Overzicht van binnengekomen advisories.
2179 resultaten gevonden
Cybersecurity professionals are being targeted through malicious security projects hosted on GitHub. These fake tools are designed to appear legitimate but contain backdoors and information-stealing malware. The campaign specifically targets security researchers and professionals who are likely to download and test security-related tools. Once installed, the malware can establish persistent access via backdoors and exfiltrate sensitive information from compromised systems. This represents a supply chain-style attack leveraging the trust developers place in GitHub-hosted repositories. The targeting of security professionals is particularly concerning as they often have elevated access to sensitive systems and data.
Bekijk origineel advisory →Socket's Threat Research Team discovered strutil-core 1.0.1, a malicious RubyGems package published by account 'jamnajiea' that embeds a 5.48 MB credential-stealing worm derived from the Shai-Hulud toolkit, identified as a new build of the testmetest worm from the Miasma family. The gem uses a native extension hook (extconf.rb) to download the Bun JavaScript runtime and execute a payload at install time, stealing credentials from cloud providers, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets, exfiltrating them to paleasbest[.]top. The worm self-propagates by injecting itself into gems, npm, and PyPI packages using stolen API keys, and installs a Python backdoor (sync.py) controlled via signed GitHub commit messages. It poisons AI coding tools by writing malicious MCP server configs, session hooks, and agent instruction files both locally and into repositories. A particularly destructive feature is a 'wiper' that deletes the user's home directory if a stolen GitHub token is revoked (returning HTTP 401/403). Socket's AI Scanner flagged the malicious version 70 seconds after publication; RubyGems removed both versions approximately five hours after the malicious release. A related PyPI package, pystr-codec, shares the same C2 endpoint.
Bekijk origineel advisory →QNAP has issued an urgent warning to users to update Plex Media Server to the latest version available through the QNAP App Center. Threat actors are actively exploiting a vulnerability chain known as Plex2Shell to breach QNAP NAS devices. The attack leverages weaknesses within Plex Media Server running on QNAP systems to gain unauthorized access. QNAP has advised all users running Plex Media Server on their NAS devices to apply the latest security updates immediately. The campaign represents an active exploitation effort targeting network-attached storage devices, which often contain sensitive data. Users who fail to update may remain exposed to remote compromise of their NAS systems.
Bekijk origineel advisory →A security researcher at Picus Security, Umut Bayram, discovered that some WordPress sites remain vulnerable during the installation of a patch for an actively exploited flaw. The update process unpacks files using the old, unpatched code, creating a race condition window during which an attacker can execute code on the server. This means that even sites attempting to remediate a known vulnerability can be attacked at the precise moment of patching. The researcher advises blocking web access during the update process to mitigate this risk. The flaw is actively being exploited in the wild, making the timing of patching particularly critical. This issue highlights a broader challenge in patch management where the remediation process itself can introduce a temporary attack surface.
Bekijk origineel advisory →A newly disclosed vulnerability in OpenSSH, tracked as CVE-2026-123158 with a CVSS score of 8.1 and codenamed SSHole, is being actively exploited by threat actors within hours of its public disclosure. The flaw allows attackers to sign into accounts that have no password set, effectively enabling unauthorized access. It affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Exploitation has been confirmed on honeypot systems, where attackers successfully gained root access. The rapid exploitation timeline underscores the urgency for affected system administrators to apply mitigations. Research and reporting on the active exploitation was conducted by Previdian. The vulnerability's high CVSS score and ease of exploitation make it a critical threat to unpatched systems.
Bekijk origineel advisory →Blockchain intelligence firm Chainalysis disclosed a security breach affecting its systems and internal tools. The attack resulted in the exposure of credentials and live tokens for all of its customers. The breach is significant given Chainalysis's role as a major provider of blockchain analytics and intelligence to government agencies, financial institutions, and cryptocurrency businesses. The exposure of live tokens is particularly critical as it could allow attackers to impersonate customers or access their accounts in real time. The full scope of the breach and the attack vector have not been fully detailed in the article. Affected customers are at risk of account takeover and unauthorized access to sensitive blockchain investigation data. Immediate credential rotation and token invalidation would be essential remediation steps.
