Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Kyverno versions v1.9.0 through v1.12.7 contain a flaw in policy exception handling. When a policy running in enforce mode is combined with two PolicyExceptions, the less restrictive exception incorrectly takes precedence over the more restrictive one. An attacker can exploit this by crafting a resource name that matches the second exception's wildcard name pattern (e.g., '*ingress*'), effectively bypassing enforced policies. This vulnerability can be used to circumvent critical security policies, such as those blocking hostPath volume mounts in Kubernetes workloads. The issue represents a security control bypass in a Kubernetes-native policy engine widely used for admission control. The flaw was fixed in Kyverno v1.13.0. Organizations running affected versions should upgrade immediately to mitigate the risk of policy bypass attacks.
Bekijk origineel advisory →The Cronos blockchain network was forced to restart following a price-manipulation attack targeting the Tectonic cryptocurrency lending platform. An attacker exploited the platform to borrow approximately $74 million through the manipulation attack. Cronos subsequently halted and then resumed trading activity after addressing the incident. The attack highlights ongoing vulnerabilities in decentralized finance (DeFi) lending protocols, particularly around price oracle manipulation. Tectonic is a crypto lending service built on the Cronos blockchain. The exploit allowed the attacker to leverage manipulated asset prices to borrow funds far exceeding what would normally be collateralized. This type of flash loan or price oracle attack is a recurring threat vector in the DeFi ecosystem. The incident underscores the financial risks associated with DeFi platforms and the systemic impact such exploits can have on underlying blockchain networks.
Bekijk origineel advisory →A researcher running an internet-exposed inference honeypot discovered it had been co-opted by adversaries who relabeled it with popular AI model names and incorporated it into infrastructure advertised as providing 'free' LLM backends. The honeypot subsequently received a real coding-agent session containing sensitive context including conversation history, filesystem output, working directory paths, and the agent's local tool manifest. The researcher clarifies the honeypot did not request or trigger any tool execution, but the incident demonstrates what a malicious operator in that position could do with such access. This highlights a significant supply-chain and data-exposure risk for developers using unverified or 'free' LLM endpoints with AI coding agents. The attacker effectively performed a man-in-the-middle interception of an AI agent workflow, gaining visibility into the developer's local environment. The scenario underscores risks of trusting unverified AI infrastructure and the potential for credential, code, and environment data exfiltration through compromised LLM endpoints.
Bekijk origineel advisory →Microsoft has issued a warning about a new variant of the ClickFix social engineering technique called TerminalFix. The attack leverages fake Cloudflare CAPTCHA prompts displayed on compromised websites to deceive victims. Users are tricked into copying and running malicious PowerShell commands in Windows Terminal. The campaign deploys reverse tunnels as part of its payload delivery or persistence mechanism. TerminalFix represents an evolution of the ClickFix attack pattern, expanding the attack surface beyond the Run dialog to Windows Terminal. The use of reverse tunnels suggests the attackers seek persistent, covert access to compromised systems. This technique is particularly dangerous as it abuses legitimate user interfaces and trusted brand names like Cloudflare.
Bekijk origineel advisory →Socket's Threat Research Team discovered 13 malicious Composer/Packagist theme packages across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject malicious JavaScript into Vietnamese movie and comic streaming sites. The injected code runs two operations: a mobile ad-fraud/gambling redirect chain, and on iPhones, a WebKit-to-kernel exploit chain (DarkSword-linked, using CVE-2025-31277 and CVE-2025-43529) that installs spyware. The spyware collects keychain data, Wi-Fi passwords, SMS, contacts, photos, browser cookies, location history, and cryptocurrency wallet seeds from seven wallet apps (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX). The campaign is attributed to Vietnamese-operated threat actors using FUNNULL infrastructure (sanctioned by OFAC). On 2026-08-12, the operators redeployed with fresh filenames and added crypto-wallet seed theft. The kernel escape was patched in iOS 26.1 and WebKit entry points in iOS 18.7.3/iOS 26.2; unpatched devices remain vulnerable.
Bekijk origineel advisory →Berlin's city administration has confirmed a data theft incident after the Rhysida ransomware gang listed the city on their data leak site. The cybercriminals are actively attempting to extort the city government. Rhysida is a ransomware-as-a-service group known for targeting government and public sector entities. The attack resulted in confirmed exfiltration of data belonging to the city. Berlin authorities are responding to the extortion attempt. This incident highlights the continued targeting of European municipal governments by ransomware groups. The Rhysida gang uses double extortion tactics, threatening to publish stolen data if ransom is not paid.
