Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Strapi, a popular open-source headless CMS, contains a cleartext storage vulnerability (CVE-2023-22894) that exposes sensitive user information to attackers with admin panel access via query filters. The vulnerability allows discovery of sensitive user details including passwords and tokens in plaintext. Affected versions may be end-of-life or end-of-service, and users are advised to upgrade to a supported version immediately. This vulnerability is particularly dangerous as it can be chained with CVE-2023-22621 to achieve remote code execution. CISA has listed this in its Known Exploited Vulnerabilities catalog under BOD 26-04 prioritization directives. The flaw affects not only Strapi directly but potentially any product or service relying on Strapi as a component or dependency. Organizations using Strapi are urged to apply available patches or migrate to supported versions without delay.
Bekijk origineel advisory →CVE-2016-3081 is a command injection vulnerability in Apache Struts that allows remote attackers to execute arbitrary code. The vulnerability is exploited via the 'method:' prefix when Dynamic Method Invocation (DMI) is enabled. It is tracked under the Struts advisory S2-032. The issue affects open-source components and third-party libraries that may be embedded in various products. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog. It is referenced under BOD 26-04, which prioritizes security updates based on risk. Organizations using Apache Struts with DMI enabled are urged to apply patches or mitigations immediately. The vulnerability carries a high criticality rating due to its potential for full remote code execution.
Bekijk origineel advisory →CVE-2015-5477 is a data processing error vulnerability in ISC BIND that allows remote attackers to cause a denial of service via specially crafted TKEY queries. The vulnerability affects the BIND DNS server software, which is widely used across many platforms and distributions. Exploitation can result in a crash of the named daemon, disrupting DNS resolution services. The vulnerability is notable for its potential broad impact given BIND's widespread use as an open-source component embedded in various products, including those from Juniper Networks. Red Hat issued a security errata (RHSA-2015:1513) addressing the flaw. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, and it falls under BOD 26-04 prioritization requirements. The vulnerability is remotely exploitable without authentication, making it particularly dangerous for internet-facing DNS infrastructure.
Bekijk origineel advisory →Unit 42 researchers from Palo Alto Networks have published an analysis detailing how threat actors are leveraging Web3 infrastructure to conduct open-source supply chain attacks targeting enterprise cloud environments. The article explores the evolution of attack techniques that combine decentralized Web3 technologies with traditional supply chain compromise methods. Threat actors are exploiting the decentralized and often less-monitored nature of Web3 platforms to host malicious payloads or command-and-control infrastructure. These attacks are designed to breach enterprise cloud environments by compromising dependencies and open-source packages. The research highlights a growing trend of sophisticated attackers adapting emerging technologies to evade detection and maintain persistence in cloud systems.
Bekijk origineel advisory →The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. Threat actors are exploiting vulnerabilities in these devices to lock out legitimate administrators, preventing them from regaining access. The attacks are actively targeting organizations using Fortinet products for network perimeter defense. FortiBleed refers to a known vulnerability affecting FortiGate appliances that allows attackers to read sensitive data from memory. The FBI urges affected organizations to patch their systems immediately and review access logs for signs of compromise. Administrators who have been locked out should follow Fortinet's remediation guidance to restore access. The ongoing nature of these attacks suggests a coordinated and persistent threat campaign. Organizations relying on FortiGate VPN solutions are particularly at risk and should prioritize mitigation efforts.
Bekijk origineel advisory →Hackers compromised third-party operators managing country-code top-level domain (ccTLD) registries for Ghana, American Samoa, and Sierra Leone. By gaining unauthorized access, attackers were able to modify authoritative DNS records for Google domains within these ccTLDs. The attackers also obtained unauthorized HTTPS certificates for several Google domains, enabling potential man-in-the-middle attacks. This attack highlights the risks associated with third-party ccTLD registry operators and DNS infrastructure security. The incident demonstrates how compromising upstream DNS authorities can have cascading effects on major platforms like Google. Unauthorized certificate issuance further compounds the severity by undermining trust in HTTPS for affected domains.
