Overzicht van binnengekomen advisories.
2014 resultaten gevonden
CISA, FBI, USSS, and international partners issued a joint advisory on SafePay ransomware, active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors gain initial access via credential theft, brute force, phishing, and exploitation of known CVEs in VPN and edge devices. After gaining access, they establish persistence using LOTL techniques, escalate privileges via UAC bypass, move laterally with RDP/WinRM/PsExec, and exfiltrate data using tools like RClone, FileZilla, and WinSCP. Files are encrypted using a hybrid ChaCha20 and RSA encryption scheme, appended with '.SafePay', and ransom is demanded in cryptocurrency. The group has impacted at least 600 victims and operates a leak site on TOR for double-extortion. Key mitigations include patching known exploited vulnerabilities, implementing MFA, network segmentation, offline backups, and Zero Trust principles.
Bekijk origineel advisory →Ahold Delhaize, one of the world's largest food retail chains, confirmed a cyberattack that disrupted services across its stores in both Europe and the United States. The attack was first detected the previous week and caused operational disruptions across multiple regions. Ahold Delhaize operates numerous well-known supermarket brands across these regions. The company acknowledged the incident and is working to address the impact on its services. The nature of the attack, whether ransomware or another type, was not fully detailed in the article. The disruptions affected both in-store and potentially online services for customers. This incident highlights the ongoing vulnerability of large retail and food supply chain organizations to cyberattacks. The geographic spread of the impact underscores the interconnected nature of the company's IT infrastructure.
Bekijk origineel advisory →Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4. The flaw allows attackers to place a specially-crafted DLL in a directory searched by the application, resulting in execution of malicious code with the application's privileges. The vulnerability has been actively exploited in ClickFix attacks to deploy a Remote Access Trojan (RAT). ClickFix is a social engineering technique that tricks users into executing malicious commands. The exploitation of a legitimate industrial software platform like Siemens Software Center raises significant concerns for operational technology and critical infrastructure environments. Siemens has addressed the vulnerability and users are advised to apply patches promptly.
Bekijk origineel advisory →Cybersecurity researchers from Forescout Research - Vedere Labs have disclosed details of a new malware delivery platform called ROMULUS that uses ClickFix-style lures. The platform operates as a malware-as-a-service, using fake landing pages to trick users into executing malicious commands on their own machines. ROMULUS is being actively used to distribute malware including Legion Loader. The ClickFix technique involves social engineering users into running malicious commands by presenting fake error messages or verification prompts. This platform represents a growing trend of commoditized malware delivery services that lower the barrier to entry for threat actors. The use of bogus landing pages makes attribution and detection more challenging for defenders.
Bekijk origineel advisory →A vulnerability identified as CVE-2026-110936 affects Siemens Software Center, involving an uncontrolled search path element. An authenticated local attacker could exploit this flaw by placing a specially crafted DLL in a directory searched by the application. Successful exploitation leads to arbitrary code execution with the privileges of the affected application. The vulnerability requires local access and authentication, limiting remote exploitation. It is tracked under CISA's BOD 26-04 directive for prioritizing security updates based on risk. Siemens has published an advisory (SSA-580366) with remediation guidance. The vulnerability is also catalogued in the NVD. Organizations using Siemens Software Center should apply patches promptly and follow forensic triage requirements outlined by CISA.
Bekijk origineel advisory →Plex Media Server versions v1.43.2 and earlier contain a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-96652. The flaw allows any attacker with a valid X-Plex-Token to inject a full URL into the 'protocol' parameter, forcing the Plex server to make POST requests to attacker-controlled destinations. This vulnerability is part of a chain that includes CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which can be combined for greater impact. The issue has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under BOD 26-04 implementation guidance. Users are urged to update Plex Media Server to a patched version immediately. The vulnerability is documented in both the NVD and CISA advisories.
