Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Two remote code execution vulnerabilities in Linux's built-in SMB server (KSMBD) have been publicly disclosed on mailing lists before mainline kernel patches are available. Both flaws carry a CVSS score of 9.0 and were reported by Trend Micro's Zero Day Initiative. ZDI-CAN-33774 is particularly dangerous as it can be triggered pre-authentication over the network. ZDI-CAN-33549 requires SMB Direct transport and an RDMA-capable network interface. Linux servers with KSMBD enabled are currently exposed with no official fix in the mainline kernel. The public disclosure before patching increases the risk of exploitation by threat actors.
Bekijk origineel advisory →INTERPOL announced the results of Operation Serengeti III, a coordinated global law enforcement action conducted between June 29 and August 31, 2026. The operation successfully disrupted 10,909 malicious cybercrime networks and recovered more than $105 million in illicit funds. Law enforcement agencies from 21 countries participated in the crackdown, resulting in the arrest of 1,462 suspects. This represents the third iteration of the Serengeti operation, reflecting ongoing international cooperation against cybercrime. The scale of disruptions and arrests underscores the growing effectiveness of multinational law enforcement collaboration in combating cyber threats.
Bekijk origineel advisory →Amazon Threat Intelligence researchers discovered that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were made available. The exploitation predates the official patch release, indicating a zero-day or near-zero-day attack window. Amazon was involved in tracking and reporting this threat activity. The article highlights the risk of pre-patch exploitation, where threat actors may have had prior knowledge of the vulnerabilities. This type of activity underscores the importance of rapid patch deployment and proactive threat monitoring. The PHP2Shell flaws were patched on a Wednesday, meaning exploitation began the preceding Saturday. The early exploitation window could have allowed attackers significant time to compromise systems before defenders had any mitigation available.
Bekijk origineel advisory →Wiz Research is tracking a threat actor overlapping with Storm-0940 that uses an AI-powered attack tool called ARTEX to target multiple software and IT vendors. The campaign focuses on identity providers and cloud authentication platforms including Okta, Microsoft Entra, and AWS Cognito. ARTEX functions as an AI agent capable of conducting automated attacks against identity and access management systems. The actor has expanded its targeting scope to include software vendors beyond its previously known victims. Forensic artifacts and log evidence were left behind during the intrusions, providing visibility into the attack methodology. This represents a notable escalation in the use of AI-assisted tooling by a state-linked threat actor in enterprise cloud environments.
Bekijk origineel advisory →GitLab has released security patches addressing a maximum-severity vulnerability in its Regular Expression Compiler component. The flaw allows remote attackers to execute arbitrary code on vulnerable GitLab servers without authentication. The vulnerability has been assigned the highest possible severity rating, indicating significant risk to organizations running unpatched GitLab instances. GitLab has urged administrators to apply the patches immediately. The issue affects GitLab's server-side processing and could be exploited remotely, making it a critical threat to DevOps pipelines and source code repositories hosted on GitLab infrastructure.
Bekijk origineel advisory →The litellm 1.107.0 package on PyPI was compromised with malicious code embedded in its wheels and Docker images. The attack introduced a .pth file-based credential stealer that activates on Python startup. An hourly remote code loader was also included, periodically fetching and executing code from litellm.dev. The malware exfiltrates credentials and sensitive data to an attacker-controlled domain. This is a supply chain attack targeting AI/LLM developers using the popular litellm library. The article provides indicators of compromise (IOCs) and remediation guidance for affected users.
Bekijk origineel advisory →Oracle has patched multiple vulnerabilities across several Fusion Middleware products including WebLogic Server, SOA Suite, Data Integrator, Identity Manager, Access Manager, WebCenter Content, Helidon, and HTTP Server. Vulnerabilities include unsafe deserialization, insufficient authentication and access controls, flaws in network protocols (HTTP, HTTP/2, SOAP, T3, IIOP, LDAP), and cryptographic library issues in Bouncy Castle and Jackson-databind. Attackers can exploit these to achieve arbitrary code execution, full system compromise, unauthorized data access, data manipulation, denial-of-service, privilege escalation, cross-site scripting, and spoofing. Exploitation is possible via network access, often without authentication, with some cases requiring user interaction. CVSS scores reach up to 10.0, indicating maximum severity. No proof-of-concept code is currently known, but NCSC anticipates increased scanning and exploitation activity due to the wide deployment of these products.