Bekijk origineel advisory →D-Link has issued a warning regarding multiple unpatched zero-day security vulnerabilities affecting its DGS-3130 series managed Gigabit stackable switches. The company has shared mitigation measures as the flaws remain unpatched. The DGS-3130 series are enterprise-grade managed switches used in network infrastructure environments. The vulnerabilities being zero-days means no official patch is currently available, increasing risk for affected organizations. D-Link's advisory focuses on workarounds and mitigations to reduce exposure until patches are developed. Network administrators using these switches are advised to implement the recommended mitigations immediately. The lack of patches makes this a significant concern for enterprise network security.
Bekijk origineel advisory →Blockchain analysis firm Chainalysis suffered a significant data breach resulting from an agentic cyber attack targeting its systems. The breach exposed sensitive user information including names, usernames, password hashes, and live tokens for all users. In response, Chainalysis temporarily shut down access to its Reactor and Data Solutions services. The company stated that its ongoing investigation found no evidence that investigations data was accessed. The incident represents a critical compromise of a major blockchain intelligence platform used widely by law enforcement and financial institutions.
Bekijk origineel advisory →Researchers at QiAnXin's XLab discovered a backdoor embedded in the web server component of Control Web Panel (CWP), a widely used free hosting management panel for Linux servers. The backdoor allows attackers to execute arbitrary commands via crafted web requests, with the malicious traffic intentionally excluded from the server's access logs, making detection extremely difficult. Installation of the backdoor requires root-level access, indicating that the threat actors had already fully compromised the target systems prior to planting it. The stealthy nature of the implant — combining command execution capability with log evasion — suggests a sophisticated, persistent threat actor. CWP is used by a large number of Linux hosting providers, potentially widening the attack surface. The backdoor represents a significant supply-chain-style risk for server administrators relying on CWP. No specific CVE has been mentioned in the article. The incident highlights the ongoing targeting of server management software as a vector for persistent access.
Bekijk origineel advisory →Two vulnerabilities in Barracuda's Email Security Gateway (ESG) appliance can be chained together to achieve unauthenticated root-level command execution. One of the flaws, CVE-2026-116606, is an authorization bypass that allows unauthenticated attackers to interact with the device without credentials. When combined with a second vulnerability, an attacker can run arbitrary commands as root, the highest privilege level on the system. Barracuda released patches on Monday following discovery of the flaws. Security firm watchTowr publicly detailed the attack chain on Thursday after patches were available. The vulnerabilities represent a critical risk to organizations using the ESG appliance for email filtering. No login is required to exploit the chain, making it particularly dangerous for internet-exposed devices.
Bekijk origineel advisory →The FBI and CISA have issued a joint warning about active cyberattacks targeting industrial refrigeration and cold-chain monitoring systems globally. Threat actors are exploiting vulnerabilities in these operational technology (OT) and industrial control systems (ICS). The attacks pose significant risks including food spoilage, equipment damage, and potential fire hazards. Cold-chain systems are critical to food safety, pharmaceutical storage, and supply chain integrity. The advisory highlights the growing threat to critical infrastructure beyond traditional IT targets. Organizations operating refrigeration and cold-chain environments are urged to review their cybersecurity posture and apply recommended mitigations. This aligns with a broader trend of threat actors increasingly targeting ICS and OT environments with potentially physical consequences.
Bekijk origineel advisory →Hackers are conducting phishing campaigns using fake event invitations impersonating high-profile organizations such as OpenAI, SpaceX, and Anthropic. The attacks target employees and aim to steal Microsoft and Google account credentials along with authentication session tokens. Two different phishing-as-a-service (PhaaS) platforms are being leveraged to carry out these attacks at scale. The lure of prestigious tech events makes these invitations particularly convincing to potential victims. By stealing session cookies in addition to credentials, attackers can bypass multi-factor authentication protections. The campaign highlights the growing sophistication and commoditization of phishing infrastructure available to threat actors.
Bekijk origineel advisory →A newly disclosed OpenSSH vulnerability nicknamed '*sshole' allows attackers to authenticate into Linux accounts that have password authentication explicitly disabled. The flaw affects Alpine Linux and other musl libc-based Linux distributions. Attackers can exploit the vulnerability simply by submitting an oversized password string, bypassing the expected authentication block. This represents a significant authentication control bypass, particularly in environments relying on musl-based distributions for lightweight or container workloads. The issue is rooted in how musl libc handles password validation compared to glibc. Systems configured to disable password logins may falsely assume they are protected from password-based attacks. The vulnerability highlights risks in assumed security configurations on hardened or minimal Linux systems. Organizations using Alpine Linux in container environments (e.g., Docker) may be especially exposed.
