Overzicht van binnengekomen advisories.
2014 resultaten gevonden
A path traversal vulnerability has been identified in multiple Fortinet products including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The vulnerability allows an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. The flaw is tracked as CVE-2025-61624 and has been assigned a high criticality rating. CISA has referenced this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Fortinet has published an advisory under FG-IR-26-122. Organizations using affected Fortinet products are advised to apply patches promptly. The vulnerability poses a significant risk as it can lead to unauthorized file manipulation on affected systems.
Bekijk origineel advisory →CVE-2026-102764 is an authentication bypass by spoofing vulnerability affecting BeyondTrust Remote Support. A remote attacker could exploit this flaw to perform unauthorized file operations on the affected appliance. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. BeyondTrust has published a security advisory with remediation guidance. CISA has also provided forensics triage requirements as part of the directive's implementation guidance. The vulnerability is tracked in the NVD and carries a high criticality rating. Organizations using BeyondTrust Remote Support are urged to apply patches promptly.
Bekijk origineel advisory →Unit 42 researchers have analyzed an AI-powered espionage campaign specifically targeting government Linux infrastructure. The campaign employs custom malware, web shells, and advanced credential theft techniques. The use of AI to enhance espionage operations represents an evolving threat landscape. Government entities running Linux systems are the primary targets, suggesting a nation-state or sophisticated threat actor involvement. The attack methodology combines multiple techniques including web shell deployment and credential harvesting. The campaign demonstrates increasing sophistication in threat actor capabilities by leveraging AI technologies. Custom malware tailored for Linux environments indicates deep technical expertise and targeted intent.
Bekijk origineel advisory →Threat actors are actively exploiting a critical remote code execution vulnerability tracked as CVE-2026-110447 in the Collabora Online Built-in CODE Server (richdocumentscode) plugin for Nextcloud. The flaw allows attackers to execute arbitrary commands on affected servers. Successful exploitation enables threat actors to install backdoors on compromised Nextcloud instances. The vulnerability is present in the richdocumentscode app, which is widely used to provide document editing capabilities within Nextcloud deployments. Organizations running Nextcloud with the Collabora Online integration are at significant risk. The active exploitation makes this a high-priority issue requiring immediate patching or mitigation. Nextcloud server administrators should review their installations and apply available security updates as soon as possible.
Bekijk origineel advisory →A critical Linux kernel vulnerability dubbed PwnEscape (CVE-2026-99999) has been disclosed, allowing code running inside a virtual machine to read memory on the host system. The flaw resides in the Linux kernel's networking code, making it broadly applicable across cloud environments rather than specific to any single provider's configuration. A security researcher demonstrated the vulnerability against Vercel's live cloud sandboxes, and Vercel confirmed the successful exploit. Because the issue is in the kernel itself, any cloud or hosting provider using affected Linux kernel versions may be at risk. This type of VM escape or cross-boundary memory read is considered critical as it undermines the fundamental isolation guarantees of virtualization. The vulnerability has been assigned a CVE identifier and is actively being tracked by the security community. Patches or mitigations are expected from Linux kernel maintainers and downstream distributions.
Bekijk origineel advisory →This weekly security roundup covers multiple significant threats including an Adobe Remote Code Execution vulnerability, DNS-based cryptocurrency wallet theft, NVIDIA container escape vulnerability, and a self-healing backdoor malware. The article also references 23 additional security stories. Key themes include data theft tools with victim intimidation features, privilege escalation via small permissions, trusted authentication bypass, exploitation of old vulnerabilities against new targets, and abuse of legitimate tools for malicious purposes. The roundup suggests a broad and active threat landscape across multiple product categories and attack vectors.
Bekijk origineel advisory →A threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular AUR helper tools yay and paru. The fake packages were designed to push malware with root privileges onto victim systems. AUR is a community-driven repository for Arch Linux users, making it a high-value target for supply chain attacks. Because AUR packages can request elevated privileges during installation, malicious packages can gain root-level access. This attack highlights the risks associated with community-maintained package repositories where packages are not officially vetted. Users who installed the trojanized versions of yay or paru may have had their systems fully compromised. The incident underscores the importance of verifying package authenticity and reviewing PKGBUILDs before installation on Arch Linux systems.