Bekijk origineel advisory →Attackers compromised three country-code top-level domain (ccTLD) registries — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) — and obtained unauthorized HTTPS certificates for several Google domains. While Google's own infrastructure was not directly breached, the compromise of these registries put all domains under those ccTLDs at risk. With fraudulent certificates in hand, attackers could impersonate legitimate Google sites over encrypted HTTPS connections, potentially enabling man-in-the-middle attacks or credential theft. The incident highlights the systemic risk posed by weakly secured national domain registries. Google disclosed the issue on October 6, 2026, and the attack represents a significant abuse of the certificate issuance process tied to domain control validation.
Bekijk origineel advisory →Cybersecurity researchers from CloudSEK and Checkmarx have uncovered a long-running npm supply chain malware campaign dubbed MALFEX. A lone threat actor has published 12 malicious npm packages since August 2023, eight of which have been downloaded over 40,767 times. The packages deliver the Overlord RAT and an information stealer to compromised hosts. The campaign represents a sustained effort to abuse the npm ecosystem for malware distribution. The malicious packages masquerade as legitimate ones to trick developers into installing them. Once installed, they establish remote access and exfiltrate sensitive information from victim systems.
Bekijk origineel advisory →SonicWall has released hotfixes addressing four vulnerabilities in its SMA1000 appliances, which are used to provide remote workers access to corporate networks and applications. The most critical flaw has been rated CVSS 10.0, the highest possible severity score. This vulnerability is a Server-Side Request Forgery (SSRF) flaw that can be exploited without authentication, allowing attackers to send requests through the appliance and access internal functions. SonicWall has stated there is no evidence of active exploitation of any of the four vulnerabilities at the time of disclosure. The patches were released as hotfixes, indicating urgency in remediation. Organizations using SMA1000 appliances are strongly advised to apply the hotfixes immediately given the critical nature of the vulnerability.
Bekijk origineel advisory →Socket Threat Research identified a coordinated campaign of 16 malicious Firefox extensions targeting cryptocurrency wallet users, specifically impersonating Rabby Wallet and OKX Wallet. The extensions intercept recovery phrases and private keys during wallet import flows and exfiltrate them to attacker-controlled Cloudflare Workers. Four extensions clone Rabby Wallet under the misspelled brand 'Raabby WaIIet', while twelve clone OKX Wallet under a 'Portal WALLET' facade. All extensions share a common campaign marker 'EQOx7EIPZSNi' and primarily use the same Cloudflare Worker infrastructure at 'icy-star-f45c.workers.dev'. The campaign uses multiple exfiltration transports including GET requests, POST JSON, sendBeacon, and image-pixel fallbacks. Mozilla unpublished all 16 extensions as of October 5th. This campaign is assessed with high confidence to be a continuation of a crypto-theft extension campaign Socket previously identified in August 2026. Affected users should treat exposed wallets as fully compromised and immediately migrate assets to new wallets.
Bekijk origineel advisory →A critical unpatched vulnerability has been discovered in LMCache, an open-source caching layer designed to accelerate large language model (LLM) servers like vLLM. The flaw resides in LMCache's multiprocess mode, where the cache operates as a standalone server communicating with LLM workers via the ZeroMQ messaging library. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the cache server without any credentials. No fixed version is currently available, leaving all users of the affected component exposed. The vulnerability is particularly concerning given the growing adoption of LLM infrastructure in enterprise and cloud environments. The use of ZeroMQ without proper authentication mechanisms appears to be the root cause of the issue. Organizations running LMCache in multiprocess mode are advised to isolate the service from untrusted networks as a temporary mitigation.
Bekijk origineel advisory →A new malware family named PoeLLM has been identified targeting exposed AI and large language model (LLM) infrastructure. The financially motivated campaign, dubbed Canto Incognito, has compromised over 3,400 servers. The malware deploys cryptocurrency miners and expands a botnet by leveraging vulnerable AI/LLM endpoints. Cybersecurity researchers are raising alarms about the scale and sophistication of the operation. The campaign highlights growing risks to AI infrastructure as it becomes an increasingly attractive attack surface for threat actors seeking computational resources for crypto mining.
Bekijk origineel advisory →On October 5th, Atlassian released patches for multiple products addressing an 'Arbitrary File Access' vulnerability tracked as CVE-2026-21589. The vulnerability allows attackers to read arbitrary files within the web application's directory. This could expose sensitive information such as configuration files. Active scanning for this vulnerability has been detected as of October 7th. The flaw impacts multiple Atlassian products. The vulnerability was publicly disclosed alongside patches, which typically accelerates exploitation attempts. Security teams are advised to apply patches immediately. The scanning activity suggests threat actors are actively probing for unpatched systems.
