Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Attackers seized control of over 300 Tor exit relays in early October, using them to intercept SSH connections and steal login credentials. The attack targeted the final hop in Tor circuits, where traffic exits the anonymity network toward its destination. Users who authenticated to SSH servers via Tor between October 1 and 5 using password-based login were at risk. The attackers redirected connections to rogue servers designed to harvest passwords. This represents a significant man-in-the-middle attack against Tor users relying on the network for secure remote access. The incident highlights the risks of trusting exit relays in anonymity networks for sensitive operations like SSH authentication.
Bekijk origineel advisory →Unknown threat actors breached TeamUpdraft's website and gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. These stolen keys were subsequently used to plant backdoors on WordPress sites managed through these services. TeamUpdraft is the developer of UpdraftPlus, a widely-used WordPress backup plugin with over four million active installations. The attack represents a supply chain compromise targeting the management infrastructure rather than the plugin itself. Affected products include UpdraftCentral, UpdraftVault, and UpdraftClone. The breach allowed attackers to leverage legitimate credentials to gain persistent access to customer WordPress installations. The incident highlights risks associated with centralized management platforms for widely-deployed CMS plugins.
Bekijk origineel advisory →The Cybersecurity and Infrastructure Security Agency (CISA), alongside the FBI, has issued an advisory warning that the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. SafePay is an emerging ransomware threat targeting critical infrastructure sectors globally. The scale of the campaign—600+ victims—highlights the group's aggressive and widespread operational tempo. CISA's involvement underscores the severity and national security implications of the threat. The advisory likely includes indicators of compromise and mitigation guidance for affected organizations. Critical infrastructure sectors such as energy, healthcare, and transportation are typically primary targets for ransomware groups of this nature. Organizations are urged to review CISA's advisory and implement recommended defenses promptly.
Bekijk origineel advisory →CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws affecting Plex Media Server collectively known as Plex2Shell, as well as vulnerabilities in Siemens and SiteGuard products. One of the listed vulnerabilities is CVE-2026-96652, a Server-Side Request Forgery (SSRF) flaw in Plex Media Server with a CVSS score of 5.3. Federal agencies have been ordered to patch these vulnerabilities promptly. The inclusion in the KEV catalog indicates active exploitation in the wild. The directive underscores ongoing risks to government and enterprise environments from known, unpatched vulnerabilities in widely used software and industrial control systems.
Bekijk origineel advisory →Two critical unpatched remote code execution vulnerabilities in PHP have been discovered, rated 9.2 on the CVSS v4.0 scale. PHP is preparing an out-of-cycle emergency security release scheduled for 14:00 UTC on October 21, 2026. The flaws affect all four currently supported PHP branches: 8.2, 8.3, 8.4, and 8.5. Security researchers at watchTowr confirmed the vulnerabilities allow remote code execution. No active exploitation has been reported at the time of disclosure. The vulnerabilities have been collectively referred to as 'PHP2Shell' by the security community. No CVE identifiers have been publicly assigned yet. The PHP security team has not disclosed technical details about the flaws ahead of the patch release. Users on unsupported PHP branches will not receive fixes and remain exposed. This represents a significant risk given PHP's widespread use in web applications globally.
Bekijk origineel advisory →A threat actor breached TeamUpdraft's official website, the developer behind popular WordPress backup and security plugins including UpdraftPlus and UpdraftCentral. The attacker potentially compromised UpdraftCentral connection keys, which are used to authenticate and send commands to connected WordPress websites. This supply chain-style attack could allow the attacker to issue malicious commands to any WordPress site connected via the stolen keys. The breach raises significant concerns for WordPress site owners relying on UpdraftCentral for centralized management. Affected users are advised to rotate their connection keys and monitor their sites for unauthorized changes or backdoors. The incident highlights the risks of centralized WordPress management platforms as high-value attack targets.
Bekijk origineel advisory →Certificate authority eMudhra revoked eight intermediate certificates after researchers discovered their private keys were critically weak. The weak keys could be recovered almost instantly by anyone, enabling forgery of trusted certificates for legitimate websites. Mozilla, Google, and Apple took action by blocking these compromised certificates in their respective browsers and trust stores. The incident highlights a serious failure in certificate authority key generation practices. This type of compromise undermines the entire web PKI trust model, potentially exposing users to man-in-the-middle attacks and credential theft. Browser vendors acted swiftly to protect users by revoking trust in the affected intermediate certificates.
