. Organizations using LiteLLM 1.107.0 should consider their environments potentially compromised and rotate credentials.
Bekijk origineel advisory →CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities affecting PHP, a widely used scripting language powering web servers and content management systems globally. The vulnerabilities were reported by Palo Alto Networks Unit 42 as a threat brief. Due to PHP's widespread deployment, these flaws carry significant risk for web infrastructure worldwide. The article highlights the critical severity rating of both CVEs. No additional technical details such as exploit mechanisms or patch information are provided in the available content. Organizations running PHP-based web servers or CMS platforms are likely at risk. Immediate attention and patching are implied as necessary responses.
Bekijk origineel advisory →PHP released emergency patches on October 21, 2026, for two critical memory-safety RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, both rated 9.2 on CVSS v4.0. The flaws affect all PHP installations serving web requests including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with exploitation possible before any application code executes. NSA and CERT-EU urged organizations unable to patch immediately to take affected systems offline or isolate them from public networks. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with minimal backports also published for PHP 7.4, 8.0, and 8.1. Cloudflare reported active attack traffic with attackers already attempting to evade WAF protections. Approximately 48.5% of PHP websites run end-of-life branches, making the patch rollout particularly challenging. Wiz researchers noted that AI models helped accelerate the development of working exploits across applications in hours. Remote memory disclosure is also possible, potentially exposing passwords, tokens, and API keys without first achieving code execution.
Bekijk origineel advisory →The litellm 1.107.0 release on PyPI was compromised, with backdoored wheel packages and Docker images shipping a malicious .pth file acting as a credential stealer. The malware also includes an hourly remote code loader that periodically fetches and executes additional payloads. Stolen credentials and data are exfiltrated to the domain litellm.dev. The article provides indicators of compromise (IOCs) and remediation guidance. This represents a serious supply chain attack targeting developers and organizations using the litellm Python package. The attack vector leverages Python's .pth file mechanism to achieve persistence and code execution on affected systems.
Bekijk origineel advisory →The PHP security team released emergency patches addressing two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell. These flaws allow attackers to execute arbitrary code remotely on affected PHP installations. The severity of the vulnerabilities prompted an out-of-cycle emergency release rather than waiting for a scheduled update. PHP is a widely deployed server-side scripting language powering a significant portion of the web, making these vulnerabilities high-impact. Administrators and developers are urged to apply the patches immediately to mitigate exploitation risk. The collective branding as PHP2Shell suggests the flaws may involve mechanisms that allow shell command execution through PHP. No further technical details about exploitation status were provided in the article excerpt.
Bekijk origineel advisory →PHP has patched two critical vulnerabilities that allow unauthenticated remote code execution on all PHP installations that process web requests. CVE-2026-109618 involves memory corruption during Out-of-Memory handling, causing internal request data to be only partially initialized and treated as valid, enabling RCE. CVE-2026-109619 involves stale internal global state persisting after memory is freed, allowing subsequent requests processed by the same worker to use outdated state before reinitialization, also leading to RCE. Both vulnerabilities are exploitable without authentication via standard web requests. All PHP installations handling web traffic are affected. The PHP team and NCSC urgently advise applying the security updates immediately.
Bekijk origineel advisory →Unit 42 investigated a threat actor who bypassed AI safety controls to leverage AI tools in planning and executing multiple types of cybercrime. The actor used AI assistance to coordinate credential theft operations, plan VoIP fraud schemes, and execute database exfiltration attacks. The investigation highlights the emerging risk of AI being weaponized by malicious actors to enhance their attack planning and execution capabilities. This case demonstrates how threat actors are actively finding ways to circumvent AI safety guardrails to obtain actionable cybercrime guidance. The report underscores the dual-use nature of AI technology and the need for stronger safety controls in AI platforms to prevent misuse by cybercriminals.
Bekijk origineel advisory →ClickFix attacks are experiencing a significant surge in activity, with cybercriminals leveraging fake AI tool installers and malicious search results to deceive users into executing malware. Attackers are impersonating trusted chatbot platforms and AI applications to make their lures more convincing and harder to detect. Push Security has analyzed how these attacks successfully evade traditional defense mechanisms. The technique relies on social engineering, tricking users into manually running malicious commands or scripts. AI-themed lures have proven particularly effective due to widespread public interest in AI tools. The campaign highlights a growing trend of threat actors exploiting emerging technology trends to increase attack success rates.
Bekijk origineel advisory →PHP has released emergency security updates to address two critical remote code execution vulnerabilities collectively dubbed 'PHP2Shell'. The flaws reside in the PHP runtime itself, meaning any site running PHP is potentially vulnerable regardless of the application code. Affected versions span PHP 8.2, 8.3, 8.4, and 8.5 branches, with fixes available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerabilities allow unauthenticated attackers to execute arbitrary code on web servers. Active exploit attempts have already been observed in the wild, making patching urgent. The PHP team has stated that only a full update to the patched versions provides complete protection against these flaws.
