Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Aesto LLC, operating as Aesto Health, disclosed a significant data breach affecting more than 9.5 million individuals. The breach was discovered recently and reported publicly. The incident represents one of the larger healthcare data breaches in terms of patient count. Healthcare data breaches are particularly sensitive due to the nature of personal and medical information involved. The scale of the breach places it among the more impactful incidents in the healthcare sector. Further details about the nature of the compromised data and the attack vector were not fully elaborated in the article excerpt. Regulatory notifications and patient advisories are likely underway given the magnitude of the breach.
Bekijk origineel advisory →Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-0768 in Langflow, an open-source framework used for building AI applications. The exploitation allows attackers to steal sensitive credentials, tokens, and API keys including those for OpenAI and AWS. The vulnerability requires no authentication, making it particularly dangerous for exposed instances. Langflow is widely used in the AI development community, increasing the potential attack surface. Organizations using Langflow are urged to patch immediately and rotate any exposed credentials. The active exploitation status elevates the severity of this vulnerability significantly.
Bekijk origineel advisory →A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329 with a CVSS score of 9.8, is being actively exploited by threat actors just days after public disclosure. The flaw allows attackers to bypass authentication mechanisms present in default configurations of Artifactory, potentially granting them administrative access to the platform. Security researchers at watchTowr flagged the active exploitation in the wild. The vulnerability's severity is compounded by the widespread use of JFrog Artifactory in enterprise software development pipelines for artifact and package management. Organizations are urged to apply the available patch immediately to mitigate the risk of administrative token minting by unauthorized actors.
Bekijk origineel advisory →A financially motivated threat actor known as Breeze Comet (formerly UNC5669) has been targeting Brazilian financial services, retail, and e-commerce organizations since 2024. The group specializes in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. Google Threat Intelligence Group (GTIG) and Mandiant have been tracking this adversary and provided detailed descriptions of their tactics. The threat actor has executed hundreds of fraudulent transactions through Brazilian payment infrastructure. The campaign highlights ongoing risks to the Brazilian financial sector from sophisticated, targeted cybercriminal operations.
Bekijk origineel advisory →Threat actors conducted a BGP hijacking attack targeting the update infrastructure of Virtualizor, a popular VPS management software. By hijacking BGP routing, attackers redirected update requests intended for legitimate Virtualizor servers to malicious servers under their control. This allowed them to push trojanized or malicious software updates to unsuspecting Virtualizor users. The attack represents a sophisticated supply chain compromise leveraging BGP routing manipulation, a technique that can affect large numbers of users simultaneously. BGP hijacking at this level requires significant resources or access to BGP routing infrastructure. Users of Virtualizor who updated their software during the attack window may have received and installed malicious code. The incident highlights the risks of software update mechanisms that lack strong cryptographic verification and the dangers of BGP as an inherently trust-based protocol. Organizations using Virtualizor should audit their systems for signs of compromise and verify the integrity of installed software.
Bekijk origineel advisory →Cybersecurity researchers discovered 13 malicious Composer theme packages on Packagist, the PHP package repository, designed to target unpatched iOS devices. The packages inject malicious JavaScript into Vietnamese movie and comic streaming sites that install the libraries. The injected code performs two main operations against site visitors: mobile ad-fraud and gambling redirects, while also deploying spyware targeting unpatched iPhones. The ultimate goal appears to be stealing cryptocurrency wallet seeds from compromised iOS devices. This represents a supply chain attack leveraging trusted package repositories to reach end users through compromised websites.
Bekijk origineel advisory →The Iranian threat group Nimbus Manticore has been linked to two newly discovered malware families targeting Linux and macOS systems. The group is using a social engineering tactic where they pose as recruiters and deliver malicious coding tests to victims. The malware consists of cross-platform remote access trojans (RATs) built with Node.js and JavaScript, enabling them to infect multiple operating systems. This campaign represents an evolution of the group's toolset and an expansion of its targeting scope beyond Windows systems. Russian cybersecurity firm Kaspersky is actively tracking this threat actor and their new malware families.