Bekijk origineel advisory →On October 21, 2026, LiteLLM's release pipeline was compromised, resulting in a malicious version (1.107.0) being pushed to both Docker Hub and PyPI. Threat actors bypassed multiple independent security controls to inject a credential stealer and backdoor into the package. LiteLLM suspects that a GitHub token leaked via AI gateway logs may have been the initial attack vector. The incident occurred around 4:00 a.m. and represents a significant supply chain attack targeting AI/ML tooling infrastructure. Users who downloaded or used the compromised version may have had credentials stolen or systems backdoored.
Bekijk origineel advisory →Node.js released security updates on October 21 addressing 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. The most critical flaw resides in the Brotli decompression code bundled with Node.js. This vulnerability could allow remote code execution, enabling attackers to run arbitrary code on affected systems. All currently supported Node.js versions are impacted. Fixed versions have been released for each supported release line. The severity of the RCE potential makes this a high-priority patch for organizations running Node.js in production environments.
Bekijk origineel advisory →Security firm FoxIO disclosed critical vulnerabilities in QPACK, the header compression mechanism used in HTTP/3, that allow unauthenticated remote attackers to crash web servers with a single connection. The attack exploits a memory amplification flaw where a small batch of compressed HTTP headers expands dramatically in memory, achieving up to 4,000-fold amplification. This can exhaust server memory on default configurations, effectively enabling denial-of-service attacks. Working proof-of-concept code has been released publicly. The vulnerability affects a wide range of HTTP/3 server implementations. No authentication or prior access is required to exploit the flaw. The disclosure highlights systemic risks in the QUIC/HTTP3 protocol stack's header compression design.
Bekijk origineel advisory →Amazon's Threat Intelligence team detected an exploitation attempt against PHP2Shell vulnerabilities on October 17, 2026, four days before they were publicly disclosed. The attempt was observed via Amazon's MadPot honeypot service. The exploit originated from an IP address linked to a commercial anonymization network. The vulnerabilities have since come under broad exploitation in the wild following patch release. The discovery highlights the existence of pre-disclosure exploitation activity, suggesting threat actors may have had prior knowledge of the flaws. CJ Moses from Amazon commented on the findings.
Bekijk origineel advisory →Microsoft disclosed that China state-aligned threat actor Storm-0940 was responsible for a supply chain compromise targeting the ConnectWise Cloud Backup application. The attackers leveraged ARTEX, a Go-based agentic AI penetration testing framework, to accelerate scanning operations during the attack. ARTEX was previously made closed-source following its abuse against South Korean financial institutions. The incident represents a notable use of AI-powered offensive tooling by a nation-state actor. This supply chain attack highlights the growing sophistication of Chinese state-sponsored cyber operations and their adoption of advanced AI-driven frameworks to enhance attack efficiency.
Bekijk origineel advisory →Hackers compromised the infrastructure of Onamae Desktop Cloud, a major VPS service provider in Japan. The attackers installed malware on up to 26,739 customers' servers, representing a significant supply-chain-style infrastructure breach. The incident affected a large number of virtual private servers managed by the provider. Onamae is a well-known domain and hosting services company in Japan. The scale of the attack — nearly 27,000 servers — makes this a high-impact event for Japanese businesses and individuals relying on the platform. The nature of the malware installed has not been fully detailed in the article. This type of cloud infrastructure compromise can lead to data theft, further lateral movement, and deployment of additional payloads on customer environments.
Bekijk origineel advisory →North Korean state-sponsored hacking group Lazarus is employing post-quantum cryptographic mechanisms to secure the delivery of malicious payloads in new operations. The campaign combines both old and new malware families, demonstrating the group's continued evolution and sophistication. The use of post-quantum cryptography marks a notable advancement in their operational security, making interception and analysis of communications more difficult. This represents a proactive adaptation to future-proof their attack infrastructure against potential quantum computing decryption capabilities. The activity highlights Lazarus Group's ongoing threat to global cybersecurity and their investment in cutting-edge evasion techniques.
