Overview of incoming advisories.
2179 results found
Cybersecurity researchers from CloudSEK and Checkmarx have uncovered a long-running npm supply chain malware campaign dubbed MALFEX. A lone threat actor has published 12 malicious npm packages since August 2023, eight of which have been downloaded over 40,767 times. The packages deliver the Overlord RAT and an information stealer to compromised hosts. The campaign represents a sustained effort to abuse the npm ecosystem for malware distribution. The malicious packages masquerade as legitimate ones to trick developers into installing them. Once installed, they establish remote access and exfiltrate sensitive information from victim systems.
View original advisory →SonicWall has released hotfixes addressing four vulnerabilities in its SMA1000 appliances, which are used to provide remote workers access to corporate networks and applications. The most critical flaw has been rated CVSS 10.0, the highest possible severity score. This vulnerability is a Server-Side Request Forgery (SSRF) flaw that can be exploited without authentication, allowing attackers to send requests through the appliance and access internal functions. SonicWall has stated there is no evidence of active exploitation of any of the four vulnerabilities at the time of disclosure. The patches were released as hotfixes, indicating urgency in remediation. Organizations using SMA1000 appliances are strongly advised to apply the hotfixes immediately given the critical nature of the vulnerability.
View original advisory →Socket Threat Research identified a coordinated campaign of 16 malicious Firefox extensions targeting cryptocurrency wallet users, specifically impersonating Rabby Wallet and OKX Wallet. The extensions intercept recovery phrases and private keys during wallet import flows and exfiltrate them to attacker-controlled Cloudflare Workers. Four extensions clone Rabby Wallet under the misspelled brand 'Raabby WaIIet', while twelve clone OKX Wallet under a 'Portal WALLET' facade. All extensions share a common campaign marker 'EQOx7EIPZSNi' and primarily use the same Cloudflare Worker infrastructure at 'icy-star-f45c.workers.dev'. The campaign uses multiple exfiltration transports including GET requests, POST JSON, sendBeacon, and image-pixel fallbacks. Mozilla unpublished all 16 extensions as of October 5th. This campaign is assessed with high confidence to be a continuation of a crypto-theft extension campaign Socket previously identified in August 2026. Affected users should treat exposed wallets as fully compromised and immediately migrate assets to new wallets.
View original advisory →A critical unpatched vulnerability has been discovered in LMCache, an open-source caching layer designed to accelerate large language model (LLM) servers like vLLM. The flaw resides in LMCache's multiprocess mode, where the cache operates as a standalone server communicating with LLM workers via the ZeroMQ messaging library. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the cache server without any credentials. No fixed version is currently available, leaving all users of the affected component exposed. The vulnerability is particularly concerning given the growing adoption of LLM infrastructure in enterprise and cloud environments. The use of ZeroMQ without proper authentication mechanisms appears to be the root cause of the issue. Organizations running LMCache in multiprocess mode are advised to isolate the service from untrusted networks as a temporary mitigation.
View original advisory →A new malware family named PoeLLM has been identified targeting exposed AI and large language model (LLM) infrastructure. The financially motivated campaign, dubbed Canto Incognito, has compromised over 3,400 servers. The malware deploys cryptocurrency miners and expands a botnet by leveraging vulnerable AI/LLM endpoints. Cybersecurity researchers are raising alarms about the scale and sophistication of the operation. The campaign highlights growing risks to AI infrastructure as it becomes an increasingly attractive attack surface for threat actors seeking computational resources for crypto mining.
View original advisory →On October 5th, Atlassian released patches for multiple products addressing an 'Arbitrary File Access' vulnerability tracked as CVE-2026-21589. The vulnerability allows attackers to read arbitrary files within the web application's directory. This could expose sensitive information such as configuration files. Active scanning for this vulnerability has been detected as of October 7th. The flaw impacts multiple Atlassian products. The vulnerability was publicly disclosed alongside patches, which typically accelerates exploitation attempts. Security teams are advised to apply patches immediately. The scanning activity suggests threat actors are actively probing for unpatched systems.