Bekijk origineel advisory →Nearly 22,000 Microsoft Exchange servers exposed to the internet remain unpatched against a high-severity authentication bypass vulnerability. This flaw allows attackers to hijack all user mailboxes on affected servers. The vulnerability is classified as high-severity and represents a significant risk to organizations still running unpatched versions. The large number of exposed servers indicates widespread failure to apply available security updates. Successful exploitation could lead to full compromise of email communications, data exfiltration, and further lateral movement within affected organizations.
Bekijk origineel advisory →CISA published an advisory regarding a denial-of-service vulnerability (CVE-2021-42260) affecting multiple Rockwell Automation programmable logic controllers including ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop) and can be triggered by sending corrupt crafted data to the affected devices. Successful exploitation can cause a major nonrecoverable fault (MNRF), requiring a program download for safety controllers or a stage 2 reset for non-safety controllers. The CVSS v3.1 base score is 7.5 (HIGH) and CVSS v4.0 base score is 8.7 (HIGH), with the attack vector being network-based, requiring no authentication or user interaction. Affected firmware versions are below 34.015, 35.014, 36.013, and 37.011 across the impacted product lines. Rockwell Automation reported the vulnerability to CISA and recommends updating to the patched firmware versions. The advisory affects critical manufacturing infrastructure deployed worldwide. No known public exploitation has been reported at the time of publication.
Bekijk origineel advisory →CISA has published an advisory for two vulnerabilities affecting Rockwell Automation Historian ME (FactoryTalk Historian Machine Edition) in Series B 5.202 and Series C 7.101. CVE-2025-12768 is a high-severity out-of-bounds write vulnerability (CVSS 3.1: 8.0) that allows a low-privileged, network-adjacent attacker to achieve remote code execution. CVE-2026-12661 is a medium-severity stack-based buffer overflow (CVSS 3.1: 4.5) that enables an authenticated adjacent attacker to crash the device via crafted web requests, causing denial of service. Affected critical infrastructure sectors include Chemical, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health, and Water and Wastewater Systems. No public exploitation has been reported. Mitigations include following Rockwell Automation security best practices, minimizing network exposure, using firewalls, and employing VPNs for remote access. Rockwell Automation self-reported these vulnerabilities to CISA.
Bekijk origineel advisory →A privilege escalation vulnerability (CVE-2026-16675) exists in Rockwell Automation FactoryTalk Activation Manager V5.02 and below. The flaw stems from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated local attacker can hijack these console windows to obtain a SYSTEM-level command prompt, granting full access to files, processes, and system resources. The vulnerability carries a CVSS v3.1 score of 7.8 (HIGH) and CVSS v4.0 score of 8.5 (HIGH). Affected sectors include Critical Manufacturing deployed worldwide. Rockwell Automation recommends updating to V5.03 to remediate the issue. No known public exploitation has been reported to CISA at this time.
Bekijk origineel advisory →A denial-of-service vulnerability (CVE-2026-9637) exists in multiple Rockwell Automation Logix Platform products due to improper validation of input length during CIP message processing. Affected products include ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380 across multiple firmware versions up to V36. Exploitation can cause a major nonrecoverable fault (MNRF), requiring a power cycle to restore operation. The vulnerability is remotely exploitable with no authentication or user interaction required, scoring 7.5 (HIGH) on CVSS v3.1 and 8.7 (HIGH) on CVSS v4.0. Rockwell Automation reported the issue to CISA and has released patched firmware versions (V34.015, V35.014, V36.013, V37.011). Organizations unable to patch are advised to follow Rockwell Automation security best practices and isolate control systems from internet exposure. No known public exploitation has been reported at the time of publication.
Bekijk origineel advisory →CISA published an ICS advisory detailing four denial-of-service vulnerabilities in Rockwell Automation RSLinx Classic versions 4.50 and earlier. The vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) can be exploited via crafted CIP packets, causing the RSLinx Classic service to crash and require a restart. Root causes include integer overflow, integer underflow, insufficient data length validation, and classic buffer overflow. CVSS v3.1 scores range from 7.5 to 8.6 (HIGH), while CVSS v4.0 scores range from 8.7 to 9.2 (HIGH to CRITICAL). The fix is available in RSLinx Classic version 4.60. These vulnerabilities affect critical manufacturing sectors worldwide. No known public exploitation has been reported at the time of publication. Rockwell Automation self-reported the vulnerabilities to CISA.