Bekijk origineel advisory →Citizen Lab researchers revealed that Candiru, an Israeli spyware vendor, infected devices at Al Jazeera through malicious online advertisements. The attacks required no user interaction, executing hidden code the moment an ad loaded on screen. In some cases, ads loaded invisibly in the background, making detection even harder. Candiru sells its spyware to government clients, raising serious concerns about state-sponsored surveillance targeting journalists. This represents a significant escalation in spyware delivery methods, weaponizing the online advertising ecosystem. The zero-click nature of the attack makes it extremely difficult for users to protect themselves. Citizen Lab's investigation links the infections directly to targeted ad campaigns, suggesting a sophisticated and deliberate targeting operation against the news network.
Bekijk origineel advisory →The threat actor known as Silent Lynx has been linked to a new wave of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The campaign, observed between June 2025 and August 2026, leverages four distinct infection chains. These include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and crafted WinRAR archives exploiting a known WinRAR vulnerability. The attacks aim to deploy reverse shells, enabling persistent remote access to compromised systems. The use of multiple infection vectors suggests a sophisticated and adaptable threat actor. The targeting of CIS government entities indicates likely espionage motivations. The exploitation of WinRAR flaws combined with living-off-the-land techniques makes detection challenging.
Bekijk origineel advisory →NGINX released versions 1.30.6 and 1.31.7 on October 14 to address five vulnerabilities. Three of the flaws are memory bugs that could crash worker processes or potentially allow remote code execution, each requiring specific configurations to exploit. A fourth vulnerability allows an attacker to forge a TLS session, potentially bypassing client certificate checks. One of the vulnerabilities has been present in every NGINX release since May 2005. F5, the company behind NGINX, disclosed these issues. The fixes are critical for organizations relying on NGINX for web serving, proxying, or TLS termination.
Bekijk origineel advisory →Next.js released an out-of-band security update on October 14 addressing two critical remote code execution vulnerabilities and one high-severity denial-of-service flaw. The first RCE flaw resides in React Server Components, potentially allowing unauthenticated attackers to execute arbitrary code. The second RCE vulnerability is in librsvg, an open-source library used by Next.js via the 'sharp' package for SVG image processing. Both flaws are critical severity and require no authentication to exploit. An out-of-band patch was issued outside the normal release cycle, indicating urgency. Administrators and developers using Next.js are urged to apply the fixes immediately. The combination of server-side and image-processing attack surfaces broadens the potential impact across Next.js deployments.
Bekijk origineel advisory →Drupal has disclosed a critical remote code execution vulnerability in its Field UI module affecting Drupal core. The flaw was patched on October 14 in versions Drupal 11.4.10, 11.3.19, and 10.6.19. While the vulnerability cannot be exploited through core alone, multiple exploit paths exist via contributed modules. At least one known exploit path requires no authentication, making it especially dangerous. The Drupal Security Team issued an advisory urging users to update immediately. Sites running contributed modules that interact with Field UI are at highest risk. The unauthenticated path significantly raises the severity of this vulnerability.
Bekijk origineel advisory →CISA issued an ICS advisory (ICSA-26-280-01) disclosing seven vulnerabilities in CISA Malcolm, a network traffic analysis tool used in critical infrastructure sectors including Energy, IT, and Water/Wastewater. Affected versions include Malcolm <=v26.07.1 and <=v26.08.0. The vulnerabilities include Authentication Bypass by Spoofing (CVE-2026-107336), Incorrect Authorization via URL path normalization (CVE-2026-107333, CVE-2026-107334), Server-Side Request Forgery via FilePond PHP server (CVE-2026-107362), Authentication Bypass through Arkime's direct port exposure (CVE-2026-107361), Cross-Site Request Forgery on the kiosk Flask app (CVE-2026-107337), and a Gzip bomb / data amplification vulnerability (CVE-2026-107335). The highest CVSS v3.1 score is 8.1 (HIGH) for CVE-2026-107333. Patches are available in Malcolm v26.08.0 and v26.09.0 depending on the CVE. The vulnerabilities were reported by Seth Grover of Idaho National Laboratory. No known public exploitation has been reported at this time.
Bekijk origineel advisory →CISA has published an ICS advisory for Guangzhou Juan IoT Technology EseeCloud, affecting both the EseeCloud App (<=4.9.6) and EseeCloud Firmware (<=4.9.86.0). Three vulnerabilities were identified: CVE-2026-107617 (Use of Hard-coded Credentials, CVSS 9.8 Critical), CVE-2026-97858 (Improperly Controlled Modification of Dynamically-Determined Object Attributes, CVSS 5.3 Medium), and CVE-2026-105664 (Observable Response Discrepancy enabling device enumeration, CVSS 5.3/8.7). Successful exploitation could allow attackers to gain full control over affected IP cameras, hijack device ownership, or enumerate registered devices at scale. The vulnerabilities affect critical infrastructure sectors worldwide including Energy, Communications, Transportation, Financial Services, and Government. The vendor did not respond to CISA's coordination attempts, leaving no official patch available. Users are advised to minimize network exposure, use firewalls, and employ VPNs for remote access. Vulnerabilities were reported by Donghyeon Lee of Tokyo University of Science and GMO Flatt Security.
