Overzicht van binnengekomen advisories.
2179 resultaten gevonden
Google has issued a warning about mass exploitation of CVE-2026-35273, a critical vulnerability (CVSS 9.8) in Oracle PeopleSoft. The flaw allows unauthenticated remote code execution and is being actively weaponized by threat actors linked to ShinyHunters. Attackers are bypassing Web Application Firewalls (WAFs) to exploit the vulnerability and deploy web shells on compromised systems. The campaign targets multiple sectors globally and the vulnerability was initially exploited as a zero-day. The activity represents a significant threat to organizations using Oracle PeopleSoft across various industries.
Bekijk origineel advisory →A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been discovered in the Elementor Website Builder WordPress plugin. The flaw carries a CVSS score of 8.8 out of 10.0 and allows unauthenticated attackers to create rogue administrator accounts and take full control of affected websites. Exploitation requires an admin user to click a specially crafted link. No CVE identifier has been assigned yet at the time of publication. The vulnerability affects specific versions of the plugin, though full version details were not included in the available content. Given the widespread use of Elementor across millions of WordPress sites, the potential impact is significant. Site administrators are advised to monitor for patches and apply updates promptly.
Bekijk origineel advisory →WordPress Core contains a remote file inclusion vulnerability tracked as CVE-2026-87902. An unauthenticated attacker can exploit this flaw to manipulate page-template resolution, forcing it to include arbitrary readable local PHP files outside the active theme directories. This can lead to remote code execution without requiring authentication. The vulnerability has been documented in a GitHub Security Advisory (GHSA-7hp8-65ch-5whp) and listed in the NVD. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under the BOD 26-04 implementation guidance. The current risk level is rated High due to the potential for unauthenticated remote code execution on WordPress installations.
Bekijk origineel advisory →A code injection vulnerability has been identified in Microsoft SharePoint, tracked as CVE-2026-65660. The vulnerability allows an authorized attacker to execute arbitrary code over a network. It has been listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which prioritizes security updates based on risk. Microsoft has published guidance through its Security Response Center. CISA has also published forensic triage requirements as part of BOD 26-04 implementation guidance. The vulnerability is rated High criticality. Organizations using Microsoft SharePoint are advised to apply available security updates promptly. The vulnerability is also tracked in the NVD database.
Bekijk origineel advisory →CVE-2026-67279 is a vulnerability in Mikrotik RouterOS involving improper enforcement of behavioral workflow. It allows an unauthenticated client to open a session channel and send an exec request without authentication. This vulnerability can be chained with CVE-2026-86060 to achieve full unauthenticated exploitation of affected devices. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements are also outlined under the BOD 26-04 implementation guidance. Mikrotik has published a security advisory for September 2026 addressing this issue. The vulnerability is tracked in the NVD under CVE-2026-67279. The current risk level is assessed as High, indicating active concern and urgency for patching.
Bekijk origineel advisory →CVE-2026-71362 is an incorrect authorization vulnerability affecting Adobe Commerce and Magento platforms. The flaw allows attackers to gain elevated access to sensitive resources without requiring any user interaction, making it particularly dangerous. The vulnerability has been catalogued by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Adobe has published an official security advisory (APSB26-92) with remediation guidance. The issue is also tracked in the NVD. CISA has provided forensic triage requirements as part of implementation guidance for the BOD 26-04 directive. The vulnerability is rated High severity. Organizations using Adobe Commerce or Magento are urged to apply security updates promptly to mitigate the risk of unauthorized privilege escalation.
Bekijk origineel advisory →A path traversal vulnerability has been identified in multiple WSO2 products including API Control Plane, API Manager, Traffic Manager, and Universal Gateway. The vulnerability could allow attackers to perform unrestricted file uploads, which may lead to remote code execution. It has been catalogued as CVE-2026-5430 and is listed in CISA's Known Exploited Vulnerabilities. CISA's Binding Operational Directive BOD 26-04 mandates prioritizing security updates based on risk. WSO2 has published a security advisory with remediation guidance. Organizations using affected WSO2 products are urged to apply patches immediately. The vulnerability is rated High severity given its potential for full system compromise via RCE.
