Overzicht van binnengekomen advisories.
2186 resultaten gevonden
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that resulted in fraudulent transactions totaling up to $133 million. The attack was carried out through a third-party service provider, highlighting the risks of supply chain and third-party vendor compromises in the financial sector. In response to the breach, the bank was forced to suspend certain systems to contain the damage. The incident underscores the growing threat of financially motivated cybercriminals targeting banks through their less-secured service providers. This type of attack vector—exploiting trusted third-party relationships—has become increasingly common in the financial industry. The scale of the financial loss makes this one of the more significant banking cyberattacks in recent European history.
Bekijk origineel advisory →SonicWall has released security updates addressing seven vulnerabilities in SonicOS firewalls. Among these is a critical SSL-VPN authentication bypass flaw that is actively being exploited in the wild. The vulnerability allows attackers to bypass multi-factor authentication protections on SSL-VPN deployments. Organizations using SonicWall firewalls are urged to apply the patches immediately. The active exploitation makes this a high-priority remediation effort for affected users.
Bekijk origineel advisory →CVE-2026-123158, nicknamed '*sshole', is a critical vulnerability affecting OpenSSH on Alpine Linux that enables password authentication bypass. The flaw is related to Alpine Linux's use of the musl libc library instead of glibc, which affects how OpenSSH handles authentication. The article covers lab results demonstrating the bypass, exposure conditions required for exploitation, and available fixes and mitigations. Alpine Linux is widely used in containerized environments, making this vulnerability particularly relevant to cloud-native and DevOps ecosystems. Users of Alpine-based systems running OpenSSH with password authentication enabled are potentially at risk. The article is published by StepSecurity, a supply chain security-focused firm, suggesting relevance to CI/CD and container security contexts.
Bekijk origineel advisory →Unit 42 from Palo Alto Networks has published an analysis of recent cyberattacks specifically targeting refrigeration systems across Europe. The article examines the nature and methods of these attacks against critical infrastructure components. It outlines defense and mitigation strategies for organizations operating refrigeration systems. The targeting of refrigeration infrastructure represents a significant threat to food supply chains, pharmaceutical storage, and industrial cooling systems. The report provides actionable guidance for defenders to protect these operational technology (OT) environments.
Bekijk origineel advisory →Ruby on Rails released security updates on November 4, 2026, addressing 21 vulnerabilities including a critical Active Storage flaw tracked as GHSA-f3w6-w445-fwh9 (CVSS 9.8). The vulnerability allows unauthenticated attackers to write arbitrary files to servers via crafted uploads when ImageMagick is used through the mini_magick variant processor. Exploitation can also lead to sensitive file reads and potentially remote code execution, including exposure of secret_key_base and application credentials. Affected versions include Rails 8.0.x and 8.1.x; patched releases are 8.0.5.2 and 8.1.4.1. MiniMagick must also be updated to version 5.1 or later. Socket has released a free Certified Patch for the critical vulnerability as an interim remediation for teams unable to upgrade immediately. Developers are advised to upgrade Rails, verify MiniMagick compatibility, review Active Storage configurations, and rotate potentially exposed credentials.
Bekijk origineel advisory →OpenAI has unveiled GPT-6 Cyber, a new artificial intelligence model specifically designed for cybersecurity research and vulnerability discovery. The model has identified 81 previously unknown high-severity vulnerabilities in Firefox and developed working exploits for 948 distinct Linux kernel flaws. This represents a significant milestone in AI-assisted vulnerability research, demonstrating the potential of large language models to autonomously discover and exploit security weaknesses at scale. The discovery raises important questions about the dual-use nature of AI in cybersecurity, as the same capabilities that enable proactive defense could also be leveraged offensively. The scale of vulnerabilities found across two major open-source projects highlights the profound impact AI-driven security research may have on the industry.
Bekijk origineel advisory →Cybersecurity professionals are being targeted through malicious security projects hosted on GitHub. These fake tools are designed to appear legitimate but contain backdoors and information-stealing malware. The campaign specifically targets security researchers and professionals who are likely to download and test security-related tools. Once installed, the malware can establish persistent access via backdoors and exfiltrate sensitive information from compromised systems. This represents a supply chain-style attack leveraging the trust developers place in GitHub-hosted repositories. The targeting of security professionals is particularly concerning as they often have elevated access to sensitive systems and data.
