Overzicht van binnengekomen advisories.
2014 resultaten gevonden
A critical unpatched vulnerability in Broadcom's Wi-Fi setup software allows an attacker within radio range to execute arbitrary code as root on affected routers. No network password or pairing step is required to exploit the flaw. Security researcher Quentin Kaiser disclosed the vulnerability on October 16, demonstrating successful attacks against home gateways from three Belgian internet providers. In at least one case, the attacker was able to read the Wi-Fi password directly off the device. The vulnerability poses a significant risk to home and small office users relying on Broadcom-based routers. No patch has been released at the time of disclosure, leaving affected devices exposed. The attack is proximity-based, requiring the attacker to be within Wi-Fi radio range of the target device.
Bekijk origineel advisory →On the night of October 16, an intruder accessed a legacy system at OpenCode, potentially exposing third-party AI provider API keys stored by users in OpenCode Console. OpenCode Console is an optional hosted service that allows workspaces to store their OpenAI, Anthropic, or Google API keys, enabling team members to access AI models through a shared interface. The breach may have compromised sensitive credentials that users had saved within the platform. The incident raises concerns about the security of API key storage in third-party hosted services. Affected users may face risks of unauthorized usage of their AI provider accounts, potential cost exposure, and data privacy implications if the keys are misused.
Bekijk origineel advisory →OpenCode reported a security breach targeting Console users who had linked AI providers to their accounts. The attack involved a distillation attack technique, which likely involved extracting or manipulating AI model outputs or credentials. The breach specifically affected developer environments where OpenCode was installed. StepSecurity published guidance on how to detect OpenCode installations on developer machines and how to respond to the incident. The article provides both vendor-reported information and practical remediation steps for security teams. This incident highlights supply chain and AI integration risks in developer tooling environments.
Bekijk origineel advisory →Attackers are actively exploiting an OS command injection vulnerability in SiteGuard Server Edition, a web application firewall product. The flaw allows threat actors to execute arbitrary commands with root or SYSTEM-level privileges on affected servers. This represents a critical security risk as the WAF product, designed to protect web servers, is itself being weaponized against the systems it defends. The vulnerability enables full system compromise due to the elevated privilege level of command execution. Organizations running SiteGuard Server Edition are urged to apply patches or mitigations immediately. The active exploitation in the wild increases the urgency of remediation efforts.
Bekijk origineel advisory →ConnectWise has suspended its Cloud Backup service after unknown threat actors gained unauthorized access to ConnectWise application identities. The attackers used these compromised identities to access and compromise Microsoft 365 tenants belonging to ConnectWise customers. ConnectWise responded by disabling seven application identities, including ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae). An investigation is ongoing to determine the full scope of the incident. The suspension of the cloud backup service impacts customers relying on ConnectWise for Microsoft 365 data protection. The incident highlights risks associated with third-party application identities having access to cloud tenants.
Bekijk origineel advisory →ConnectWise has shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a security incident in which hackers accessed application identities. The attackers leveraged this access to compromise Microsoft 365 tenants belonging to ConnectWise customers. The incident is classified as a supply-chain attack, as the breach originated through ConnectWise's own infrastructure and affected downstream customers. ConnectWise took the service offline as a containment measure. The attack highlights the risks of third-party cloud backup and management tools having broad access to enterprise Microsoft 365 environments. Organizations using ConnectWise Cloud Backup are advised to review their Microsoft 365 tenant for signs of unauthorized access and review delegated application permissions.
Bekijk origineel advisory →Drupal has released patches for two critical remote code execution (RCE) vulnerabilities affecting all supported versions of the popular content management system. The vulnerabilities could allow attackers to execute arbitrary code remotely on affected websites. Drupal has warned that exploits may emerge soon following the disclosure, urging administrators to apply patches immediately. The flaws affect any supported version of Drupal, making the scope of potential impact significant given Drupal's widespread use across enterprise and government websites. No specific CVE identifiers were mentioned in the article summary, but the critical severity rating and RCE nature of the flaws make them high-priority targets for threat actors. Website administrators running Drupal are strongly advised to update to the patched versions as soon as possible to mitigate the risk of exploitation.