Bekijk origineel advisory →Socket's Threat Research team discovered a malicious Firefox extension named 'pdf-para-texto@extensao.local', posing as a PDF identity verification tool. Published September 3, 2026, the extension ships with no hardcoded malicious code, evading static analysis and store reviewers. After installation, it fetches a remote payload from attacker-controlled infrastructure (pdf[.]gusercontent[.]com) and arms itself with a configuration object enabling full Google account takeover. The extension injects scripts into real accounts.google.com pages, steals Google oauth_token session cookies via webRequest interception, and can silently change the victim's Google account password. It uses FedCM API calls to identify victims, streams live session telemetry to the attacker every 500ms, and targets Portuguese- and Spanish-speaking users. The campaign's significance lies in its sophisticated detection-evasion architecture rather than its current scale, which remains limited.
Bekijk origineel advisory →A new Android malware-as-a-service (MaaS) platform named RemControl has been identified targeting users in Europe and Canada. The malware is distributed through malvertising campaigns that impersonate the TVTap IPTV application. RemControl operates as a MaaS offering, suggesting it is available for use by multiple threat actors. The campaign focuses on banking-related fraud, likely harvesting credentials or performing unauthorized financial transactions. The use of a legitimate-looking IPTV app as a lure increases the likelihood of successful infections. The geographic targeting of Europe and Canada suggests a focused operation on regions with high banking digitization. Users are advised to avoid downloading apps from unofficial sources and to verify app authenticity before installation.
Bekijk origineel advisory →Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability affecting the VPN certificate-handling functionality in its Security Gateway product. The flaw allows unauthenticated attackers to execute arbitrary code remotely, making it particularly dangerous. Active exploitation in the wild has been observed, prompting Check Point to issue an urgent warning to its customers. Organizations using Check Point Security Gateway with VPN functionality are advised to apply patches or mitigations immediately. The vulnerability's pre-authentication nature significantly raises its severity and exploitation risk.
Bekijk origineel advisory →Threat actors have escalated from probing to actively exploiting CVE-2026-87902, a critical vulnerability in WordPress. The flaw allows attackers to write files to disk that execute shell commands when accessed, effectively enabling remote code execution. The exploitation represents a significant threat to WordPress site owners worldwide. Security researchers have observed a clear progression from reconnaissance activity to active exploitation. Site administrators are urged to patch immediately to prevent unauthorized code execution and potential full site compromise.
Bekijk origineel advisory →Cybersecurity researchers have uncovered Go-based malware distributed through malicious Terraform providers and Go modules hosted on the HashiCorp registry. This marks the first known instance of threat actors leveraging the HashiCorp centralized repository as a distribution vector for malicious payloads. The identified malicious packages include 'gocommunity-io/dockerd' and 'kreuzwenker/' among others. The attack represents a novel supply chain threat targeting developers and infrastructure-as-code workflows. The malware was written in Go, consistent with a growing trend of attackers using Go for cross-platform malicious tooling. The use of a trusted, widely-used registry like HashiCorp's increases the likelihood of successful compromise. Developers and DevOps teams using Terraform are advised to audit their provider dependencies immediately.
Bekijk origineel advisory →GitLab provides each user a private email address for filing issues by email, but this address functions as a credential. If this address is leaked or discovered by a malicious actor, they can send emails that GitLab will commit as code patches in the victim's name to any branch the victim has push access to, including main/master branches. Additionally, attackers can trigger CI/CD pipeline jobs that execute under the victim's identity and permissions. The vulnerability stems from the fact that GitLab trusts the destination email address as sufficient authentication for performing sensitive repository operations. This represents a significant privilege escalation and identity impersonation risk within GitLab-hosted projects. The feature, labeled 'Email work item to this project,' is intended for convenience but inadvertently exposes users to serious security risks if the address is exposed in logs, forwarded emails, or other leakage vectors.