Bekijk origineel advisory →Socket's Threat Research Team discovered strutil-core 1.0.1, a malicious RubyGems package published by account 'jamnajiea' that embeds a 5.48 MB credential-stealing worm derived from the Shai-Hulud toolkit, identified as a new build of the testmetest worm from the Miasma family. The gem uses a native extension hook (extconf.rb) to download the Bun JavaScript runtime and execute a payload at install time, stealing credentials from cloud providers, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets, exfiltrating them to paleasbest[.]top. The worm self-propagates by injecting itself into gems, npm, and PyPI packages using stolen API keys, and installs a Python backdoor (sync.py) controlled via signed GitHub commit messages. It poisons AI coding tools by writing malicious MCP server configs, session hooks, and agent instruction files both locally and into repositories. A particularly destructive feature is a 'wiper' that deletes the user's home directory if a stolen GitHub token is revoked (returning HTTP 401/403). Socket's AI Scanner flagged the malicious version 70 seconds after publication; RubyGems removed both versions approximately five hours after the malicious release. A related PyPI package, pystr-codec, shares the same C2 endpoint.
Bekijk origineel advisory →QNAP has issued an urgent warning to users to update Plex Media Server to the latest version available through the QNAP App Center. Threat actors are actively exploiting a vulnerability chain known as Plex2Shell to breach QNAP NAS devices. The attack leverages weaknesses within Plex Media Server running on QNAP systems to gain unauthorized access. QNAP has advised all users running Plex Media Server on their NAS devices to apply the latest security updates immediately. The campaign represents an active exploitation effort targeting network-attached storage devices, which often contain sensitive data. Users who fail to update may remain exposed to remote compromise of their NAS systems.
Bekijk origineel advisory →A security researcher at Picus Security, Umut Bayram, discovered that some WordPress sites remain vulnerable during the installation of a patch for an actively exploited flaw. The update process unpacks files using the old, unpatched code, creating a race condition window during which an attacker can execute code on the server. This means that even sites attempting to remediate a known vulnerability can be attacked at the precise moment of patching. The researcher advises blocking web access during the update process to mitigate this risk. The flaw is actively being exploited in the wild, making the timing of patching particularly critical. This issue highlights a broader challenge in patch management where the remediation process itself can introduce a temporary attack surface.
Bekijk origineel advisory →A newly disclosed vulnerability in OpenSSH, tracked as CVE-2026-123158 with a CVSS score of 8.1 and codenamed SSHole, is being actively exploited by threat actors within hours of its public disclosure. The flaw allows attackers to sign into accounts that have no password set, effectively enabling unauthorized access. It affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Exploitation has been confirmed on honeypot systems, where attackers successfully gained root access. The rapid exploitation timeline underscores the urgency for affected system administrators to apply mitigations. Research and reporting on the active exploitation was conducted by Previdian. The vulnerability's high CVSS score and ease of exploitation make it a critical threat to unpatched systems.
Bekijk origineel advisory →Blockchain intelligence firm Chainalysis disclosed a security breach affecting its systems and internal tools. The attack resulted in the exposure of credentials and live tokens for all of its customers. The breach is significant given Chainalysis's role as a major provider of blockchain analytics and intelligence to government agencies, financial institutions, and cryptocurrency businesses. The exposure of live tokens is particularly critical as it could allow attackers to impersonate customers or access their accounts in real time. The full scope of the breach and the attack vector have not been fully detailed in the article. Affected customers are at risk of account takeover and unauthorized access to sensitive blockchain investigation data. Immediate credential rotation and token invalidation would be essential remediation steps.
Bekijk origineel advisory →D-Link has issued a warning regarding multiple unpatched zero-day security vulnerabilities affecting its DGS-3130 series managed Gigabit stackable switches. The company has shared mitigation measures as the flaws remain unpatched. The DGS-3130 series are enterprise-grade managed switches used in network infrastructure environments. The vulnerabilities being zero-days means no official patch is currently available, increasing risk for affected organizations. D-Link's advisory focuses on workarounds and mitigations to reduce exposure until patches are developed. Network administrators using these switches are advised to implement the recommended mitigations immediately. The lack of patches makes this a significant concern for enterprise network security.
Bekijk origineel advisory →Blockchain analysis firm Chainalysis suffered a significant data breach resulting from an agentic cyber attack targeting its systems. The breach exposed sensitive user information including names, usernames, password hashes, and live tokens for all users. In response, Chainalysis temporarily shut down access to its Reactor and Data Solutions services. The company stated that its ongoing investigation found no evidence that investigations data was accessed. The incident represents a critical compromise of a major blockchain intelligence platform used widely by law enforcement and financial institutions.
