Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Multiple Atlassian products are affected by a files or directories accessible to external parties vulnerability tracked as CVE-2026-21589. The vulnerability impacts Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. An unauthenticated attacker could exploit this flaw to access specific files within the web application root directory. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in CISA's BOD 26-04 implementation guidance. The vulnerability is rated High criticality and requires prompt patching across all affected Atlassian Data Center products.
Bekijk origineel advisory →Palo Alto Networks has issued security updates addressing a high-severity remote code execution (RCE) zero-day vulnerability in PAN-OS, tracked as CVE-2026-0322. The flaw has been actively exploited in attacks targeting firewalls. The vulnerability poses significant risk to organizations relying on Palo Alto Networks firewall products. Users are urged to apply the released patches immediately to mitigate exposure. The exploitation of this zero-day highlights ongoing threats to network perimeter security devices.
Bekijk origineel advisory →Unit 42 investigated an intrusion campaign exploiting CVE-2024-47575, a critical vulnerability in Fortinet's FortiManager. Attackers leveraged this flaw to compromise over 500 FortiGate firewalls. The campaign deployed PEERSTITCH, a stealthy memory-resident implant compiled for ARM64 architecture. PEERSTITCH is designed to persist in memory, making forensic detection significantly more difficult. The malware targets FortiGate network devices, indicating a focus on network infrastructure compromise. The scale of the attack (500+ firewalls) suggests a well-resourced and organized threat actor. This intrusion highlights the ongoing risk of unpatched network appliances being targeted for espionage or persistent access.
Bekijk origineel advisory →The U.S. Department of Justice disrupted the Famous Chollima threat group, a North Korean state-sponsored operation that places IT workers remotely at foreign companies. The FBI raided laptop farms in Texas used to facilitate these schemes. Two suspects were arrested and 14 individuals were charged in connection with the operation. Nearly 187 laptops were seized as part of the enforcement action. The scheme involves North Korean nationals posing as remote IT workers to gain employment at US companies. The operation generates revenue for the North Korean regime and potentially enables insider threat activities. This is part of a broader US government effort to counter DPRK cyber and financial operations.
Bekijk origineel advisory →Cisco has patched a critical vulnerability in Cisco Secure Email Gateway affecting the Advanced Malware Protection (AMP) feature. The flaw lies in how AMP processes email attachments when the file reputation service is enabled. An unauthenticated remote attacker can exploit this to write arbitrary files to the underlying operating system. Successful exploitation can lead to command execution with root privileges, severely impacting system integrity. Cisco has confirmed active exploitation in the wild and has shared Indicators of Compromise and background information. No public Proof-of-Concept or exploit code is currently known, but NCSC considers it likely that one will emerge shortly. NCSC anticipates increased scanning traffic and exploitation attempts as a result.
Bekijk origineel advisory →Cisco has issued an advisory warning of active exploitation of a critical vulnerability in Cisco Secure Email Gateway. The flaw allows an unauthenticated attacker to write arbitrary files to the appliance's operating system simply by sending a crafted email attachment through the gateway. If the attack succeeds, the attacker can execute commands with root privileges on the affected appliance. The vulnerability requires no login credentials, making it particularly dangerous. Cisco Secure Email Gateway is widely used by organizations to filter inbound and outbound email for spam and malware. The active exploitation status elevates the urgency for organizations to patch or mitigate immediately. The advisory was released on a Wednesday, indicating a mid-cycle emergency disclosure likely due to observed in-the-wild attacks.
Bekijk origineel advisory →Ledger, a prominent hardware cryptocurrency wallet manufacturer, has instructed resellers and distributors across multiple Asian countries to suspend sales and remove products from shelves. The affected regions include Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. The action comes as Ledger investigates a supply chain attack involving suspected device tampering. This type of attack can involve malicious actors physically modifying hardware wallets before they reach end users, potentially allowing theft of cryptocurrency private keys or funds. Supply chain attacks on hardware devices are particularly dangerous as end users typically trust devices purchased through official channels. The investigation is ongoing and the full scope of the tampering has not yet been disclosed.