Bekijk origineel advisory →A financially motivated threat actor is leveraging open-source AI agent frameworks to conduct large-scale attacks against online retailers. The campaign has successfully compromised more than 100 e-commerce websites, deploying JavaScript credit card skimmers (Magecart-style) across them. Over 600,000 credit card records have been stolen as a result. The use of AI agents marks a significant escalation in automation and scale for skimming operations. This represents an emerging threat vector where AI tooling lowers the barrier and increases the efficiency of cybercriminal campaigns targeting payment data. The attack highlights the dual-use risk of open-source AI frameworks being weaponized for financial cybercrime.
Bekijk origineel advisory →Two MikroTik RouterOS SSH vulnerabilities, CVE-2026-67279 and CVE-2026-86060, have been chained together in an attack technique dubbed MikroTrick by CERT Polska. The exploit allows attackers to gain full administrative control over Internet-exposed MikroTik routers without requiring a password, SSH key, or any completed authentication. CVE-2026-67279 is an SSH state-machine flaw, while CVE-2026-86060 is an argument-injection bug in the RouterOS login process. Attack logs indicate exploitation activity has already been observed in the wild. The combination of these two flaws creates a critical unauthenticated remote compromise vector for a widely deployed networking device.
Bekijk origineel advisory →InfraTrust has released a report warning that attackers are increasingly targeting network management systems used to control enterprise infrastructure. Several critical vulnerabilities in these systems are being actively exploited, in some cases before or shortly after vendors publicly disclosed them. The attacks focus on the management plane of enterprise networks, which represents a high-value target due to the broad access such systems provide. The report highlights a trend of threat actors prioritizing infrastructure control systems as entry points. Organizations relying on these management platforms are urged to apply patches promptly and monitor for signs of compromise.
Bekijk origineel advisory →A security research by Varonis reveals a confused deputy attack vector where a Kubernetes user with limited permissions can escalate privileges to gain control of an entire Google Cloud (GCP) organization. The attack exploits the elevated authority granted to Google Kubernetes Config Connector, a component that bridges Kubernetes and GCP resources. By crafting a single malicious Kubernetes YAML file, an attacker can abuse the Config Connector's permissions to perform organization-wide privilege escalation. The vulnerability represents a significant misconfiguration and design risk in hybrid Kubernetes-GCP environments. Organizations using GCP with Kubernetes Config Connector should review and restrict the permissions granted to this component to minimize blast radius.
Bekijk origineel advisory →Unknown threat actors compromised two legitimate MemTensor packages hosted on npm and PyPI to distribute a Go-based implant called sckit. The malware is designed to steal credentials and targets Windows, Linux, and macOS platforms. The compromised package identified includes @memtensor/memos-cloud-openclaw-plugin. Multiple security firms including Aikido, SafeDep, Socket, and StepSecurity reported on the campaign. This represents a supply chain attack leveraging trusted open-source repositories. The implant is platform-specific and cross-platform in scope, broadening its potential victim pool. The use of legitimate package namespaces increases the likelihood of developer trust and accidental installation.
Bekijk origineel advisory →F5 Networks heeft een kritieke kwetsbaarheid verholpen in BIG-IP Access Policy Manager (APM). De kwetsbaarheid stelt een ongeauthenticeerde aanvaller in staat om op afstand malafide code uit te voeren via kwaadaardig netwerkverkeer. Systemen zijn kwetsbaar wanneer een access policy is geconfigureerd en het systeem fungeert als OAuth Authorisation Server. F5 Networks bevestigt dat het een zeroday-kwetsbaarheid betreft die actief wordt misbruikt in het wild. Organisaties die BIG-IP APM gebruiken als OAuth Authorisation Server worden dringend geadviseerd de patch onmiddellijk toe te passen.
Bekijk origineel advisory →Arista Networks has released security patches addressing a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw is being actively exploited in the wild, making it a high-priority security concern for organizations running on-premises VCO installations. Arista Networks has responded by issuing patches to remediate the vulnerability. The article highlights the urgency of applying these patches given the active exploitation status. No specific CVE identifier was mentioned in the available content snippet. Affected organizations are advised to update their VeloCloud Orchestrator deployments immediately to mitigate potential compromise. This incident underscores the risks associated with network orchestration platforms being targeted by threat actors.
Bekijk origineel advisory →