Bekijk origineel advisory →Researchers at Wiz, leveraging AI-assisted analysis, discovered critical remote code execution (RCE) vulnerabilities in the core PHP engine, dubbed PHP2Shell. These flaws potentially affect approximately 70% of the Internet, given PHP's widespread deployment. The vulnerabilities enable attackers to execute arbitrary code remotely on affected servers. Additionally, a Heartbleed-style memory disclosure vulnerability was identified, which could expose sensitive data from server memory. The severity and breadth of affected systems make this a critical issue comparable to historical vulnerabilities like Heartbleed. Organizations running PHP-based web infrastructure are urged to apply patches immediately. The discovery highlights the growing role of AI in identifying complex, systemic vulnerabilities in foundational web technologies.
Bekijk origineel advisory →A malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker Hub on October 21. The compromised package contains a credential stealer targeting browser-stored credentials, cloud secrets, and AI-related secrets. Additionally, the malicious version includes a dormant command-and-control (C2) capability, suggesting potential for future remote exploitation. This is a supply chain attack targeting AI/ML developers and organizations using LiteLLM for managing large language model integrations. Users who installed version 1.107.0 should consider themselves compromised and rotate all secrets immediately. The attack highlights ongoing risks in open-source AI tooling ecosystems and package registries.
Bekijk origineel advisory →LiteLLM version 1.107.0 on PyPI and Docker was compromised in a supply chain attack, delivering a credential stealer via Python startup hooks (cook.pth, cook.py, sitecustomize.py). The malware collects cloud credentials (AWS, Azure, GCP), AI provider keys, SSH/GPG keys, browser data, and developer secrets. A lookalike GitHub repository 'Berri-AI/litellm' (vs legitimate 'BerriAI/litellm') was recorded in container build provenance, indicating the release workflow was hijacked. Seven wheel files across macOS, Linux, and Windows were affected, as well as multiple Docker/GHCR container images including those tagged 'latest'. Stolen data is encrypted with AES-256-CBC and RSA-4096 and exfiltrated to hxxp://www[.]litellm[.]dev/healthcheck. A remote Python code loader is controlled via a GitHub file at letters9813/pythonclient-test. Socket's AI scanner detected the malicious package seven minutes after publication. Users are advised to immediately stop using 1.107.0, revoke exposed credentials, and roll back to 1.106.2.
Bekijk origineel advisory →PHP.net announced a critical security update addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.4. Due to the severity and widespread use of PHP, ISC SANS elevated the InfoCon level to YELLOW. Early proof-of-concept exploits were reportedly available before the patch was released, increasing the risk of exploitation. The high CVSS score and pre-patch PoC availability make this a high-priority issue for organizations running PHP-based applications. Administrators are strongly urged to apply the patch as soon as it becomes available.
Bekijk origineel advisory →A previously undocumented China-aligned threat cluster called Bronze Sandcastle has been identified targeting organizations in Asia and Africa since mid-2025. The group's most distinctive technical marker is its consistent use of Sandboxie DLL sideloading techniques to deploy backdoors. The campaign was disclosed by Sophos security researcher Gabor Szappanos. The threat actor is assessed to be aligned with Chinese state interests. The targeting pattern focuses on organizations across Asian and African regions. DLL sideloading via the legitimate Sandboxie application is used as a mechanism to load malicious payloads stealthily. This technique helps the attackers evade detection by abusing trusted software. The activity represents a newly documented cluster not previously attributed or tracked publicly.
Bekijk origineel advisory →CISA is urging organizations to immediately patch two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as 'php2shell'. These vulnerabilities allow unauthenticated remote code execution and affect all PHP installations serving web requests. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations unable to patch immediately should take PHP-based systems offline, especially internet-facing ones. PHP 8.1 and earlier unsupported versions are also affected. CISA recommends inventorying all PHP installations, applying patches with priority to internet-facing systems, and using web application firewalls as a temporary mitigation. Network defenders should monitor for suspicious activity such as PHP worker processes launching shells or downloading tools. No active exploitation has been observed at the time of publication.
Bekijk origineel advisory →Two critical PHP vulnerabilities collectively named PHP2Shell have been rated 9.2 out of 10 in severity and are scheduled for a patch release at 14:00 UTC on October 21. PHP has provided no official workaround prior to the fix. A setting being circulated in the security community as a mitigation has been clarified by the originating security firm to be insufficient on its own. Organizations are urged to apply the patch as soon as it becomes available. The flaws allow remote code execution (RCE), making them highly dangerous for any server running PHP. The article aims to clarify what partial mitigations may reduce risk in the window before patching and what measures are ineffective.
Bekijk origineel advisory →