Overzicht van binnengekomen advisories.
2179 resultaten gevonden
CISA has added CVE-2024-27834, a medium-severity improper authentication vulnerability affecting multiple Apple operating systems, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw carries a CVSS score of 5.5 and has been reported as actively exploited in the wild. Despite being previously patched by Apple, threat actors are leveraging the vulnerability to deliver information-stealing malware to victims. The addition to the KEV catalog signals that federal agencies and organizations should prioritize patching. The exploitation underscores the risk of delayed patch adoption even for medium-severity vulnerabilities when active exploitation is confirmed.
Bekijk origineel advisory →OpenAI detailed a prototype AI pipeline leveraging a cyber-focused AI model that analyzed 2,308 candidate Linux kernel findings. The system dynamically reproduced 1,724 vulnerabilities and produced 948 local privilege escalation (LPE) exploits in a 30-hour run. The operation cost approximately $1.2 million in API costs. The pipeline was designed to validate and patch Linux local privilege escalation vulnerabilities at scale. This represents a significant demonstration of AI-assisted vulnerability research and exploitation capabilities. The scale and speed of exploit generation raises significant concerns about the democratization of offensive security tools. It also highlights the dual-use nature of AI in cybersecurity, potentially accelerating both attack and defense capabilities.
Bekijk origineel advisory →Zyxel released a patch for a zero-day vulnerability affecting its GS1900 series network switches. Threat actors actively exploited this flaw to compromise nearly 1,000 devices globally. The attackers were able to steal configuration files and credentials from the compromised switches. The vulnerability was present before a patch was made available, classifying it as a zero-day. The incident highlights the ongoing risk of network infrastructure devices being targeted by attackers. Organizations using GS1900 series switches are urged to apply the patch immediately. The theft of configuration files and credentials could enable further lateral movement or persistent access in affected networks.
Bekijk origineel advisory →DreamHost has confirmed a data breach in which attackers gained unauthorized access to its File Manager platform for approximately two months. During this period, threat actors were able to steal customers' FTP and SFTP usernames and passwords, as well as webmail session data. The breach affected customers who used DreamHost's File Manager and webmail services. The exposure of FTP/SFTP credentials poses significant risk as attackers could use them to access and modify hosted websites. DreamHost has notified affected customers and is urging them to change their credentials. The two-month window of unauthorized access suggests the intrusion may have gone undetected for an extended period, raising concerns about detection and response capabilities.
Bekijk origineel advisory →France's national blood service (Établissement Français du Sang) confirmed a cyberattack targeting a third-party refrigeration equipment provider. The attack altered temperature and defrost settings at three blood storage facilities, directly threatening the integrity of stored blood products. This incident highlights the vulnerability of critical healthcare supply chain components to cyberattacks. The attack targeted operational technology (OT) systems responsible for maintaining safe storage conditions for blood. No specific threat actor has been attributed at this time. The incident raises serious concerns about patient safety and the security of medical infrastructure. Authorities and cybersecurity teams are investigating the breach and working to restore normal operations.
Bekijk origineel advisory →A critical vulnerability in APT, the package manager used by Debian and Ubuntu, allows a man-in-the-middle attacker to swap a verified package with a malicious one during download. The attacker's substituted package runs with root privileges, enabling full system compromise. The flaw is triggered when APT retries failed downloads, a behavior enabled by default starting from Debian 12. Advisories were published on November 4 by Debian, Ubuntu, and APT developers. The attack requires the ability to intercept or modify package downloads in transit. This represents a significant supply chain risk for systems relying on APT for package management. Users of Debian and Ubuntu are strongly advised to apply patches immediately.
Bekijk origineel advisory →SonicWall has disclosed two security vulnerabilities affecting its end-of-life Global Management System (GMS) versions 9.5.2 and earlier. The company has stated it will not release patches for these flaws due to the EoL status of the product. One of the vulnerabilities, CVE-2026-109593, carries a critical CVSS score of 9.1 and allows unauthenticated attackers with network access to read internal GMS files. A second vulnerability is also mentioned, capable of altering database records. The lack of patching leaves organizations still running these legacy systems exposed to potential data exposure and database tampering. Users are implicitly urged to upgrade to supported versions of the product.