Bekijk origineel advisory →A critical vulnerability in OpenSSH allows attackers to bypass SSH authentication on Alpine Linux servers running the standard openssh-server package. The flaw enables login to accounts with no password, including SSH key-only accounts, using a password between 257 and 1,024 bytes long. Attackers only need network access, a valid account name, and the specially sized password to exploit the issue. OpenSSH has rated the vulnerability as critical and released version 10.6p2 as an emergency fix. Alpine Linux has also published patched packages for all affected versions. The vulnerability is particularly dangerous as it undermines key-based authentication, a widely trusted security mechanism.
Bekijk origineel advisory →A new Linux malware named CWPdoor is being distributed through a trojanized version of cwpsrv, the web server component of the Control Web Panel (CWP) server management interface. Attackers are leveraging this trojanized binary to backdoor Linux servers, gaining persistent unauthorized access. The malware targets systems running CWP, a widely used Linux server management panel. The attack involves replacing the legitimate cwpsrv binary with a malicious version that contains backdoor functionality. This supply chain-style attack vector makes detection difficult as the malware masquerades as a legitimate system component. Linux server administrators using CWP are advised to verify the integrity of their cwpsrv binaries and monitor for suspicious activity.
Bekijk origineel advisory →This ThreatsDay roundup covers multiple cybersecurity incidents including a remote code execution vulnerability in Apache OFBiz, a data breach at DreamHost, and hijacking attacks targeting DeFi websites. The article highlights how stolen credentials can cascade across multiple systems, and how trusted configurations can be weaponized to lock users out. It also notes that simple file operations can expose sensitive data in unintended locations. The piece underscores a persistent patching gap, with some critical systems remaining unpatched for months or even over a year. New security tooling is emerging to accelerate vulnerability discovery, but remediation timelines remain a major concern. In total, the roundup covers 20 or more distinct security stories.
Bekijk origineel advisory →CVE-2026-109518 is a critical vulnerability in the APT package manager that allows attackers to swap packages after the verification step, enabling arbitrary code execution with root privileges. The flaw targets the window between package verification and installation, a classic time-of-check to time-of-use (TOCTOU) style attack. The article advises patching vulnerable APT clients immediately to mitigate risk. It also highlights the use of StepSecurity's Harden-Runner tool to detect HTTP-based package downloads and monitor CI/CD pipeline activity for signs of exploitation. The vulnerability poses significant risk to Linux-based systems relying on APT for package management. Supply chain integrity is a key concern, as attackers could substitute malicious packages in automated build and deployment environments. Organizations using CI/CD pipelines are particularly at risk if they download packages over unprotected channels. The article serves both as a technical advisory and a promotion of StepSecurity's tooling for detection and response.
Bekijk origineel advisory →In October 2026, a new wave of cyber threats targeted US businesses, exploiting trusted platforms, legitimate authentication processes, and common business workflows. The article outlines five active campaigns that posed significant risks to enterprises, including potential financial losses, data breaches, and operational disruption. Attackers leveraged everyday business tools and trusted services to bypass traditional defenses. The campaigns collectively represent a broad and evolving threat landscape for US organizations. The article serves as a threat briefing for security teams to understand and mitigate active risks. Each threat vector highlights the increasing sophistication of adversaries targeting enterprise environments.
Bekijk origineel advisory →CERT-In has identified an active threat actor known as Crafty Falcon targeting India's Banking, Financial Services, and Insurance (BFSI) sector. The threat actor leverages AI-assisted offensive security tools to conduct attacks. A backdoored Docker image for ARTEX AI has been linked to the campaign, exposing 62 consoles to root access. The activity is described as ongoing and sophisticated. The use of publicly available AI-driven tools marks a notable evolution in the threat landscape. CERT-In has flagged this as a high-priority concern for financial sector organizations in India.
Bekijk origineel advisory →Zyxel GS1900 network switches remain vulnerable to an actively exploited zero-day flaw despite a previously released patch. Researchers at Binarly discovered that the earlier fix (firmware version 2.90) failed to fully remediate the vulnerability. The exploit allows unauthenticated attackers who can reach the switch's web management interface to execute arbitrary commands with root privileges. Zyxel has responded by releasing new firmware for 10 affected GS1900 switch models. The flaw is particularly critical as it requires no authentication and targets network infrastructure devices. Organizations using GS1900 switches should apply the latest firmware immediately to close the exposure.
Bekijk origineel advisory →