Bekijk origineel advisory →Plex Media Server versions v1.43.2 and earlier contain an improper neutralization of encoded URI schemes in a web page vulnerability. This flaw could allow an attacker to call other plugins' functions and supply their own parameters, potentially enabling unauthorized actions. The vulnerability is part of a chain of related security issues, linked with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. CISA has flagged this vulnerability and it is subject to BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements have also been outlined under the BOD 26-04 implementation guidance. Users are strongly advised to update to a patched version of Plex Media Server as soon as possible. The vulnerability has been assigned a high criticality rating.
Bekijk origineel advisory →Plex Media Server contains a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-96655. An authenticated user can exploit this flaw to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. The vulnerability affects Plex Media Server v1.43.2 and earlier. It can be chained with related vulnerabilities CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, potentially increasing the severity and impact. The vulnerability has been flagged under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Forensic triage requirements are also noted under BOD 26-04 implementation guidance. Users are urged to apply the security update as detailed in the Plex community forums.
Bekijk origineel advisory →Plex Media Server versions v1.43.2 and earlier contain an external control of file name or path vulnerability (CVE-2026-96656) that allows an admin user to write arbitrary files which may be executed on load. This vulnerability is part of a chain that includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. The vulnerability was disclosed via the Plex forums and listed by CISA. It is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements are also outlined under BOD 26-04 implementation guidance. The chaining of these CVEs increases the overall risk and potential impact significantly. Affected users are urged to update to a patched version of Plex Media Server immediately.
Bekijk origineel advisory →EG Secure Solutions SiteGuard Server Edition contains a critical OS command injection vulnerability tracked as CVE-2026-106931. The flaw allows attackers to execute arbitrary OS commands with root or SYSTEM-level privileges on affected systems. This vulnerability poses a severe risk as successful exploitation grants full administrative control over the host system. The vulnerability has been flagged by CISA and is subject to BOD 26-04 prioritization requirements. EG Secure Solutions has published an advisory with remediation guidance. Organizations running SiteGuard Server Edition are urged to apply security updates immediately. The vulnerability is also documented in the NVD database.
Bekijk origineel advisory →Nikkei Inc. disclosed a third data breach within approximately one month, exposing 1.83 million personal information records. This represents a pattern of repeated security incidents at the Japanese media conglomerate in a short timeframe. The scale of exposure, nearly 1.83 million records, indicates a significant compromise of personal data. The repeated nature of the breaches suggests systemic security weaknesses within Nikkei's infrastructure. This incident highlights the challenges organizations face in fully remediating breaches and preventing subsequent incidents. The disclosure follows two prior breaches within the same month, raising concerns about the company's incident response and security posture.
Bekijk origineel advisory →The Rank Math PRO WordPress SEO plugin was compromised in a supply-chain attack, with malicious downloads distributed directly from the vendor's official website. The malware planted hidden backdoors on affected WordPress sites. This represents a significant supply-chain risk as the plugin is widely used across many WordPress installations. The attack was discovered last week and highlights ongoing threats targeting WordPress plugin ecosystems. Website administrators using Rank Math PRO are advised to verify their installations and check for signs of compromise.
Bekijk origineel advisory →Hackers compromised AOMEI's update servers to distribute malware through a built-in promotional feature in AOMEI's backup software. The attackers tampered with configuration files to push malicious content to users, then restored the files to their original state to conceal the attack. This represents a supply chain attack leveraging trusted software update infrastructure. Users of AOMEI backup products who received updates during the compromise window may have been exposed to malware. The stealthy nature of the attack, with files being restored after tampering, suggests a sophisticated threat actor attempting to minimize detection. The incident highlights risks associated with software update mechanisms and promotional features embedded in applications.
Bekijk origineel advisory →Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, to deploy cryptocurrency miners and reverse proxy backdoor software on affected systems. The exploitation began just one day after a public proof-of-concept (PoC) was released by a researcher known as boredhackerblog. The attack chain involves chaining four distinct vulnerabilities together to achieve code execution and persistence. The deployment of crypto miners indicates financial motivation, while the Linux proxy backdoor suggests the attackers may also be building infrastructure for further malicious activity. The rapid exploitation following PoC release underscores the urgency for Plex Media Server users to apply patches immediately. This campaign highlights the ongoing risk posed by media server software exposed to the internet.