Bekijk origineel advisory →Researchers at QiAnXin's XLab discovered a backdoor embedded in the web server component of Control Web Panel (CWP), a widely used free hosting management panel for Linux servers. The backdoor allows attackers to execute arbitrary commands via crafted web requests, with the malicious traffic intentionally excluded from the server's access logs, making detection extremely difficult. Installation of the backdoor requires root-level access, indicating that the threat actors had already fully compromised the target systems prior to planting it. The stealthy nature of the implant — combining command execution capability with log evasion — suggests a sophisticated, persistent threat actor. CWP is used by a large number of Linux hosting providers, potentially widening the attack surface. The backdoor represents a significant supply-chain-style risk for server administrators relying on CWP. No specific CVE has been mentioned in the article. The incident highlights the ongoing targeting of server management software as a vector for persistent access.
Bekijk origineel advisory →Two vulnerabilities in Barracuda's Email Security Gateway (ESG) appliance can be chained together to achieve unauthenticated root-level command execution. One of the flaws, CVE-2026-116606, is an authorization bypass that allows unauthenticated attackers to interact with the device without credentials. When combined with a second vulnerability, an attacker can run arbitrary commands as root, the highest privilege level on the system. Barracuda released patches on Monday following discovery of the flaws. Security firm watchTowr publicly detailed the attack chain on Thursday after patches were available. The vulnerabilities represent a critical risk to organizations using the ESG appliance for email filtering. No login is required to exploit the chain, making it particularly dangerous for internet-exposed devices.
Bekijk origineel advisory →The FBI and CISA have issued a joint warning about active cyberattacks targeting industrial refrigeration and cold-chain monitoring systems globally. Threat actors are exploiting vulnerabilities in these operational technology (OT) and industrial control systems (ICS). The attacks pose significant risks including food spoilage, equipment damage, and potential fire hazards. Cold-chain systems are critical to food safety, pharmaceutical storage, and supply chain integrity. The advisory highlights the growing threat to critical infrastructure beyond traditional IT targets. Organizations operating refrigeration and cold-chain environments are urged to review their cybersecurity posture and apply recommended mitigations. This aligns with a broader trend of threat actors increasingly targeting ICS and OT environments with potentially physical consequences.
Bekijk origineel advisory →SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability tracked as CVE-2026-19868. The flaw allows a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation can also bypass SAML-enforced multi-factor authentication (MFA), significantly weakening access controls. The vulnerability is catalogued by CISA and covered under BOD 26-04, which prioritizes security updates based on risk. SonicWall has published an advisory via their PSIRT portal under SNWLID-2026-0014. CISA has also published forensics triage requirements related to this vulnerability. Federal agencies and organizations using SonicWall SSLVPN with SAML-based MFA are particularly at risk. Immediate patching and review of authentication configurations are strongly recommended.
Hackers are conducting phishing campaigns using fake event invitations impersonating high-profile organizations such as OpenAI, SpaceX, and Anthropic. The attacks target employees and aim to steal Microsoft and Google account credentials along with authentication session tokens. Two different phishing-as-a-service (PhaaS) platforms are being leveraged to carry out these attacks at scale. The lure of prestigious tech events makes these invitations particularly convincing to potential victims. By stealing session cookies in addition to credentials, attackers can bypass multi-factor authentication protections. The campaign highlights the growing sophistication and commoditization of phishing infrastructure available to threat actors.
Bekijk origineel advisory →A newly disclosed OpenSSH vulnerability nicknamed '*sshole' allows attackers to authenticate into Linux accounts that have password authentication explicitly disabled. The flaw affects Alpine Linux and other musl libc-based Linux distributions. Attackers can exploit the vulnerability simply by submitting an oversized password string, bypassing the expected authentication block. This represents a significant authentication control bypass, particularly in environments relying on musl-based distributions for lightweight or container workloads. The issue is rooted in how musl libc handles password validation compared to glibc. Systems configured to disable password logins may falsely assume they are protected from password-based attacks. The vulnerability highlights risks in assumed security configurations on hardened or minimal Linux systems. Organizations using Alpine Linux in container environments (e.g., Docker) may be especially exposed.
Bekijk origineel advisory →