Overzicht van binnengekomen advisories.
2186 resultaten gevonden
An active campaign has been identified where unknown threat actors are leveraging a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. At least 173 Microsoft 365 tenants have been affected. ConnectWise Cloud Backup is a cloud-based backup and recovery service designed for managed service providers (MSPs), making the breach particularly significant due to the downstream impact on MSP customers. The attack highlights risks associated with credential compromise in MSP tooling and cloud backup services. Cybersecurity researchers are actively raising alarms about this campaign. The incident underscores the supply-chain-like risk posed when a trusted MSP vendor's credentials are compromised. No specific CVEs have been mentioned in the available content.
Bekijk origineel advisory →A critical maximum-severity vulnerability tracked as CVE-2026-103849 has been discovered in BlockStrap, affecting Magento and Adobe Commerce platforms. The flaw could allow attackers to execute arbitrary PHP code on store servers. Researchers are warning that exploitation could be imminent. The vulnerability poses a significant risk to e-commerce stores running Magento and Adobe Commerce. No additional details about patches or mitigations are provided in the article excerpt, but the severity rating suggests urgent remediation is required. The issue highlights ongoing risks to widely-used e-commerce infrastructure.
Bekijk origineel advisory →Researchers from security firm Calif have published a local privilege escalation exploit targeting OpenBSD 7.9 that achieves root access by chaining a roughly 37-year-old integer overflow in shared memory with a separate kernel flaw. The exploit successfully bypasses OpenBSD's KARL (kernel address randomization layout) as well as hardware protections SMAP and SMEP. A full proof-of-concept code was released after OpenBSD shipped a patch. The vulnerability chain demonstrates that legacy bugs in foundational OS code can remain exploitable for decades. This is particularly notable given OpenBSD's reputation as one of the most security-focused operating systems. The attack is local, requiring existing access to the system, but escalates privileges to root. The disclosure follows responsible reporting by Calif to the OpenBSD team prior to public release.
Bekijk origineel advisory →Unit 42 researchers detail the top five initial access vectors used by adversaries to breach organizations in September 2026. The report highlights edge device exploits, credential abuse, and phishing as leading methods. These findings are based on incident response and threat intelligence observations by Palo Alto Networks' Unit 42 team. The article serves as a periodic threat landscape summary to help organizations prioritize defensive measures. Understanding these vectors is critical for improving detection and prevention strategies against current threat actor tactics.
Bekijk origineel advisory →Between May and July 2026, attackers repeatedly tampered with AOMEI Backupper's official update servers in short windows of five to ten minutes at a time. Any instance of the Windows backup software that checked for updates during these windows would download and execute a backdoor. The attack represents a classic supply chain compromise targeting the software update mechanism of a trusted vendor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team were involved in investigating the incident. The brevity of the attack windows suggests the attackers were attempting to minimize detection while still achieving broad distribution through legitimate update channels.
Bekijk origineel advisory →A threat actor tracked as UAT-11985 has been conducting a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The campaign uses fake event invitations to lure victims to an adversary-in-the-middle (AitM) phishing framework. The goal is to harvest Google account credentials and multi-factor authentication (MFA) codes. The AitM technique allows attackers to bypass MFA protections by intercepting authentication tokens in real time. This represents a sophisticated APT-level operation targeting academic and research communities in Taiwan, likely for espionage purposes.
Bekijk origineel advisory →CISA has issued an alert regarding CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) affecting versions 26.2.3 and earlier. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as threat actors are actively exploiting it to gain initial access, establish persistence, escalate privileges, and move laterally. Organizations using self-hosted appliances must apply the BT26-05-RS patch; those on versions older than 24.3.1 must upgrade first. BeyondTrust-hosted SaaS deployments have already been patched. CISA recommends isolating potentially compromised appliances, conducting forensic investigations, hunting for indicators of compromise such as unrecognized privileged sessions or unauthorized account changes, and rebuilding from a known-good state. After remediation, organizations should rotate all credentials stored or injected by the appliance and revoke active support sessions. Mandiant has published additional guidance under the campaign name ARMORY CASTLE.
