Overzicht van binnengekomen advisories.
2179 resultaten gevonden
Attackers have begun actively scanning the internet for systems vulnerable to a recently disclosed critical flaw in Oracle E-Business Suite (EBS). The vulnerability was recently patched by Oracle, but unpatched systems remain at risk. The scanning activity indicates threat actors are attempting to identify and potentially exploit vulnerable installations before administrators apply the patch. Oracle EBS is widely used in enterprise environments, making this a significant risk for organizations that have not yet updated. The situation underscores the importance of rapid patch deployment following critical vulnerability disclosures, especially when exploit scanning begins shortly after public disclosure.
Bekijk origineel advisory →A critical vulnerability discovered in EDK II, the widely-used open-source UEFI firmware codebase, has existed for approximately 16 years. The flaw allows an attacker to execute arbitrary code on a target machine before the operating system loads, effectively bypassing Secure Boot protections. The attack vector is limited to network-booting scenarios, meaning the machine must be performing a PXE or similar network boot for exploitation to occur. Since EDK II is used by most hardware manufacturers to build their UEFI firmware, the scope of affected devices is extremely broad. The vulnerability poses a significant risk to data centers, enterprise servers, and any environment where network booting is common. Exploitation could allow attackers to implant persistent firmware-level malware or rootkits that survive OS reinstallation. The age of the flaw suggests it may have been present and potentially exploitable in production environments for over a decade.
Bekijk origineel advisory →Adobe has released security patches addressing eight critical vulnerabilities in Adobe Campaign Classic. The most severe flaw, CVE-2026-104351, carries a CVSS score of 9.9 and is a code injection vulnerability enabling arbitrary code execution. The vulnerabilities collectively allow for arbitrary code execution, security feature bypass, and privilege escalation. Adobe has classified all eight as critical severity issues. Users of Adobe Campaign Classic are urged to apply the patches immediately to mitigate potential exploitation risks.
Bekijk origineel advisory →CISA has issued a warning that threat actors are actively exploiting a critical vulnerability in the Brotli compression library, referred to as Node2Shell, Broccoli2Shell, and HTTP2Shell. The flaw is considered critical and has moved from theoretical risk to active exploitation in the wild. CISA's alert signals that organizations using affected Node.js or HTTP/2 implementations leveraging Brotli should treat this as an urgent remediation priority. The vulnerability allows attackers to potentially gain shell-level access to affected systems, hence the 'Shell' suffix in its common names. This type of advisory typically precedes broader exploitation campaigns and ransomware or espionage activity. Organizations are advised to patch immediately and review CISA's Known Exploited Vulnerabilities catalog for guidance.
Bekijk origineel advisory →The Skyw4lker campaign is a device code phishing operation primarily targeting U.S.-based organizations. Rather than relying on traditional credential theft, attackers abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain unauthorized access to corporate accounts. The campaign was analyzed by ANY.RUN, which exposed its methodology and scope. Device code phishing exploits OAuth device authorization flows to trick users into granting attackers access tokens. This technique leaves fewer obvious signs of compromise compared to conventional phishing. The campaign highlights the growing trend of attackers leveraging legitimate infrastructure to bypass security controls.
Bekijk origineel advisory →Anthropic's unreleased AI model autonomously discovered security vulnerabilities in major platforms including Chrome, Safari, Android, Windows, and Linux, and chained them into working proof-of-concept exploits. The exploits were generated in a controlled lab environment after the model was prompted, and were not observed in any real-world attacks. Anthropic responsibly disclosed all discovered flaws to the respective vendors before publication, and all vulnerabilities have since been patched. This marks a significant demonstration of AI-assisted vulnerability research and exploit development capabilities. The findings raise important questions about the dual-use nature of advanced AI models in cybersecurity contexts.