Bekijk origineel advisory →The popular WordPress SEO plugin Rank Math PRO was compromised in a supply chain attack. Malicious copies were distributed via the official rankmath.com website and as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. The tampered plugin versions contained malware designed to install a self-restoring backdoor on affected WordPress sites. Any site that installed and activated one of the compromised versions should be treated as fully compromised. Rank Math issued a security notice on October 16 disclosing the incident. The self-restoring nature of the backdoor makes remediation particularly challenging, as simply removing the plugin may not fully clean the infection.
Bekijk origineel advisory →Wiz explores the critical gap between when supply chain zero-days occur and when they are officially detected or assigned CVEs. The article highlights how malicious code injected into trusted packages can rapidly propagate through developer environments and beyond. Wiz introduces its supply chain pipeline capability that monitors and identifies compromised packages at the point of publication, enabling security teams to detect zero-day supply chain compromises proactively. The solution integrates with Wiz Defend to provide early warning before a CVE is formally published. This approach addresses a significant blind spot in traditional vulnerability management, where teams typically rely on CVE publication as a trigger for response. By closing the detection gap, organizations can reduce their exposure window to supply chain attacks significantly.
Bekijk origineel advisory →This weekly cybersecurity recap covers a broad range of high-impact incidents and vulnerabilities. Key highlights include 98 zero-day vulnerabilities, rogue AI agents being weaponized, a $100 million cryptocurrency theft, and a supply chain attack affecting 700 supermarkets. The article emphasizes that threats often arrive through trusted services, hardware, and overlooked systems. Old vulnerabilities are finding new victims, and hardware security is increasingly a concern. The recap underscores the pervasive and stealthy nature of modern cyber threats across multiple sectors.
Bekijk origineel advisory →The GhostAction threat actor has expanded its supply chain attack campaign beyond injecting malicious GitHub Actions workflows. The group is now targeting open-source developers by phishing them and delivering credential-stealing malware disguised as a fake font file. The campaign has been observed across 94 GitHub repositories. Research from OpenSourceMalware indicates the attackers are actively evolving their tactics in response to detection and mitigation efforts. The shift from workflow injection to font-disguised stealers represents a notable refinement in their operational approach. This campaign poses a significant risk to open-source developers and the broader software supply chain.
Bekijk origineel advisory →Wiz's Cloud Incident Response Team (CIRT) investigated real-world AI-driven attacks targeting cloud environments, Kubernetes clusters, CI/CD pipelines, and identity systems. The attacks were characterized as loud, fast, and widespread, leveraging AI to accelerate and broaden attack scope. The article provides an anatomical breakdown of how these attacks behave across multiple infrastructure layers. Key focus areas include detection strategies for AI-assisted threat actors operating in cloud-native environments. The incidents highlight the growing risk of AI being weaponized to conduct sophisticated, multi-vector cloud intrusions. Organizations are advised to strengthen detection capabilities across cloud, container, and identity planes to counter these emerging threats.
Bekijk origineel advisory →A fake Web3 accelerator campaign has been discovered distributing information-stealing malware and backdoors targeting both Windows and macOS systems. The attackers used malicious npm packages as the delivery mechanism, luring victims with promises of free AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. The malware delivered included information stealers and backdoors capable of hijacking AI agent traffic. The campaign was identified and reported by Elastic security researchers. This represents a supply chain attack leveraging the npm ecosystem combined with social engineering around AI and Web3 themes to increase credibility. The use of legitimate AI brand names (Claude, Gemini) as bait indicates sophisticated targeting of developers and tech-savvy users. Both major desktop operating systems are affected, broadening the potential victim pool significantly.
Bekijk origineel advisory →