Bekijk origineel advisory →CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP core that leaked prior to official disclosure. The article examines the nature of these flaws and why exploitation consistently results in web servers spawning interactive shells. Elastic Security Labs analyzes the attack patterns associated with these vulnerabilities and details the detection logic developed to identify exploitation attempts. The convergence of exploitation behavior around web-server-to-shell patterns makes detection feasible through behavioral analysis. Elastic has developed specific detections targeting this behavior to provide coverage for affected organizations. The article serves both as a technical assessment and a practical guide for defenders using Elastic's security tooling.
Bekijk origineel advisory →The PHP security team has issued an urgent warning to administrators about two critical vulnerabilities affecting PHP. Information about the flaws was reportedly leaked ahead of their scheduled coordinated disclosure, prompting an accelerated emergency patch release. Administrators are advised to prepare for immediate updates to be released the following day. The early leak increases the risk of exploitation before patches are widely applied. No specific CVE identifiers or technical details were included in the initial warning. The situation underscores the dangers of premature vulnerability disclosure. PHP is widely used across web infrastructure globally, making the potential impact significant. Administrators running PHP-based systems should monitor official PHP channels and apply patches as soon as they are available.
Bekijk origineel advisory →Threat actors are conducting LLMjacking attacks by luring victims through malicious Google Search ads that lead to phishing sites stealing cloud credentials. Once credentials are compromised, attackers hijack cloud billing accounts to exploit LLM APIs such as those provided by major cloud providers. The unauthorized AI API usage can result in hundreds of thousands of dollars in charges to the victim. The attack chain begins with a simple ad click, progresses through credential theft, and culminates in large-scale abuse of AI services. This campaign highlights the growing financial motivation behind targeting cloud environments for AI resource exploitation. The technique represents an emerging threat vector where cloud-hosted LLM services are monetized by attackers at the victim's expense. Organizations using cloud-based AI services are urged to monitor billing anomalies and enforce strong credential hygiene.
Bekijk origineel advisory →Zeabur, a cloud development platform, disclosed a second cybersecurity incident within two months. An attacker exploited leaked internal credentials that were stored in plaintext to gain unauthorized access to Zeabur's infrastructure. The breach resulted in the theft of over 3.2 million environment variable records, which can contain sensitive configuration data and secrets. Additionally, account information for 321,810 users was compromised. The repeated nature of the breaches and the severity of the data exposure led Zeabur to announce it would be shutting down operations. The incident highlights the critical risk of storing credentials and secrets in plaintext. The scale of stolen environment variables poses significant downstream risks for affected developers and their applications.
Bekijk origineel advisory →Eight eMudhra intermediate certificate authority (CA) private keys have been confirmed compromised, as reported by Mozilla and Google's Chrome Root Program on October 20. Intermediate CA certificates are used to sign website certificates, meaning possession of these keys would allow an attacker to issue fraudulent certificates for any website that browsers would trust. A researcher reported the issue, triggering emergency responses from major browser vendors. Emergency fixes are being rolled out across browsers and software to revoke trust in the affected certificates. This represents a significant threat to web PKI integrity and HTTPS trust across the internet.
Bekijk origineel advisory →A critical path traversal vulnerability tracked as CVE-2026-106173 has been identified in Fortinet FortiSIEM with a CVSS score of 9.4. Cybersecurity researchers have released a public proof-of-concept (PoC) exploit for this flaw. The vulnerability allows an unauthenticated attacker to execute arbitrary code or commands remotely via specially crafted requests. Fortinet has released a patch for the issue. The public availability of a PoC significantly raises the risk of exploitation in the wild. Organizations using FortiSIEM are urged to apply the patch immediately. The flaw is classified as critical due to its unauthenticated nature and high CVSS score.
Bekijk origineel advisory →Palo Alto Networks has disclosed ongoing exploitation of CVE-2026-0257, a now-patched authentication bypass vulnerability affecting PAN-OS and Prisma Access. The flaw carries a CVSS score of 7.8 and allows threat actors to establish unauthorized VPN connections, effectively bypassing multi-factor authentication. Two ransomware groups, Qilin and INC, have been observed actively exploiting this vulnerability. Palo Alto Networks patched the flaw in May 2026. The continued exploitation post-patch indicates that many organizations have not yet applied the fix. The activity highlights the growing trend of ransomware actors targeting network edge devices to gain initial access.
Bekijk origineel advisory →A Chinese-speaking threat actor deployed autonomous AI agents to conduct automated attacks against company websites with minimal human intervention. The campaign targeted over 1,200 websites and successfully breached systems belonging to more than 100 companies, including major firms like John Deere. The operation was discovered because the attackers left their control panels exposed on the public internet, allowing a security researcher to observe the attacks in real time. This incident marks a significant escalation in the use of AI for offensive cybersecurity operations, demonstrating that autonomous agents can conduct web intrusions at scale. The event raises serious concerns about the future threat landscape where AI lowers the barrier to entry for sophisticated attacks.