Bekijk origineel advisory →Tailscale has released version 1.104.4 to address critical security flaws in its built-in SSH server. The vulnerabilities reside in how Tailscale SSH handles network connection forwarding, a process executed with root privileges by the Tailscale background daemon. An attacker who has already compromised a device within a Tailscale network could potentially exploit these flaws to gain unauthorized access to services and files on other servers that should only be accessible by the root user. The flaws represent a significant privilege escalation and lateral movement risk within Tailscale-managed networks. Users are strongly advised to update to version 1.104.4 immediately to mitigate the risk.
Bekijk origineel advisory →A critical vulnerability in Oracle PeopleSoft, initially thought to be a single zero-day, has been revealed as three chained flaws. The vulnerability chain, tracked under CVE-2026-35273, has been actively exploited by the threat actor ShinyHunters since May 2026. Oracle patched all three flaws under a single CVE identifier in June 2026. The root cause is a server-side request forgery (SSRF) vulnerability that allows attackers to reach an internal management interface by exploiting PeopleSoft's trust of its own loopback address. Researchers who reported the vulnerabilities disclosed the chained nature of the exploit this week, highlighting the complexity of the attack vector.
Bekijk origineel advisory →CISA has added two vulnerabilities affecting Adobe Commerce, Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities catalog. The primary vulnerability CVE-2026-111497 carries a critical CVSS score of 9.2 and is described as an unchecked return value vulnerability. Hundreds of Adobe Commerce and Magento stores have reportedly been breached via PolyShell attacks. Brotli exploit traffic has also emerged as a related threat vector. The active exploitation of these vulnerabilities prompted CISA to issue the KEV catalog update, urging organizations to patch immediately.
Bekijk origineel advisory →CVE-2026-46300 is a missing initialization of a variable vulnerability in the Linux Kernel. The flaw involves failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place, potentially allowing unintended modification of page-cache-backed data. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root, making it a critical threat. Multiple kernel stable branches are affected, with patches available across several Git commits. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined in CISA implementation guidance. The vulnerability affects open-source components and third-party libraries that may be used by a wide range of products.
Bekijk origineel advisory →CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom VMware ESX. The flaw allows a malicious actor with administrative access to perform certain operations without those actions being recorded in logs. This creates a significant blind spot for security monitoring and forensic investigation. The vulnerability was catalogued by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Broadcom has published a security advisory with remediation details. The absence of audit trails for admin actions could facilitate insider threats or post-compromise lateral movement without detection. Organizations running VMware ESX are advised to apply the relevant security updates promptly.
Bekijk origineel advisory →Japan's GMO Group has issued an urgent warning to customers to disconnect their systems from the internet and shut down their computers. A threat actor who breached GMO's Onamae Desktop Cloud service has threatened to launch a ransomware attack. The company is taking a proactive defensive stance by advising customers to power down PCs to prevent potential ransomware deployment. The incident highlights the risks associated with cloud-hosted desktop services. GMO Group operates one of Japan's largest internet services, making this a significant incident affecting a broad customer base. The threat appears imminent as the attacker set a specific date for the ransomware launch.
Bekijk origineel advisory →The University of New Mexico Health Sciences Center suffered a ransomware attack that caused significant system outages. The attack disrupted patient care operations and academic activities at the institution. Surgeries and other medical procedures were impacted as a result of the cyberattack. The incident highlights the growing threat of ransomware targeting healthcare organizations. System outages forced staff to revert to manual processes, affecting the quality and continuity of care. The attack underscores the vulnerability of healthcare infrastructure to cyber threats.
Bekijk origineel advisory →A credit card skimming group compromised a shared analytics script belonging to e-commerce platform Convertr. The attackers injected malicious code into the script to steal payment card data from shoppers during the checkout process. This is a supply chain attack targeting e-commerce sites that rely on Convertr's analytics. Multiple online stores using the compromised script were likely affected simultaneously. The attack follows a common Magecart-style approach where shared third-party scripts are weaponized to maximize reach. Payment data including card numbers and related checkout information was the primary target. The incident highlights risks associated with third-party script dependencies in e-commerce environments.