Bekijk origineel advisory →The developers of Goddess of Victory: NIKKE confirmed that hackers compromised the game's PC launcher scripts in a supply-chain attack. The attackers tampered with launcher scripts to distribute malware capable of stealing credentials and cryptocurrency wallet data. This is a classic supply-chain attack where trusted software distribution infrastructure was leveraged to push malicious payloads to end users. The malware includes both remote access trojan (RAT) capabilities and data-stealing functionality targeting sensitive user information. Players who used the PC launcher during the compromise window may have had their credentials and crypto wallets exposed. The incident highlights the ongoing risk of supply-chain attacks targeting gaming platforms and their large user bases.
Bekijk origineel advisory →mSeven Software, the developer of the mSecure password manager, suffered a cyberattack that exposed an encrypted customer database. The company is warning both current and former customers to take immediate protective actions. Recommended steps include changing passwords, resetting two-factor authentication configurations, and removing passkeys. The breach affected the customer database, though it was reportedly encrypted at the time of exposure. The incident highlights ongoing risks targeting password management solutions, which are high-value targets due to the sensitive credentials they store. Users of mSecure should treat this as a high-priority security event and act on the company's warnings promptly.
Bekijk origineel advisory →StepSecurity introduces a tool called 'Malicious Files' designed to detect files planted by supply chain attacks in GitHub repositories and on developer machines. The article highlights two specific attack campaigns: Miasma and Shai-Hulud, which are known to leave behind malicious artifacts. The tool aims to help security teams identify and remediate these hidden threats. Supply chain attacks targeting developer environments and CI/CD pipelines represent a growing risk. By scanning repositories and local machines, the tool provides visibility into compromise indicators left by these attacks. This is part of StepSecurity's broader effort to secure software supply chains.
Bekijk origineel advisory →A sophisticated phishing campaign dubbed Operation CloudFire exploited Google Calendar invites to lure corporate victims into fake login pages. Attackers leveraged trusted Google redirects to evade detection and bypass multi-factor authentication by hijacking authenticated session tokens. The campaign targeted corporate Google accounts, making it particularly dangerous for enterprises relying on Google Workspace. Material Security investigated and tracked the attacks, implementing blocking measures against malicious messages. The operation involved nearly 900 malicious domains that were subsequently taken down. The use of legitimate Google infrastructure made detection significantly harder for traditional security tools.
Bekijk origineel advisory →Russia-linked APT29 conducted a large-scale watering hole campaign targeting iOS and Android users. The attackers compromised websites and fake domains to deliver mobile exploits. A supply chain attack was leveraged through a Ukrainian web analytics service called Plerdy SEO Tracker. Injected JavaScript code was used to collect browser and device attributes from victims. The campaign was discovered and analyzed by Sekoia researchers Amaury-Jacques Garçon and colleagues. This operation demonstrates APT29's capability to abuse legitimate third-party services for malware distribution. The targeting of both iOS and Android platforms indicates a broad mobile threat scope. The use of watering hole tactics suggests targeted victim profiling and selective exploitation.
Bekijk origineel advisory →CISA has issued a warning to federal agencies about active exploitation of a recently patched high-severity remote code execution (RCE) vulnerability in WordPress. The flaw is being actively exploited in the wild by attackers. CISA's alert signals that the vulnerability poses significant risk, particularly to government and enterprise environments running WordPress. Federal agencies are urged to apply the available patch promptly. The advisory underscores the ongoing targeting of widely-used CMS platforms as vectors for initial access and compromise.