Bekijk origineel advisory →The Silver Fox threat actor has been distributing the ValleyRAT backdoor disguised as a signed Chinese adware application called QN Wallpaper, a legitimate desktop-wallpaper tool. By hiding malware within a signed application, attackers exploit the tendency of users to add trusted or familiar software to antivirus exclusion lists. This allows the malware to run under a trusted process, effectively bypassing antivirus detection. Kaspersky, a Russian cybersecurity vendor, identified and reported on this campaign. The technique highlights the growing abuse of signed software and user trust as a vector for malware delivery. The campaign demonstrates sophisticated social engineering combined with code-signing abuse to evade security controls.
Bekijk origineel advisory →Threat actors linked to Aurora ransomware (also known as Aur0ra) have been observed leveraging Cursor, an AI-powered coding assistant, to conduct attacks against at least 10 targets. The findings come from independent analyses by CloudSEK and Gambit Security, based on exposed infrastructure tied to the Russian-speaking cybercrime group. The use of AI coding tools in ransomware operations marks a notable evolution in attack methodology. The group appears to be utilizing Cursor to assist in developing or refining attack tooling. This incident highlights growing concerns about the abuse of legitimate AI development tools by ransomware operators.
Bekijk origineel advisory →The Spring Ring campaign exploits Microsoft Teams as a vector for voice phishing (vishing) attacks targeting enterprise environments. Attackers abuse Teams' communication features to socially engineer victims into executing malware. The campaign ultimately aims to compromise enterprise domain controllers, indicating a high-level threat to organizational infrastructure. The attack chain combines voice-based social engineering with malware deployment, making it a sophisticated multi-stage operation. This research from Palo Alto Networks Unit 42 provides an inside look at the tactics, techniques, and procedures used in these campaigns. The targeting of domain controllers suggests the threat actors are seeking privileged access and lateral movement within enterprise networks.
Bekijk origineel advisory →A China-linked cyber espionage group tracked as Fire Ant has expanded its campaign beyond VMware hypervisors to target Cisco IOS XR routers, TACACS servers, and Linux management hosts. The threat actor aims to steal credentials and disable security logging on high-value networks. Incident response firm Sygnia investigated the intrusion and attributed it to Fire Ant. The campaign targets critical network infrastructure used for routing, authentication, and management. The expansion of attack surface suggests an evolving and sophisticated threat actor with persistent access objectives. TACACS server compromise enables credential theft at scale across managed network devices. Blinding security logs indicates deliberate operational security measures to evade detection. The campaign reflects broader Chinese cyber espionage interest in telecommunications and enterprise network infrastructure.
Bekijk origineel advisory →The U.S. Department of Justice issued a correction to a previously released press statement regarding Chinese threat actor attacks on U.S. government agencies. The DoJ clarified that agencies including NASA, the Federal Reserve, the Department of Energy, and the DoJ itself were targeted rather than confirmed victims. This distinction between 'targeted' and 'victims' is significant in cybersecurity and legal contexts. The correction suggests the initial statement may have overstated the impact or success of the intrusion attempts. The incident highlights ongoing Chinese cyber espionage efforts directed at critical U.S. government institutions. The clarification raises questions about the accuracy of initial threat assessments and public communications from federal agencies.
Bekijk origineel advisory →PaperCut NG/MF contains a critical unsafe reflection vulnerability (CVE-2026-82078) that allows attackers to manipulate system configuration parameters and execute arbitrary Java bytecode on the application classpath. The execution occurs under the security context of the PaperCut server process, granting significant privileges to a potential attacker. This vulnerability can be chained with CVE-2026-81578 to increase attack impact. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. PaperCut has issued an urgent security advisory urging immediate patching. Forensic triage requirements have also been outlined by CISA for affected organizations. The vulnerability poses a high risk to enterprise print management environments running PaperCut NG or MF.
Bekijk origineel advisory →PaperCut NG/MF contains a missing authentication for critical function vulnerability (CVE-2026-81578) that allows unauthenticated remote attackers to modify system configurations. The vulnerability can be chained with CVE-2026-82078 to potentially increase the impact of exploitation. CISA has flagged this vulnerability under BOD 26-04, requiring prioritized security updates. An urgent security advisory was published by PaperCut on August 27, 2026. The flaw is classified as high severity due to its unauthenticated remote exploitation potential. Organizations using PaperCut NG/MF are urged to apply patches immediately. CISA also provides forensic triage requirements as part of the BOD 26-04 implementation guidance.