View original advisory →A critical vulnerability tracked as CVE-2026-21589 has been discovered affecting multiple Atlassian product families including Jira, Confluence, and Bitbucket. The flaw allows attackers to exploit the systems without requiring any authentication, making it particularly dangerous. Following the public release of a proof-of-concept (PoC) exploit, threat actors have begun actively exploiting the vulnerability in real-world attacks. The unauthenticated nature of the exploit significantly lowers the barrier for attackers. Organizations using affected Atlassian products are urged to apply patches immediately to mitigate risk.
View original advisory →The FBI and Secret Service (USSS) have issued a joint warning that the FortiBleed credential harvesting campaign remains actively targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign exploits reused or leaked credentials combined with legacy SHA-256 password storage vulnerabilities to compromise devices. Over 86,644 Fortinet device credentials have been amassed by threat actors through this ongoing campaign. The advisory highlights the risks posed by poor credential hygiene and outdated password hashing mechanisms in widely deployed network security appliances. Organizations using Fortinet FortiGate devices are urged to rotate credentials, upgrade firmware, and review authentication configurations immediately.
View original advisory →A critical arbitrary file access vulnerability tracked as CVE-2026-21589 with a CVSS score of 9.3 has been disclosed affecting multiple Atlassian Data Center products. The affected products include Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, and Jira Software Data Center. Threat actors began attempting to exploit the flaw within two hours of public disclosure. The vulnerability allows unauthorized access to sensitive files under certain conditions. The rapid exploitation timeline highlights the urgency for organizations to patch affected Atlassian Data Center deployments immediately.
View original advisory →CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute an information-stealing malware known as LunexStealer, also referred to as Psychedelic Stealer. The campaign was observed in September 2026 and attributed to the threat cluster UAC-0277. The attack technique involves fake Cloudflare verification checks to trick users into executing the malware. The widespread nature of the campaign, affecting more than 100 websites, indicates a coordinated and large-scale operation. The malware is designed to steal sensitive information from infected systems. CERT-UA has not yet disclosed the identity of the threat actors behind UAC-0277.
View original advisory →Hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins: Ninja Forms and WPC Product Bundles for WooCommerce. The attacks leverage these flaws to install backdoors on compromised WordPress sites and create rogue administrator accounts. Both plugins have distinct vulnerabilities but are being exploited in related campaigns targeting WordPress installations. The exploitation is active in the wild, making this a high-priority security concern for WordPress site administrators. Site owners using either plugin are urged to update immediately to patched versions to prevent unauthorized access and potential full site compromise.
View original advisory →On the first day of Pwn2Own Ireland 2026, security researchers successfully exploited 32 zero-day vulnerabilities across various devices. The Samsung Galaxy S26 was hacked twice during the competition. Researchers earned a total of $388,500 in prize money for their successful exploits. The competition is a well-known security research event where participants compete to find and exploit previously unknown vulnerabilities. The high number of zero-days demonstrated in a single day highlights significant security weaknesses in modern devices. This event serves as a critical mechanism for responsible vulnerability disclosure to vendors.
View original advisory →Socket has launched experimental scanning support for VS Code Marketplace extensions, covering 100,000+ extensions alongside existing Open VSX coverage. The initiative was prompted by real-world attacks, including a GitHub breach originating from a malicious update to the Nx Console VS Code extension, which led to exfiltration of approximately 3,800 internal repositories. Socket's GlassWorm investigation uncovered a cluster of malicious VS Code and Open VSX extensions disguised as color themes, some using encrypted JavaScript and a Solana dead drop to execute additional payloads. The scanning capability detects risky behaviors including unauthorized file system access, suspicious network activity, process execution, obfuscated code, and hidden functionality. The article highlights that even previously vetted extensions can be weaponized through automatic updates without developer awareness. Socket's analysis covers code, activation patterns, dependencies, and capabilities to help security teams make informed decisions about extension adoption.
View original advisory →Cybersecurity researchers have uncovered a human-operated phishing platform that impersonates advertising products for major AI chatbots including Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The fake portals pose as legitimate advertising tools offering services such as campaign optimization, spend audits, and business-account connections. The primary objective of these portals is to capture user credentials and multi-factor authentication (MFA) codes from victims. The platform targets businesses and individuals who manage advertising campaigns on AI platforms. The operation is human-operated, suggesting active involvement during attacks rather than fully automated phishing. This campaign exploits the growing popularity and trust in AI-based tools to lure victims. The threat represents a significant risk to organizations using AI advertising services, as credential and MFA theft can lead to full account takeover.