Bekijk origineel advisory →BeyondTrust has patched a critical vulnerability in BeyondTrust Remote Support, identified as CVE-2026-102764 with a CVSS score of 9.3. The vulnerability involves insufficient validation of message origins within internal product components. An unauthenticated remote attacker can exploit this flaw to place or modify files on an affected appliance. All Remote Support versions up to and including 26.2.3 are affected. BeyondTrust has confirmed that CVE-2026-102764 was actively exploited as a zero-day vulnerability in the wild.
Bekijk origineel advisory →A cyberattack targeting BAE Systems, a major government contractor, has disrupted operations at US federal bankruptcy courts. The Administrative Office of the US Courts confirmed that the attack took down the notice system used by federal bankruptcy courts. BAE Systems is a defense and security contractor with significant ties to US government operations. The disruption affects court notification infrastructure, potentially impacting case communications and proceedings. This incident highlights the risks of third-party contractor dependencies within critical government systems. The attack demonstrates how supply chain vulnerabilities can cascade into public sector disruptions. Details on the nature of the attack, attribution, and extent of the damage are limited in the current reporting.
Bekijk origineel advisory →The China-nexus cyber espionage group Armory Castle (formerly UNC5221 or Warp Panda) exploited a zero-day vulnerability in BeyondTrust Remote Support (formerly Bomgar) in late August 2026. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, involves improper origin validation in an internal messaging component. Exploitation of this vulnerability allowed attackers to take over remote support servers. The group has been previously tracked under multiple aliases, indicating a sophisticated and persistent threat actor. This incident highlights ongoing risks posed by China-linked espionage operations targeting enterprise remote support infrastructure. The high CVSS score underscores the critical severity of the vulnerability and the potential for widespread impact.
Bekijk origineel advisory →BeyondTrust disclosed and patched a critical zero-day vulnerability in its Remote Support (RS) product that has been actively exploited in attacks since late August. The flaw was identified as being exploited in the wild before a patch was available, classifying it as a zero-day. BeyondTrust issued an urgent warning to customers to apply the patch immediately. The vulnerability poses significant risk given BeyondTrust's widespread use in enterprise privileged access and remote support environments. No additional CVE identifier was mentioned in the excerpt, but the severity and active exploitation make this a high-priority remediation item. Organizations using BeyondTrust Remote Support are urged to update immediately to mitigate risk of compromise.
Bekijk origineel advisory →A suspected advanced threat actor has been exploiting CVE-2025-61624, a path traversal vulnerability (CVSS 5.4) in Fortinet FortiOS's command line interpreter, to deploy a previously unreported memory-resident ARM64 malware dubbed PEERSTITCH. The vulnerability also affects FortiPAM, FortiProxy, and FortiSwitchManager. The malware is notable for its ability to bypass security checks on tagged VPN sessions, making detection and remediation more difficult. PEERSTITCH resides in memory, leaving minimal forensic artifacts on disk. The attack chain highlights the continued targeting of network edge devices by sophisticated threat actors. Organizations using affected Fortinet products are urged to apply patches and monitor for indicators of compromise.
Bekijk origineel advisory →A path traversal vulnerability has been identified in multiple Fortinet products including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The vulnerability allows an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. The flaw is tracked as CVE-2025-61624 and has been assigned a high criticality rating. CISA has referenced this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Fortinet has published an advisory under FG-IR-26-122. Organizations using affected Fortinet products are advised to apply patches promptly. The vulnerability poses a significant risk as it can lead to unauthorized file manipulation on affected systems.
Bekijk origineel advisory →CVE-2026-102764 is an authentication bypass by spoofing vulnerability affecting BeyondTrust Remote Support. A remote attacker could exploit this flaw to perform unauthorized file operations on the affected appliance. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. BeyondTrust has published a security advisory with remediation guidance. CISA has also provided forensics triage requirements as part of the directive's implementation guidance. The vulnerability is tracked in the NVD and carries a high criticality rating. Organizations using BeyondTrust Remote Support are urged to apply patches promptly.