Bekijk origineel advisory →CVE-2026-82855 affects @hulumi/policies versions before 1.3.2, exposing an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators. Attackers can exploit this flaw by submitting compliant evidence from unrelated zones, hostnames, origins, or repositories to suppress policy violations. This allows bypassing security guardrails for unrelated resources within the same stack. The vulnerability undermines the integrity of policy enforcement mechanisms designed to govern deployments and Cloudflare configurations. The issue is resolved in version 1.3.2 of the package. The vulnerability has been assigned a high criticality rating, indicating significant risk to affected deployments. Organizations using @hulumi/policies for infrastructure governance should upgrade immediately to mitigate potential exploitation.
Bekijk origineel advisory →CVE-2026-51720 describes an incorrect access control vulnerability in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw exists in the delIpPortFilterRules function, which fails to enforce authentication before processing requests. Unauthenticated remote attackers can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Successful exploitation allows attackers to delete firewall IP/port filter rules, potentially exposing the network to further attacks. The vulnerability is significant because it undermines network perimeter defenses without requiring any credentials. It affects TOTOLINK T6 routers, which are consumer and small business networking devices. References include GitHub repositories detailing vendor coordination efforts and the TOTOLINK official website for firmware downloads.
Bekijk origineel advisory →A critical OS command injection vulnerability (CVE-2026-82668) has been identified in klaussilveira GitList version 2.0.0. The vulnerability exists in the getDefaultBranch function within src/SCM/System/Git/CommandLine.php of the Git Command Line component. An attacker can exploit this flaw remotely to execute arbitrary OS commands. The exploit has been publicly disclosed and is available for use, increasing the risk of active exploitation. A patch has been released and is identified by commit 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Users are strongly advised to upgrade to GitList version 3.0.0-beta to remediate the vulnerability. No workaround is mentioned other than upgrading the affected component.
Bekijk origineel advisory →CVE-2026-82856 affects @hulumi/policies versions before 1.3.2, which fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can exploit this vulnerability by using ForAnyValue:StringLike operators to obscure wildcard GitHub Actions OIDC subject conditions, effectively bypassing security guardrails. This allows malicious actors to craft trust policies that appear compliant but grant overly permissive access. The vulnerability poses a significant risk in CI/CD pipelines that rely on GitHub Actions with AWS IAM role assumption via OIDC federation. The fix is available in version 1.3.2 of the package. Organizations using this library should upgrade immediately to prevent unauthorized AWS resource access. The issue has been documented in both the GitHub security advisory and VulnCheck advisories.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the WordPress plugin 'Throws SPAM Away' affecting versions 3.8.2 and earlier. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially exposing sensitive database information or enabling further compromise of the WordPress site. The flaw is documented under CVE-2026-81763 and has been reported via both the NVD and Patchstack vulnerability databases. No authentication is required to exploit this vulnerability, making it particularly dangerous for unpatched installations. WordPress site administrators using this plugin are advised to update to a patched version immediately. The vulnerability was assigned a high severity rating. Details are available through the NVD and Patchstack advisory pages.
Bekijk origineel advisory →A critical unrestricted file upload vulnerability has been identified in the Cozmoslabs Profile Builder Plugin for WordPress, affecting versions up to 3.16.1. The vulnerability resides in the wppb_ajax_simple_avatar function within the Avatar Simple Upload AJAX Handler component at /wp-admin/admin-ajax.php. An unauthenticated remote attacker can exploit this flaw to upload arbitrary files to the server, potentially leading to remote code execution. The exploit has been publicly disclosed, increasing the risk of active exploitation in the wild. The vulnerability has been assigned CVE-2026-82607 and is rated as high severity. WordPress site administrators running affected versions are strongly advised to upgrade to version 3.16.2, which resolves the issue. No workaround is documented other than upgrading the plugin.
Bekijk origineel advisory →A critical OS command injection vulnerability (CVE-2026-82692) has been discovered in D-Link DNS-340L and DNS-345 NAS devices up to firmware version 20260717. The vulnerability exists in the /cgi-bin/iscsi_mgr.cgi file, where manipulation of the alias, username, password, or volume_location arguments can lead to OS command injection. The attack can be initiated remotely without requiring physical access. A public exploit has been released, increasing the risk of active exploitation. The vulnerability affects iSCSI management functionality of the affected D-Link NAS devices. D-Link DNS-340L and DNS-345 are network-attached storage devices commonly used in home and small business environments. The public availability of the exploit significantly elevates the risk level for unpatched devices. Users of affected D-Link NAS devices should apply patches or mitigations immediately to prevent potential compromise.
Bekijk origineel advisory →