View original advisory →Linux backdoors have been discovered targeting telecom and network appliances in South Korea and Taiwan. The malware disguises its network traffic to resemble legitimate email services and processes to evade detection. Threat actors employ a defense evasion technique of naming malicious software after legitimate operating system components or processes. By borrowing names of real binaries, the malware blends into normal system activity. The campaign specifically focuses on telecom and network infrastructure sectors in the targeted regions. This represents a sophisticated approach to maintaining persistence while avoiding security tools.
View original advisory →Atlassian has issued a warning about a critical vulnerability tracked as CVE-2026-21589 affecting multiple self-hosted Data Center products including Confluence, Jira, and Bitbucket. The flaw allows arbitrary file-access, posing significant risks to organizations running these platforms on-premises. Atlassian is urging customers to apply patches or mitigations promptly. The vulnerability impacts Data Center editions of the affected products, which are widely used in enterprise environments for project management and collaboration. No details on active exploitation were mentioned, but the critical severity rating underscores the urgency of remediation.
View original advisory →UK fashion retailer ASOS confirmed a data breach after hackers sent unauthorized push notifications through its mobile app claiming to have stolen customer data. The attackers accessed ASOS's Snowflake cloud environment and used the app's push notification system to alert customers of the breach themselves. The incident highlights ongoing targeting of Snowflake-hosted data environments by threat actors. ASOS is investigating the scope of the breach and what customer data may have been compromised. The use of in-app notifications by the attackers was an unusual method to publicize the breach directly to customers.
View original advisory →A malicious campaign is targeting advertising account managers by creating fake websites impersonating popular AI services including ChatGPT, Gemini, Claude, and Perplexity. The attackers use browser-in-browser (BitB) attack techniques to steal login credentials and multi-factor authentication (MFA) codes. The campaign is specifically aimed at people managing advertising accounts, suggesting the goal is to hijack ad accounts for financial gain or fraudulent advertising. Browser-in-browser attacks render a fake browser window within the real browser, making phishing pages appear legitimate with convincing URLs. The stolen MFA codes allow attackers to bypass two-factor authentication protections. This campaign highlights the exploitation of AI brand recognition to lend credibility to phishing sites. Ad account takeovers can result in significant financial losses and misuse of advertising budgets.
View original advisory →A critical buffer overflow vulnerability (CVE-2026-15340) has been identified in Savannah lwIP SMTP client version 2.2.1. The flaw exists because the software does not check the size of inputs, potentially allowing a classic buffer overflow condition. Successful exploitation could crash the affected device or allow remote code execution. The vulnerability has a CVSS v3.1 score of 9.8 (CRITICAL) and a CVSS v4.0 score of 9.3 (CRITICAL), with a network-based attack vector requiring no privileges or user interaction. Affected critical infrastructure sectors include Energy, Water and Wastewater Systems, with worldwide deployment. A fix has been released by xchglabs as patch_125_smtp_txbuf.diff, available via git commit 614420f82c8729d070e01464c0dddb3c9525c772. CISA recommends minimizing network exposure, using firewalls, and employing VPNs for remote access as defensive measures.
View original advisory →Hitachi Energy has disclosed a critical Remote Code Execution (RCE) vulnerability (CVE-2026-34197) in the Apache ActiveMQ component used in its SOI product versions 2.0.0 through 2.2.0. The vulnerability stems from improper input validation and code injection issues in Apache ActiveMQ's Jolokia JMX-HTTP bridge, which exposes exec operations on ActiveMQ MBeans by default. An authenticated attacker can exploit this by invoking broker operations with a crafted URI that loads a remote Spring XML application context, leading to arbitrary code execution on the broker's JVM. The CVSS v3.1 base score is 8.8 (HIGH), impacting confidentiality, integrity, and availability. The fix involves applying patch SOI EP2, which upgrades ActiveMQ to version 5.19.5 and includes additional component upgrades. This affects critical infrastructure in the energy sector and is deployed worldwide. The vulnerability was reported internally by Hitachi Energy's own team to CISA.
View original advisory →