Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in Onigmo, the regular expression engine embedded in the language. These three bugs are responsible for four critical remote code execution (RCE) vulnerabilities that GitLab patched over the past month. The flaws allow a specially crafted regex pattern to corrupt memory during Ruby's compilation process, potentially enabling code execution on GitLab's servers. The vulnerability chain highlights a supply chain risk where a language-level bug propagates to dependent platforms. GitLab users and Ruby developers are strongly encouraged to update to the patched versions immediately. The severity is considered critical given the RCE potential on widely-used DevOps infrastructure.
Bekijk origineel advisory →Cybersecurity researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is a framework called 'Phantom,' described as an Autonomous Red Team Kill Chain Framework. The threat actors are assessed to be Russian-speaking and operate as both intrusion and data-extortion operators. The discovery came through exposed infrastructure that revealed how ransomware affiliates are leveraging AI agents to execute intrusions. This represents a significant evolution in ransomware tactics, with threat actors automating attack chains using artificial intelligence. The use of AI agents enables more scalable, efficient, and potentially harder-to-detect intrusion operations. The operation highlights the growing intersection of AI technology and cybercriminal activity, particularly in the ransomware ecosystem.
Bekijk origineel advisory →Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach affecting patient records. A threat actor gained unauthorized access to the company's Quanum LSM system, resulting in the exposure of sensitive patient information. The breach highlights ongoing risks to healthcare organizations and their patient data management systems. Quest Diagnostics is a high-profile target given the volume and sensitivity of medical and personal data it handles. The incident underscores the importance of securing laboratory information management systems in the healthcare sector.
Bekijk origineel advisory →The PHP security team has disclosed a new remote code execution (RCE) vulnerability affecting PHP installations with non-default configurations. No patch is currently available, prompting the team to share mitigation measures instead. The vulnerability poses a significant risk to affected systems as it allows remote attackers to execute arbitrary code. The issue is limited to systems running non-default PHP configurations, which may reduce the overall attack surface. Until a patch is released, administrators are advised to apply the recommended mitigations to protect their environments. This situation highlights the ongoing challenge of securing widely-used scripting languages and the importance of prompt mitigation strategies when patches are unavailable.
Bekijk origineel advisory →A large-scale cyberattack campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs. Threat operators have successfully compromised numerous organizations worldwide, obtaining over 70,000 credentials in the process. Researchers investigating the campaign found artifacts indicating further compromise attempts against some victims. The campaign highlights ongoing risks associated with internet-exposed network perimeter devices. The scale and targeting of enterprise-grade security infrastructure makes this a significant threat to organizations globally.
Bekijk origineel advisory →Hewlett Packard Enterprise (HPE) released security updates addressing 72 vulnerabilities in ArubaOS (AOS), the operating system powering Aruba networking products. Among these, eight vulnerabilities were rated maximum severity, covering remote code execution (RCE) and authentication bypass flaws. The patches represent a significant security update for enterprise network infrastructure relying on Aruba products. The maximum severity rating indicates these vulnerabilities could be exploited without authentication or with minimal user interaction. Organizations using HPE Aruba networking equipment are urged to apply the patches immediately. The breadth of the patch release (72 total CVEs) suggests a comprehensive security audit was performed. No specific CVE identifiers were detailed in the article excerpt, but the severity level warrants urgent attention. This release highlights ongoing risks in enterprise networking infrastructure from critical unpatched vulnerabilities.
Bekijk origineel advisory →PHP has disclosed a new remote code execution vulnerability tracked as CVE-2026-115560, just two days after issuing emergency patches for the critical PHP2Shell flaws. The new issue affects web applications configured in an unusual manner and is considered an unlikely risk by the PHP project. Unlike the previous PHP2Shell vulnerabilities, PHP is not issuing an emergency fix for this new issue. Instead, the project recommends disabling a specific feature as a mitigation measure. The disclosure highlights ongoing security concerns within the PHP ecosystem following the recent emergency patch cycle.
Bekijk origineel advisory →A critical vulnerability (CVE-2026-112900) has been discovered in Pillow, the most widely used Python image processing library. The flaw exists in how Pillow handles EPS (Encapsulated PostScript) image files. When opening an EPS file, Pillow passes the filename directly to Ghostscript without sanitizing or validating the input first. This behavior allows an attacker to craft a malicious filename that causes Pillow to execute arbitrary operating system commands on the server. The impact is significant given Pillow's widespread adoption across Python-based web applications and services. Exploitation could lead to remote code execution on affected servers. Users and administrators are advised to update Pillow to a patched version as soon as one becomes available.
Bekijk origineel advisory →Security researchers at Imperva have demonstrated a remote code execution exploit called 'Node2Shell' targeting a vulnerability in Node.js's bundled Brotli decoder. The proof of concept successfully ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64 without requiring a debugger or custom build. The attack works by feeding specially crafted Brotli data to the bundled Brotli decoder component. The vulnerability is tracked as CVE-2026-111497 and was disclosed by Node.js. The exploit requires no special configuration, making it particularly dangerous for any application running on an official Node.js build that processes Brotli-compressed data. The demonstration highlights a significant risk for production environments using standard Node.js deployments.
Bekijk origineel advisory →Threat actors are actively attempting to exploit two newly disclosed PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2. The attacks aim to leverage unauthenticated remote code execution to compromise systems and enlist them into a Mirai botnet variant called Potassium. Despite the high volume of exploit attempts reaching millions, attackers have been largely unsuccessful, as weaponizing the flaws appears more difficult than initially anticipated. The vulnerabilities allow unauthenticated remote access, making them high-severity targets for botnet operators. The Mirai-based Potassium variant is the end payload intended for deployment on compromised systems. This campaign highlights the rapid exploitation attempts that follow public disclosure of critical vulnerabilities.