Bekijk origineel advisory →CISA has published an ICS medical advisory (ICSMA-26-288-02) detailing six vulnerabilities in J4Care dcm4chee-arc-light version 5.35.1, a medical imaging archive platform used worldwide in healthcare. The vulnerabilities include Missing Authorization (CVE-2026-97851), two Infinite Loop issues in JPEG and MP4 parsers (CVE-2026-107621, CVE-2026-105273), Inefficient Algorithmic Complexity in multipart stream handling (CVE-2026-101021), and two Missing Authentication for Critical Function flaws affecting DICOM associations and HL7 listener (CVE-2026-105279, CVE-2026-105667). Successful exploitation could allow attackers to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause denial-of-service. The highest CVSS v3.1 score is 9.1 (Critical), with some CVEs reaching 9.3 under CVSS v4.0. J4Care has released version 5.35.2 as the fix. These vulnerabilities were reported by Abhinav Agarwal to CISA, and no known active exploitation has been reported at the time of publication.
Bekijk origineel advisory →The GhostAction credential-theft campaign has significantly escalated, targeting over 30,000 repositories across 3,000 users and organizations on GitHub. The surge was observed on October 8 and 9, 2026, according to security firm GitGuardian. Approximately 1,900 GitHub accounts were compromised during the campaign. Attackers attempted to extract 3,174 secrets from public repositories' CI pipelines. The campaign represents a large-scale supply chain threat targeting developer credentials and sensitive secrets stored in CI/CD environments. The scale of the attack highlights ongoing risks to open-source and developer ecosystems hosted on GitHub.
Bekijk origineel advisory →The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice managing the Public Defender Service, suffered a significant data breach. Attackers breached its IT systems in April 2025 and exfiltrated records dating as far back as 1978. The breach represents a major exposure of highly sensitive legal and personal data spanning nearly five decades. The LAA oversees legal aid funding in England and Wales, meaning the stolen data likely includes sensitive personal and legal information of vulnerable individuals. The scale and historical depth of the breach raises serious concerns about data retention practices and legacy system security. This incident highlights the risks of retaining large volumes of historical data without adequate protection.
Bekijk origineel advisory →A critical remote code execution vulnerability (CVE-2026-105740, CVSS 9.9) in Langflow, an open-source AI application and agentic workflow platform, is being actively exploited by threat actors. Security firm Previdian issued an alert regarding the exploitation activity. Langflow is maintained by DataStax, which was acquired by IBM in February 2025. The vulnerability is classified as an authenticated RCE flaw, indicating attackers need some level of authentication to exploit it. Honeypot data reveals 1,423 exploit attempts have been recorded, demonstrating active and widespread exploitation in the wild. The high CVSS score of 9.9 underscores the severity of the flaw. Organizations using Langflow are strongly advised to patch or mitigate immediately given the active exploitation.
Bekijk origineel advisory →Singapore-based Ahsay Backup has released security updates to address two critical vulnerabilities in AhsayCBS (CVE-2026-105133 and CVE-2026-105134). These flaws have been actively exploited by threat actors to deploy web shells and XMRig cryptocurrency miners on affected systems. The vulnerabilities can be chained together to bypass authentication and execute arbitrary commands. New patches have been issued after initial fixes were found to be incomplete. The exploitation of these flaws highlights the risk of backup software being targeted as an attack vector. Organizations using AhsayCBS are urged to apply the latest security updates immediately.
Bekijk origineel advisory →Palo Alto Networks released security updates addressing a high-severity remote code execution (RCE) vulnerability in PAN-OS software. The flaw, tracked as CVE-2026-0322 with a CVSS score of 8.6, resides in the management interface of PAN-OS. The vulnerability allows authenticated remote attackers to execute arbitrary code. The issue is under active exploitation in the wild, making patching urgent. Palo Alto Networks issued the patches on Wednesday alongside the public disclosure. Organizations using affected PAN-OS versions are urged to apply updates immediately to mitigate risk.
Bekijk origineel advisory →