Bekijk origineel advisory →Attackers exploited a critical vulnerability in the Collabora Online - Built-in CODE Server, an optional app for Nextcloud, to plant web shells on affected servers. The web shells allow attackers to execute arbitrary commands with the privileges of the web server account. At least three Nextcloud administrators reported the issue on GitHub, with the first confirmed attack occurring on September 10. A web shell is a small malicious file that executes commands sent via web requests. The attack vector is the optional Collabora Online integration, which is widely used for document editing within Nextcloud. The incident highlights risks associated with third-party integrations in self-hosted cloud platforms. Server administrators running Collabora's CODE app are strongly advised to patch or disable the component immediately.
Bekijk origineel advisory →Cisco has released patches for a newly discovered zero-day vulnerability in its Secure Email Gateway (SEG) product. The flaw allows remote unauthenticated attackers to execute arbitrary commands with root privileges, making it critically severe. The vulnerability was actively exploited in the wild at the time of disclosure. No authentication is required to exploit the flaw, significantly lowering the barrier for attackers. Cisco's patch addresses the issue and customers are urged to update immediately. This is described as 'another' zero-day, suggesting prior vulnerabilities in the same product have been exploited. The impact is broad given the widespread enterprise use of Cisco's email security appliances.
Bekijk origineel advisory →Microsoft, Health-ISAC, Japan Cybercrime Control Center (JC3), and private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs jointly disrupted three phishing kits: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. Since January 2026, the threat actors behind these kits have been responsible for over 1 billion scam messages. The operation represents a significant cross-sector and international collaboration to take down large-scale phishing infrastructure. These phishing kits were used to conduct widespread scam campaigns targeting a broad range of victims. The disruption highlights the growing trend of coordinated public-private partnerships in combating cybercrime.
Bekijk origineel advisory →CISA has issued an urgent warning to security administrators to immediately patch a critical vulnerability in Ivanti Connect Secure (ICS) that has been actively exploited as a zero-day since at least October 1st. The flaw poses significant risk to organizations using the affected product. CISA's advisory underscores the severity of the exploitation activity and the need for rapid remediation. The vulnerability allows threat actors to compromise systems running Ivanti Connect Secure without prior authentication or user interaction. Organizations are urged to apply available patches without delay to prevent potential breaches.
Bekijk origineel advisory →CISA has issued an urgent advisory for organizations to update their Ivanti Connect Secure (ICS) appliances due to an actively exploited authentication bypass vulnerability tracked as CVE-2026-104935 with a CVSS score of 8.6. The flaw allows attackers to bypass authentication on affected ICS deployments. Honeypot data has recorded 105 exploit attempts against this vulnerability, indicating active threat actor interest. CISA is urging immediate patching to the latest version of Ivanti Connect Secure. The vulnerability poses significant risk to organizations using ICS for remote access and VPN connectivity.
Bekijk origineel advisory →A new Android malware named Hirudo has been discovered that targets banking users by replacing legitimate banking applications with modified, malicious versions. These trojanized apps disable security checks that would normally detect fraudulent activity. The malware is designed to steal bank account credentials from victims. By substituting genuine apps with look-alike versions, Hirudo can evade standard mobile security mechanisms. This technique represents an advanced approach to banking fraud on Android devices. The malware's method of app replacement makes it particularly difficult for users to detect the compromise. Security researchers have flagged this as a significant threat to mobile banking security.
Bekijk origineel advisory →Security firm XBOW used OpenAI's publicly available GPT-5.6 Sol model to construct a full-chain Chrome exploit within six days. The attack chained three previously unknown Google Chrome vulnerabilities into a single exploit capable of executing arbitrary code on a Windows machine when a user visits a malicious web page. The exploit required no additional user interaction beyond loading the page. Google confirmed all three bugs, patched them, and paid XBOW its top bug bounty reward of $250,000. This research demonstrates a significant advancement in AI-assisted vulnerability discovery and exploit development. The use of AI agents to automate exploit chaining raises serious concerns about the democratization of advanced offensive security capabilities and the accelerating pace at which zero-day exploits can be developed.