Bekijk origineel advisory →A critical vulnerability in Ruby on Rails allows unauthenticated attackers to write arbitrary files on a server by uploading a specially crafted file. The flaw resides in Active Storage, the Rails component responsible for handling file uploads, and is triggered when applications process uploads using ImageMagick. The Rails project has publicly disclosed the vulnerability via an advisory. Fixes have been released in versions 8.1.4.1 and 8.0.5.2. Applications not using ImageMagick for upload processing are not affected. The severity is high due to the unauthenticated nature of the attack and potential for remote code execution or server compromise via arbitrary file writes.
Bekijk origineel advisory →Two critical vulnerabilities in the Xen hypervisor allow a malicious guest virtual machine to read and write the memory of other VMs running on the same host, including dom0. Dom0 is the privileged VM that manages all other VMs on the host, making this a severe privilege escalation and isolation bypass issue. The Xen Project published an advisory on November 3 confirming the flaws. All Xen versions from 4.6 onward are affected by these vulnerabilities. Patches have been released, but no known mitigations exist aside from applying the patches. The ability to cross VM memory boundaries represents a critical hypervisor escape scenario with significant implications for multi-tenant cloud and virtualization environments.
Bekijk origineel advisory →A China-aligned threat actor known as SlippyNunchucks has been conducting a DNS hijacking campaign targeting the Windows version of Sogou Input Method. The operation exploits insecure HTTP communications within the software to intercept DNS requests. Starting July 1, 2026, the campaign has been used to deploy a backdoor implant called DarkVigil, also known as FDMTP. The campaign appears focused on surveillance objectives, targeting organizations through this supply-chain-adjacent attack vector. By abusing a widely-used Chinese input method application, the attackers can potentially reach a broad set of targets. The DNS hijacking technique allows the threat actor to redirect traffic and deliver malicious payloads without direct exploitation of a traditional vulnerability. This campaign highlights ongoing risks associated with insecure update or communication mechanisms in widely deployed software.
Bekijk origineel advisory →A large-scale watering hole campaign attributed to Russian threat actors has been targeting iOS and Android users. Attackers compromise legitimate websites or create fake portals impersonating real ones to deliver exploits. The campaign leverages n-day exploits in zero-click attack chains, meaning victims do not need to interact beyond visiting the malicious or compromised site. Both iOS and Android platforms are affected, suggesting a broad and sophisticated operation. The use of n-day (known but recently patched) vulnerabilities indicates attackers exploit the gap between patch release and user adoption. This type of attack is particularly dangerous as it requires no user interaction to compromise devices. The campaign highlights the ongoing threat posed by state-sponsored Russian hacking groups targeting mobile platforms.
Bekijk origineel advisory →CISA has added CVE-2026-119977, a high-severity vulnerability in WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaw is a Time-of-check Time-of-use (TOCTOU) race condition with a CVSS score of 8.1. It can be exploited to achieve arbitrary code execution. The vulnerability is triggered during software upgrade processes. Organizations using WordPress are urged to apply patches promptly given the active exploitation confirmed by CISA.
Bekijk origineel advisory →CVE-2024-27834 is an improper authentication vulnerability affecting multiple Apple products including iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. The flaw allows an attacker with arbitrary read and write capability to bypass pointer authentication, a security mechanism designed to protect memory integrity. The vulnerability has been flagged by CISA and is tracked under their Known Exploited Vulnerabilities catalog. Multiple Apple support advisories have been published addressing this issue across different product lines. CISA references BOD 26-04 directives requiring prioritization of security updates based on risk. Forensic triage requirements are also outlined in associated implementation guidance. Users and administrators are urged to apply available patches immediately given the high criticality rating.
Bekijk origineel advisory →Elastic Security Labs' quarterly threats report highlights how adversaries are increasingly weaponizing trust mechanisms across the enterprise stack. The report covers abuse of AI assistants, npm supply chains, identity flows, and legitimate management tools. Attackers are exploiting trusted components to deliver payloads and evade detection. The report spans multiple attack surfaces including software supply chains and identity infrastructure. This reflects a broader trend of living-off-the-land and trust-abuse tactics in modern threat campaigns.
Bekijk origineel advisory →