Bekijk origineel advisory →Collabora Online's Built-in CODE Server contains an OS command injection vulnerability when used within the Nextcloud platform. The flaw allows remote code execution when the CODE server is not running. The vulnerability affects the integration between Collabora Online and Nextcloud, posing significant risk to users of this combination. CISA has flagged this under BOD 26-04, requiring prioritized security updates. Users are urged to update their Collabora Built-in CODE Server as soon as possible. The advisory is backed by both GitHub security advisories and NVD documentation. Forensics triage requirements have also been outlined under BOD 26-04 implementation guidance.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in Arista VeloCloud Orchestrator (VCO) on-premises deployments. The flaw allows a remote attacker to access privileged internal functionality without proper authorization. Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. The vulnerability is tracked as CVE-2026-114625 and has been listed by CISA. Arista has published a security advisory with remediation guidance. The issue is subject to CISA's BOD 26-04 directive, which mandates prioritizing security updates based on risk. Organizations running on-prem VeloCloud Orchestrator instances are urged to apply patches immediately. The vulnerability poses significant risk to network management infrastructure given VCO's role in orchestrating SD-WAN environments.
Bekijk origineel advisory →Elastic Security Labs analyzed CVE-2026-73570, a command injection vulnerability in Zimbra that can be exploited to achieve remote code execution. Researchers reproduced the vulnerability and discovered that several publicly available proof-of-concept (PoC) exploits are flawed, writing payloads that Swatchdog never matches. This means a failed exploit attempt may incorrectly appear as though the server is patched, leading to false confidence in security posture. The attack vector involves the manipulation of Zimbra log files, which are processed by Swatchdog, a log monitoring utility. The article provides technical detail on how the exploit chain works and highlights the pitfalls in existing public PoCs. Organizations running Zimbra should treat this as a high-severity issue requiring immediate patching and validation.
Bekijk origineel advisory →Japanese gaming company Capcom has confirmed a data breach affecting its CAPCOM ID membership service. The breach exposed over 11.7 million customer email addresses along with associated personal information. The incident involved unauthorized access by hackers to Capcom's membership platform. This is a significant breach given the large number of affected users. The breach impacts customers who had registered accounts with CAPCOM ID. Capcom has publicly disclosed the incident following investigation. The exposed data includes at minimum email addresses and potentially other account-related information. This breach raises concerns about the security of gaming platform user data.
Bekijk origineel advisory →eMudhra's emSign intermediate Certificate Authority keys were compromised, putting Python package downloads and CI/CD pipelines at significant risk. The compromise affects tools like pip and uv that rely on certificate trust chains for secure dependency downloads. Users of Python virtual environments and CI/CD images that bundle affected certificates need to take immediate action. The article provides details on which tools and environments are affected, along with verified certificate-trust test results. Remediation steps are provided for pip, uv, virtual environments, and CI/CD images to remove or distrust the compromised certificates. This is a supply chain security issue with broad implications for Python developers and DevOps engineers worldwide.
Bekijk origineel advisory →Hackers compromised the LiteLLM project's release pipeline, resulting in the publication of malicious PyPI packages and Docker images. The malicious payload was designed to steal credentials, secrets, and environment variables from affected systems. LiteLLM is a popular open-source library used to interact with large language model APIs, making this a significant supply chain attack targeting AI/ML developers. The attack involved tampering with the CI/CD pipeline to inject malicious code into legitimate release artifacts. Victims who installed the compromised package or pulled the malicious Docker images would have had sensitive data exfiltrated. This incident highlights the growing risk of supply chain attacks targeting AI tooling ecosystems.
Bekijk origineel advisory →Arista has issued an advisory warning of an actively exploited zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO), the central management platform for VeloCloud SD-WAN networks. The flaw allows any authenticated user, even those with read-only customer accounts, to escalate privileges to operator level, the highest control tier. The advisory was published on October 22. No CVE identifier is mentioned in the available content. The vulnerability poses significant risk to organizations relying on VeloCloud SD-WAN infrastructure for network management. Active exploitation has been confirmed, making this a critical and urgent issue for affected deployments.
Bekijk origineel advisory →This weekly cybersecurity roundup covers a wide range of critical security incidents and vulnerabilities. Highlights include critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. Additional issues include AI secrets leakage, source code theft targeting PingCAP, a Signal application hang-up flaw, and a Laravel authentication bypass vulnerability. The article also references stolen passwords and other exposed credentials. In total, the roundup covers 25 or more distinct cybersecurity threats and incidents from the week, spanning multiple platforms, services, and vulnerability types.
Bekijk origineel advisory →Arista Networks has released security updates to address an actively exploited zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. The vulnerability is being exploited in the wild, making it a high-priority patching concern for organizations running on-premises VCO installations. Arista has responded by issuing patches to mitigate the risk. The article highlights the urgency for administrators to apply the updates immediately given the active exploitation. VeloCloud Orchestrator is a network management platform used in SD-WAN environments, making this a significant concern for enterprise network infrastructure.
Bekijk origineel advisory →Eight eMudhra intermediate Certificate Authority (CA) private keys were found to be compromised, posing significant risks to TLS certificate integrity. The compromise enables threat actors to perform unauthorized TLS certificate signing and man-in-the-middle (MitM) interception attacks. eMudhra is a licensed Certifying Authority, making this a high-impact PKI trust chain issue. Unit 42 published an analysis of the compromise along with a containment guide for affected organizations. The exposure of intermediate CA private keys can allow attackers to impersonate any domain covered under the affected CA hierarchy. This type of compromise undermines the foundational trust model of HTTPS and certificate-based authentication. Organizations relying on eMudhra-issued certificates are advised to review and revoke affected certificates immediately.
Bekijk origineel advisory →