Bekijk origineel advisory →A critical vulnerability tracked as CVE-2026-21589 has been discovered affecting multiple Atlassian product families including Jira, Confluence, and Bitbucket. The flaw allows attackers to exploit the systems without requiring any authentication, making it particularly dangerous. Following the public release of a proof-of-concept (PoC) exploit, threat actors have begun actively exploiting the vulnerability in real-world attacks. The unauthenticated nature of the exploit significantly lowers the barrier for attackers. Organizations using affected Atlassian products are urged to apply patches immediately to mitigate risk.
Bekijk origineel advisory →The FBI and Secret Service (USSS) have issued a joint warning that the FortiBleed credential harvesting campaign remains actively targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign exploits reused or leaked credentials combined with legacy SHA-256 password storage vulnerabilities to compromise devices. Over 86,644 Fortinet device credentials have been amassed by threat actors through this ongoing campaign. The advisory highlights the risks posed by poor credential hygiene and outdated password hashing mechanisms in widely deployed network security appliances. Organizations using Fortinet FortiGate devices are urged to rotate credentials, upgrade firmware, and review authentication configurations immediately.
Bekijk origineel advisory →A critical arbitrary file access vulnerability tracked as CVE-2026-21589 with a CVSS score of 9.3 has been disclosed affecting multiple Atlassian Data Center products. The affected products include Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, and Jira Software Data Center. Threat actors began attempting to exploit the flaw within two hours of public disclosure. The vulnerability allows unauthorized access to sensitive files under certain conditions. The rapid exploitation timeline highlights the urgency for organizations to patch affected Atlassian Data Center deployments immediately.
Bekijk origineel advisory →CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute an information-stealing malware known as LunexStealer, also referred to as Psychedelic Stealer. The campaign was observed in September 2026 and attributed to the threat cluster UAC-0277. The attack technique involves fake Cloudflare verification checks to trick users into executing the malware. The widespread nature of the campaign, affecting more than 100 websites, indicates a coordinated and large-scale operation. The malware is designed to steal sensitive information from infected systems. CERT-UA has not yet disclosed the identity of the threat actors behind UAC-0277.
Bekijk origineel advisory →Hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins: Ninja Forms and WPC Product Bundles for WooCommerce. The attacks leverage these flaws to install backdoors on compromised WordPress sites and create rogue administrator accounts. Both plugins have distinct vulnerabilities but are being exploited in related campaigns targeting WordPress installations. The exploitation is active in the wild, making this a high-priority security concern for WordPress site administrators. Site owners using either plugin are urged to update immediately to patched versions to prevent unauthorized access and potential full site compromise.
Bekijk origineel advisory →On the first day of Pwn2Own Ireland 2026, security researchers successfully exploited 32 zero-day vulnerabilities across various devices. The Samsung Galaxy S26 was hacked twice during the competition. Researchers earned a total of $388,500 in prize money for their successful exploits. The competition is a well-known security research event where participants compete to find and exploit previously unknown vulnerabilities. The high number of zero-days demonstrated in a single day highlights significant security weaknesses in modern devices. This event serves as a critical mechanism for responsible vulnerability disclosure to vendors.
Bekijk origineel advisory →Socket has launched experimental scanning support for VS Code Marketplace extensions, covering 100,000+ extensions alongside existing Open VSX coverage. The initiative was prompted by real-world attacks, including a GitHub breach originating from a malicious update to the Nx Console VS Code extension, which led to exfiltration of approximately 3,800 internal repositories. Socket's GlassWorm investigation uncovered a cluster of malicious VS Code and Open VSX extensions disguised as color themes, some using encrypted JavaScript and a Solana dead drop to execute additional payloads. The scanning capability detects risky behaviors including unauthorized file system access, suspicious network activity, process execution, obfuscated code, and hidden functionality. The article highlights that even previously vetted extensions can be weaponized through automatic updates without developer awareness. Socket's analysis covers code, activation patterns, dependencies, and capabilities to help security teams make informed decisions about extension adoption.
Bekijk origineel advisory →