Bekijk origineel advisory →The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was confirmed to be infected with NSO Group's Pegasus spyware in 2026. The infection was discovered by Citizen Lab and reported on October 19, just six days before Serbia's October 25 snap parliamentary election. The attack used a zero-click exploit, meaning the victim did not need to interact with any malicious link or file. This case highlights the continued use of Pegasus spyware against civil society figures, academics, and political activists. The timing of the discovery, shortly before a national election, raises serious concerns about political surveillance and interference.
Bekijk origineel advisory →CISA published an ICS advisory (ICSA-26-293-02) regarding two HIGH severity vulnerabilities in the Web-Based Management (WBM) interface of multiple WAGO device families running WAGO OS Linux firmware versions 1.0.0 through 4.10.0. CVE-2026-80466 (CVSS 3.1: 8.8) is an OS Command Injection flaw in the WBM routing configuration that allows a low-privileged remote attacker to inject shell commands executed with root privileges. CVE-2026-88850 (CVSS 3.1: 8.1) is a Missing Authorization vulnerability in PROFIBUS configuration management that allows unauthorized modification of root-owned PROFIBUS parameters. Affected devices include CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 across 11 hardware model families. The fix is to update to firmware version 4.10.0 (FW32) or higher. These vulnerabilities impact critical infrastructure sectors including Chemical, Energy, Manufacturing, Transportation, and Water Systems worldwide. The vulnerabilities were reported by Ievgen Bondarenko and coordinated by CERT@VDE.
Bekijk origineel advisory →CISA issued an ICS advisory for Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier, identifying two vulnerabilities. CVE-2026-109812 is a missing authorization flaw in the internal API /api/v1/secrets/ that allows a privileged authenticated attacker with adjacent network access to access sensitive information including cryptographic key material. CVE-2026-109813 is a hard-coded cryptographic key vulnerability in /usr/bin/sysman that allows an unauthenticated attacker with adjacent network access to compromise confidentiality and integrity of communications. The highest CVSS v3.1 score is 8.1 (HIGH). Affected sectors include Critical Manufacturing, Energy, and Water and Wastewater Systems. Moxa has released firmware v1.4.1 as a fix, available via the AIG-302 Web Console or manual download. No known public exploitation has been reported at this time.
Bekijk origineel advisory →CISA republished a Hitachi Energy advisory disclosing multiple vulnerabilities affecting MicroSCADA X SYS600 versions 10.7 and prior, as well as version 10.8. CVE-2026-9852 is a CSV injection vulnerability (CVSS 3.1: 5.0, MEDIUM) allowing formula injection, data exfiltration, and potential code execution via malicious log messages. CVE-2026-9853 is an incorrect authentication algorithm implementation (CVSS 3.1: 7.8, HIGH) allowing OS-authenticated users to read and modify SYS600 application objects without SYS600 credentials. CVE-2026-9854 is a privilege escalation vulnerability (CVSS 3.1: 7.8, HIGH) in the RBAC mechanism enabling engineering tool users to elevate privileges to Windows administrator level. Affected products are deployed worldwide in the Energy critical infrastructure sector. Remediation includes updating to version 10.8 and following mitigation strategies outlined in the MicroSCADA X SYS600 10.8 Installation and Administration Manual. Vulnerabilities were reported by researchers from Sandia National Laboratories via the CyTRICS program.
Bekijk origineel advisory →CISA published an ICS advisory regarding multiple vulnerabilities affecting Hitachi Energy RTU500 series CMU Firmware versions 12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8, and 13.8.1-13.8.2. Seven distinct vulnerability types were identified including NULL Pointer Dereference, Type Confusion, Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, and Authentication Bypass by Primary Weakness. The vulnerabilities affect the energy critical infrastructure sector and are deployed worldwide. CVSS scores range from 5.3 (Medium) to 8.8 (High), with the highest severity being CVE-2026-6653 (Use After Free in libxml2) at CVSS 8.8. Affected libraries include OpenSSL, libxml2, and libcurl components embedded in the RTU500 firmware. Remediation involves updating to CMU Firmware version 13.9.1 as the primary fix, with version-specific patches also available (12.7.8, 13.7.9, 13.8.3). General mitigations include network isolation, firewall segmentation, and avoiding direct internet exposure of control system devices. The vulnerabilities were reported by Hitachi Energy's internal security team.
Bekijk origineel advisory →