Bekijk origineel advisory →A new Android banking trojan named Hirudo has been identified by Dutch mobile security firm ThreatFabric. The malware operates by replacing legitimate banking applications with purpose-built patched versions that are designed to bypass the apps' built-in security mechanisms from within. This technique represents a significant escalation in financial fraud tactics on the Android platform. Researchers found that Hirudo targets at least eight Indonesian banking apps. By patching the legitimate apps, the trojan can circumvent integrity checks and other security measures that would normally detect tampering. This approach allows attackers to intercept credentials and financial data while evading detection by the apps' own security layers.
Bekijk origineel advisory →An AI-powered pentesting agent autonomously discovered a critical authentication bypass vulnerability on a major insurance company's production website during an authorized security assessment. The flaw allowed users to specify where their one-time passcode (OTP) was sent during the login process, effectively enabling authentication bypass. The vulnerability was described as simple in nature but proving it on a live production system presented significant challenges. This case highlights the growing capability of AI agents in identifying security vulnerabilities during penetration testing engagements. The finding raises important questions about AI-driven security testing and responsible disclosure in production environments.
Bekijk origineel advisory →A critical vulnerability tracked as CVE-2026-74580 and named 'Vghost' has been discovered in Linux's vhost subsystem. The flaw allows local users to read and write kernel memory arbitrarily, enabling privilege escalation to root. It affects nearly a decade's worth of Linux kernel versions. In virtualization environments, the bug can be exploited by an untrusted virtual machine to write to the host's memory and hijack the hypervisor process, effectively breaking out of the guest VM. The vulnerability was discovered by Tencent Zhuque Lab using AI-assisted techniques. The combination of local privilege escalation and VM escape capabilities makes this a severe security risk for both standalone Linux systems and virtualized infrastructures.
Bekijk origineel advisory →CVE-2026-0322 is a code injection vulnerability affecting Palo Alto Networks PAN-OS. An authenticated attacker with network access can exploit this vulnerability to execute arbitrary code with root privileges on the affected firewall. The vulnerability is tracked by CISA and listed under BOD 26-04, which prioritizes security updates based on risk. CISA provides forensics triage requirements as part of the implementation guidance for this directive. The vulnerability is also documented in the NVD and Palo Alto Networks' own security advisory portal. The high criticality rating reflects the severity of potential root-level code execution on network security devices.
Bekijk origineel advisory →Ahsay AhsayCBS contains an improper authentication vulnerability tracked as CVE-2026-105133. A remote attacker can bypass authentication by manipulating the random parameter in the API component's checkSysPwd function. This vulnerability can be chained with CVE-2026-105134 to potentially increase the severity of exploitation. The issue is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. CISA has also published forensics triage requirements as part of the BOD 26-04 implementation guidance. Ahsay has released a patch addressing both CVE-2026-105133 and CVE-2026-105134. Organizations using AhsayCBS are strongly urged to apply the available patch immediately. The vulnerability poses a significant risk due to its remote exploitability and authentication bypass nature.
Bekijk origineel advisory →CVE-2026-76519 is a relative path traversal vulnerability affecting Cisco Secure Email Gateway (ESA). An unauthenticated, remote attacker could exploit this flaw to write arbitrary files on the underlying operating system, potentially leading to full system compromise. The vulnerability is tracked by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Cisco has published a security advisory detailing the issue and remediation steps. The vulnerability is rated High criticality. Organizations using Cisco Secure Email Gateway are advised to apply patches immediately and conduct forensic triage as outlined in CISA guidance.
Bekijk origineel advisory →