Bekijk origineel advisory →Cybersecurity researchers have identified a malicious npm package named 'imgdecode' as part of the MALFEX software supply chain attack campaign. The package was uploaded to the npm registry on September 30, 2026, by a user named 'malfexteste8'. It has been downloaded approximately 979 times and remains available on npm. The package hides a shellcode loader within a Windows native addon, making it particularly dangerous as it can execute arbitrary code on victim machines. This discovery highlights the ongoing risks associated with software supply chain attacks targeting the npm ecosystem. The campaign name MALFEX suggests a coordinated effort to distribute malware through legitimate package registries.
Bekijk origineel advisory →An active campaign has been identified where unknown threat actors are leveraging a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. At least 173 Microsoft 365 tenants have been affected. ConnectWise Cloud Backup is a cloud-based backup and recovery service designed for managed service providers (MSPs), making the breach particularly significant due to the downstream impact on MSP customers. The attack highlights risks associated with credential compromise in MSP tooling and cloud backup services. Cybersecurity researchers are actively raising alarms about this campaign. The incident underscores the supply-chain-like risk posed when a trusted MSP vendor's credentials are compromised. No specific CVEs have been mentioned in the available content.
Bekijk origineel advisory →A critical maximum-severity vulnerability tracked as CVE-2026-103849 has been discovered in BlockStrap, affecting Magento and Adobe Commerce platforms. The flaw could allow attackers to execute arbitrary PHP code on store servers. Researchers are warning that exploitation could be imminent. The vulnerability poses a significant risk to e-commerce stores running Magento and Adobe Commerce. No additional details about patches or mitigations are provided in the article excerpt, but the severity rating suggests urgent remediation is required. The issue highlights ongoing risks to widely-used e-commerce infrastructure.
Bekijk origineel advisory →Researchers from security firm Calif have published a local privilege escalation exploit targeting OpenBSD 7.9 that achieves root access by chaining a roughly 37-year-old integer overflow in shared memory with a separate kernel flaw. The exploit successfully bypasses OpenBSD's KARL (kernel address randomization layout) as well as hardware protections SMAP and SMEP. A full proof-of-concept code was released after OpenBSD shipped a patch. The vulnerability chain demonstrates that legacy bugs in foundational OS code can remain exploitable for decades. This is particularly notable given OpenBSD's reputation as one of the most security-focused operating systems. The attack is local, requiring existing access to the system, but escalates privileges to root. The disclosure follows responsible reporting by Calif to the OpenBSD team prior to public release.
Bekijk origineel advisory →Unit 42 researchers detail the top five initial access vectors used by adversaries to breach organizations in September 2026. The report highlights edge device exploits, credential abuse, and phishing as leading methods. These findings are based on incident response and threat intelligence observations by Palo Alto Networks' Unit 42 team. The article serves as a periodic threat landscape summary to help organizations prioritize defensive measures. Understanding these vectors is critical for improving detection and prevention strategies against current threat actor tactics.
Bekijk origineel advisory →Between May and July 2026, attackers repeatedly tampered with AOMEI Backupper's official update servers in short windows of five to ten minutes at a time. Any instance of the Windows backup software that checked for updates during these windows would download and execute a backdoor. The attack represents a classic supply chain compromise targeting the software update mechanism of a trusted vendor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team were involved in investigating the incident. The brevity of the attack windows suggests the attackers were attempting to minimize detection while still achieving broad distribution through legitimate update channels.
Bekijk origineel advisory →A threat actor tracked as UAT-11985 has been conducting a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The campaign uses fake event invitations to lure victims to an adversary-in-the-middle (AitM) phishing framework. The goal is to harvest Google account credentials and multi-factor authentication (MFA) codes. The AitM technique allows attackers to bypass MFA protections by intercepting authentication tokens in real time. This represents a sophisticated APT-level operation targeting academic and research communities in Taiwan, likely for espionage purposes.