Bekijk origineel advisory →Two recently patched security vulnerabilities in PaperCut NG and MF print management software are being actively exploited in data theft attacks. The vulnerabilities were initially exploited as zero-days before patches were released. Attackers are leveraging these flaws to steal data from affected organizations. PaperCut is widely used print management software deployed across enterprises and educational institutions. The exploitation occurred shortly after patches were made available, indicating rapid weaponization by threat actors. Organizations using PaperCut NG or MF are strongly advised to apply the available patches immediately. The active exploitation underscores the risk of delayed patching for critical software vulnerabilities.
Bekijk origineel advisory →Threat actors are actively exploiting two critical vulnerabilities in Langflow and Ruby on Rails, as reported by VulnCheck. CVE-2026-0768 (CVSS 9.8) affects Langflow and allows attackers to execute arbitrary Python code as root due to improper input validation. CVE-2026-66066 affects Ruby on Rails. The exploitation activity includes credential-probing and command-and-control (C2) operations. Both vulnerabilities are rated critical and are being leveraged in active attack campaigns. Organizations using these platforms are urged to apply patches immediately. The findings highlight the ongoing risk of unpatched web application frameworks being weaponized by threat actors.
Bekijk origineel advisory →This article analyzes a Guildma (also known as Astaroth) malware infection originating from a Brazilian Portuguese phishing email. Guildma is a sophisticated banking trojan primarily targeting Brazilian users and organizations. The malware is typically distributed via spam email campaigns written in Brazilian Portuguese to target local victims. Astaroth/Guildma is known for its use of living-off-the-land binaries (LOLBins) to evade detection and execute its payload. The infection chain often involves malicious attachments or links leading to multi-stage loaders. This malware is capable of credential theft, keylogging, and intercepting banking transactions. The article was published on September 1st and appears on the SANS Internet Storm Center diary.
Bekijk origineel advisory →CVE-2026-61774 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, which can be exploited by an attacker to achieve remote code execution, data tampering, and information disclosure. The vulnerability is tracked under NVIDIA's product security advisory and listed in the National Vulnerability Database. No specific exploitation in the wild has been mentioned, but the potential impact is significant given the range of consequences. NVIDIA has published a security advisory on GitHub. Users of NVIDIA Megatron Bridge are advised to review the advisory and apply any available mitigations or patches promptly.
Bekijk origineel advisory →CVE-2026-84121 is a high-severity vulnerability in Firefox involving a use-after-free condition in the DOM Security component that enables sandbox escape. The flaw allows an attacker to potentially break out of the browser sandbox, which could lead to arbitrary code execution or privilege escalation. Mozilla has addressed the vulnerability in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. Multiple Mozilla Security Advisories (MFSA2026-82 through MFSA2026-85) have been published in relation to this issue. The vulnerability is tracked in Mozilla's Bugzilla under bug ID 2059018. Users of affected Firefox versions are strongly urged to update immediately. The sandbox escape nature of the bug makes it particularly critical as it bypasses a key security boundary in the browser.
Bekijk origineel advisory →LibreNMS versions prior to 26.5.0 contain a remote code execution vulnerability in the AboutController component. The snmpget configuration parameter is passed directly to shell_exec() without proper sanitization or validation. An authenticated administrator can exploit this by modifying the snmpget configuration to reference a malicious executable. Code execution is then triggered by simply accessing the /about endpoint. The vulnerability requires administrator-level authentication, limiting the attack surface but not eliminating the risk. Fixes are available in LibreNMS version 26.5.0 and later. The issue is documented across NVD, GitHub Security Advisories, and VulnCheck.
Bekijk origineel advisory →CVE-2026-61774 affects NVIDIA Megatron Bridge, a component likely related to NVIDIA's AI/ML infrastructure tooling. The vulnerability involves deserialization of untrusted data, a well-known and dangerous vulnerability class. A successful exploit could allow an attacker to achieve remote code execution, tamper with data, or disclose sensitive information. The vulnerability is currently undergoing analysis on the NVD. NVIDIA has published a security advisory referencing this CVE in their product-security GitHub repository. No patch or workaround details are included in the available content. The severity is rated High based on the potential impact of code execution and data compromise. Organizations using NVIDIA Megatron Bridge should monitor for updates from NVIDIA and apply patches as soon as they become available.
Bekijk origineel advisory →