Bekijk origineel advisory →Unit 42 researchers have analyzed an AI-powered espionage campaign specifically targeting government Linux infrastructure. The campaign employs custom malware, web shells, and advanced credential theft techniques. The use of AI to enhance espionage operations represents an evolving threat landscape. Government entities running Linux systems are the primary targets, suggesting a nation-state or sophisticated threat actor involvement. The attack methodology combines multiple techniques including web shell deployment and credential harvesting. The campaign demonstrates increasing sophistication in threat actor capabilities by leveraging AI technologies. Custom malware tailored for Linux environments indicates deep technical expertise and targeted intent.
Bekijk origineel advisory →Threat actors are actively exploiting a critical remote code execution vulnerability tracked as CVE-2026-110447 in the Collabora Online Built-in CODE Server (richdocumentscode) plugin for Nextcloud. The flaw allows attackers to execute arbitrary commands on affected servers. Successful exploitation enables threat actors to install backdoors on compromised Nextcloud instances. The vulnerability is present in the richdocumentscode app, which is widely used to provide document editing capabilities within Nextcloud deployments. Organizations running Nextcloud with the Collabora Online integration are at significant risk. The active exploitation makes this a high-priority issue requiring immediate patching or mitigation. Nextcloud server administrators should review their installations and apply available security updates as soon as possible.
Bekijk origineel advisory →A critical Linux kernel vulnerability dubbed PwnEscape (CVE-2026-99999) has been disclosed, allowing code running inside a virtual machine to read memory on the host system. The flaw resides in the Linux kernel's networking code, making it broadly applicable across cloud environments rather than specific to any single provider's configuration. A security researcher demonstrated the vulnerability against Vercel's live cloud sandboxes, and Vercel confirmed the successful exploit. Because the issue is in the kernel itself, any cloud or hosting provider using affected Linux kernel versions may be at risk. This type of VM escape or cross-boundary memory read is considered critical as it undermines the fundamental isolation guarantees of virtualization. The vulnerability has been assigned a CVE identifier and is actively being tracked by the security community. Patches or mitigations are expected from Linux kernel maintainers and downstream distributions.
Bekijk origineel advisory →This weekly security roundup covers multiple significant threats including an Adobe Remote Code Execution vulnerability, DNS-based cryptocurrency wallet theft, NVIDIA container escape vulnerability, and a self-healing backdoor malware. The article also references 23 additional security stories. Key themes include data theft tools with victim intimidation features, privilege escalation via small permissions, trusted authentication bypass, exploitation of old vulnerabilities against new targets, and abuse of legitimate tools for malicious purposes. The roundup suggests a broad and active threat landscape across multiple product categories and attack vectors.
Bekijk origineel advisory →A threat actor uploaded malicious packages to the Arch User Repository (AUR), impersonating popular AUR helper tools yay and paru. The fake packages were designed to push malware with root privileges onto victim systems. AUR is a community-driven repository for Arch Linux users, making it a high-value target for supply chain attacks. Because AUR packages can request elevated privileges during installation, malicious packages can gain root-level access. This attack highlights the risks associated with community-maintained package repositories where packages are not officially vetted. Users who installed the trojanized versions of yay or paru may have had their systems fully compromised. The incident underscores the importance of verifying package authenticity and reviewing PKGBUILDs before installation on Arch Linux systems.
Bekijk origineel advisory →Citizen Lab researchers revealed that Candiru, an Israeli spyware vendor, infected devices at Al Jazeera through malicious online advertisements. The attacks required no user interaction, executing hidden code the moment an ad loaded on screen. In some cases, ads loaded invisibly in the background, making detection even harder. Candiru sells its spyware to government clients, raising serious concerns about state-sponsored surveillance targeting journalists. This represents a significant escalation in spyware delivery methods, weaponizing the online advertising ecosystem. The zero-click nature of the attack makes it extremely difficult for users to protect themselves. Citizen Lab's investigation links the infections directly to targeted ad campaigns, suggesting a sophisticated and deliberate targeting operation against the news network.
Bekijk origineel advisory →