Bekijk origineel advisory →CISA has issued an alert regarding CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) affecting versions 26.2.3 and earlier. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as threat actors are actively exploiting it to gain initial access, establish persistence, escalate privileges, and move laterally. Organizations using self-hosted appliances must apply the BT26-05-RS patch; those on versions older than 24.3.1 must upgrade first. BeyondTrust-hosted SaaS deployments have already been patched. CISA recommends isolating potentially compromised appliances, conducting forensic investigations, hunting for indicators of compromise such as unrecognized privileged sessions or unauthorized account changes, and rebuilding from a known-good state. After remediation, organizations should rotate all credentials stored or injected by the appliance and revoke active support sessions. Mandiant has published additional guidance under the campaign name ARMORY CASTLE.
Bekijk origineel advisory →BeyondTrust has patched a critical vulnerability in BeyondTrust Remote Support, identified as CVE-2026-102764 with a CVSS score of 9.3. The vulnerability involves insufficient validation of message origins within internal product components. An unauthenticated remote attacker can exploit this flaw to place or modify files on an affected appliance. All Remote Support versions up to and including 26.2.3 are affected. BeyondTrust has confirmed that CVE-2026-102764 was actively exploited as a zero-day vulnerability in the wild.
Bekijk origineel advisory →A cyberattack targeting BAE Systems, a major government contractor, has disrupted operations at US federal bankruptcy courts. The Administrative Office of the US Courts confirmed that the attack took down the notice system used by federal bankruptcy courts. BAE Systems is a defense and security contractor with significant ties to US government operations. The disruption affects court notification infrastructure, potentially impacting case communications and proceedings. This incident highlights the risks of third-party contractor dependencies within critical government systems. The attack demonstrates how supply chain vulnerabilities can cascade into public sector disruptions. Details on the nature of the attack, attribution, and extent of the damage are limited in the current reporting.
Bekijk origineel advisory →The China-nexus cyber espionage group Armory Castle (formerly UNC5221 or Warp Panda) exploited a zero-day vulnerability in BeyondTrust Remote Support (formerly Bomgar) in late August 2026. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, involves improper origin validation in an internal messaging component. Exploitation of this vulnerability allowed attackers to take over remote support servers. The group has been previously tracked under multiple aliases, indicating a sophisticated and persistent threat actor. This incident highlights ongoing risks posed by China-linked espionage operations targeting enterprise remote support infrastructure. The high CVSS score underscores the critical severity of the vulnerability and the potential for widespread impact.
Bekijk origineel advisory →BeyondTrust disclosed and patched a critical zero-day vulnerability in its Remote Support (RS) product that has been actively exploited in attacks since late August. The flaw was identified as being exploited in the wild before a patch was available, classifying it as a zero-day. BeyondTrust issued an urgent warning to customers to apply the patch immediately. The vulnerability poses significant risk given BeyondTrust's widespread use in enterprise privileged access and remote support environments. No additional CVE identifier was mentioned in the excerpt, but the severity and active exploitation make this a high-priority remediation item. Organizations using BeyondTrust Remote Support are urged to update immediately to mitigate risk of compromise.
Bekijk origineel advisory →A suspected advanced threat actor has been exploiting CVE-2025-61624, a path traversal vulnerability (CVSS 5.4) in Fortinet FortiOS's command line interpreter, to deploy a previously unreported memory-resident ARM64 malware dubbed PEERSTITCH. The vulnerability also affects FortiPAM, FortiProxy, and FortiSwitchManager. The malware is notable for its ability to bypass security checks on tagged VPN sessions, making detection and remediation more difficult. PEERSTITCH resides in memory, leaving minimal forensic artifacts on disk. The attack chain highlights the continued targeting of network edge devices by sophisticated threat actors. Organizations using affected Fortinet products are urged to apply patches and monitor for indicators of compromise.
Bekijk origineel advisory →