Bekijk origineel advisory →The PHP Foundation published a postmortem accusing Chainguard of breaking a coordinated security embargo by releasing patched PHP container images over six hours before the scheduled disclosure of two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Chainguard CEO Dan Lorenc defended the early release citing active exploitation reports from multiple security vendors and the ease of independently discovering the vulnerability. The disclosure process was further disrupted by leaked CVE identifiers, an accidentally published exploit demonstration video by Calif, and potentially leaked mitigation guidance. The underlying memory management vulnerability had been known since a 2024 Quarkslab audit but stalled due to complex trade-offs and limited developer resources. Researchers from Calif, OpenAI, and Wiz contributed to identifying attack vectors and RCE proofs of concept. PHP's security team is now moving to majority-vote decisions to prevent fixes from stalling, and the Foundation is calling for increased funding from companies dependent on PHP. The incident raised community concerns about whether other projects would trust Chainguard with embargoed patches in the future.
Bekijk origineel advisory →CISA has issued a warning regarding active exploitation of four vulnerabilities in Plex Media Server, collectively referred to as 'Plex2Shell' attacks. Attackers are chaining these flaws together to breach servers running Plex Media Server. The advisory highlights the risk of remote code execution or unauthorized access through the chained exploitation of these vulnerabilities. CISA is urging organizations and users running Plex Media Server to apply patches immediately. The campaign demonstrates the increasing trend of attackers combining multiple lower-severity vulnerabilities to achieve high-impact outcomes. This advisory underscores the importance of timely patching for media server software exposed to the internet.
Bekijk origineel advisory →The popular LiteLLM Python package was compromised in a software supply chain attack affecting version 1.107.0. The malicious package was distributed via PyPI wheels and Docker images, delivering both a credential stealer and a backdoor. The compromise was discovered and reported by multiple security firms including SafeDep, Socket, StepSecurity, and Upwind. PyPI has since quarantined the affected package to prevent further installations. This incident highlights ongoing risks in open-source package ecosystems, particularly for AI/LLM tooling. Organizations using LiteLLM 1.107.0 should consider their environments potentially compromised and rotate credentials.
Bekijk origineel advisory →CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities affecting PHP, a widely used scripting language powering web servers and content management systems globally. The vulnerabilities were reported by Palo Alto Networks Unit 42 as a threat brief. Due to PHP's widespread deployment, these flaws carry significant risk for web infrastructure worldwide. The article highlights the critical severity rating of both CVEs. No additional technical details such as exploit mechanisms or patch information are provided in the available content. Organizations running PHP-based web servers or CMS platforms are likely at risk. Immediate attention and patching are implied as necessary responses.
Bekijk origineel advisory →PHP released emergency patches on October 21, 2026, for two critical memory-safety RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, both rated 9.2 on CVSS v4.0. The flaws affect all PHP installations serving web requests including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with exploitation possible before any application code executes. NSA and CERT-EU urged organizations unable to patch immediately to take affected systems offline or isolate them from public networks. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with minimal backports also published for PHP 7.4, 8.0, and 8.1. Cloudflare reported active attack traffic with attackers already attempting to evade WAF protections. Approximately 48.5% of PHP websites run end-of-life branches, making the patch rollout particularly challenging. Wiz researchers noted that AI models helped accelerate the development of working exploits across applications in hours. Remote memory disclosure is also possible, potentially exposing passwords, tokens, and API keys without first achieving code execution.
Bekijk origineel advisory →The litellm 1.107.0 release on PyPI was compromised, with backdoored wheel packages and Docker images shipping a malicious .pth file acting as a credential stealer. The malware also includes an hourly remote code loader that periodically fetches and executes additional payloads. Stolen credentials and data are exfiltrated to the domain litellm.dev. The article provides indicators of compromise (IOCs) and remediation guidance. This represents a serious supply chain attack targeting developers and organizations using the litellm Python package. The attack vector leverages Python's .pth file mechanism to achieve persistence and code execution on affected systems.
Bekijk origineel advisory →