Bekijk origineel advisory →Cybersecurity researchers have uncovered details of three cyber attacks targeting Japanese organizations in which AI played a central role, either autonomously or assisting human operators. A threat actor group identified as CyberStrikeAI deployed 44 AI agents to automate malicious hacking operations. Research firm TrendAI analyzed three exposed server environments used by the threat actors. The operations are described as distinct from previously published threat actor behaviors. The use of AI agents marks a significant evolution in offensive cyber capabilities. This represents a notable case of AI being weaponized at scale for targeted cyber intrusions. The attacks highlight growing concerns about AI-augmented threat actors increasing the speed and scale of attacks.
Bekijk origineel advisory →Socket's Threat Research Team discovered a cluster of malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys. The extensions use Unicode homoglyphs to mimic legitimate wallet names and route stolen data to brand-named subdomains of a single C2 apex, bonto[.]io. The Phantom impersonator uses a two-stage approach: a loader fetches a remote payload at runtime, allowing operators to swap the stealer after Mozilla's review. All three extensions also bundle complete stealers in their signed packages. The Phantom package additionally contains a Node.js drainer backend that forwards stolen secrets via Telegram and auto-sweeps funds to hardcoded wallet addresses across multiple blockchains. Infrastructure provisioned for Coinbase and Exodus subdomains suggests the campaign is broader than the three confirmed listings. Rating manipulation was observed on the Phantom listing to suppress negative reviews from victims reporting fund losses. All three listings have been removed from Firefox Add-ons as of publication.
Bekijk origineel advisory →Tailscale's security team has disclosed nearly a dozen vulnerabilities in its SSH implementation that pose serious risks to users. The flaws could be exploited by attackers to steal credentials, crash servers, and gain root privileges on affected systems. Tailscale is actively working to patch these vulnerabilities. The issues are particularly concerning given Tailscale's wide use as a secure networking and remote access tool. Root privilege escalation vulnerabilities are considered high-severity as they allow attackers full control over compromised systems. No specific CVE identifiers were mentioned in the article snippet. Users of Tailscale SSH functionality are advised to monitor for patches and apply them promptly. The breadth of vulnerabilities (approximately a dozen) suggests systemic issues in the SSH feature implementation.
Bekijk origineel advisory →Apple has backported a fix for a high-severity vulnerability tracked as CVE-2026-86950 to older iPhones and iPads. The flaw, scoring 8.8 on the CVSS scale, is an out-of-bounds write issue in the CoreGraphics framework. Exploitation of this vulnerability can lead to arbitrary code execution when a maliciously crafted file is processed. The flaw was confirmed to have been exploited in real-world cyberattacks. Apple had originally released patches last month for newer devices and has now extended coverage to legacy hardware. The backport underscores the active exploitation risk associated with this vulnerability. Users of older Apple devices are strongly encouraged to apply the update immediately.
Bekijk origineel advisory →Microsoft has patched a vulnerability in its Authenticator app for Android, tracked as CVE-2026-80097. The flaw allowed a malicious app with no special permissions to impersonate trusted Microsoft applications such as Teams. By exploiting this vulnerability, an attacker could collect sign-in tokens associated with a victim's work account. The fix was released in Microsoft Authenticator for Android version 6.2606.4246. Users are strongly advised to update to the patched version immediately. The vulnerability posed a significant risk to enterprise environments relying on Microsoft Authenticator for multi-factor authentication. No permissions were required for the malicious app to carry out the attack, lowering the barrier for exploitation significantly.
Bekijk origineel advisory →CISA published ICS advisory ICSA-26-300-01 covering four vulnerabilities in EPICS Base versions 7.0.10 and prior, used in critical manufacturing infrastructure worldwide. The highest severity CVE-2026-114595 scores 9.8 (CRITICAL) on CVSS v3.1 and involves an integer overflow in network request processing that can lead to memory corruption, denial of service, or remote code execution. CVE-2026-114596 (CVSS 8.2 HIGH) involves improper validation of message length values causing integer overflow and out-of-bounds memory write. CVE-2026-114597 (CVSS 7.5 HIGH) and CVE-2026-114598 (CVSS 7.5 HIGH) involve insufficient validation of element/length values enabling out-of-bounds reads, potential DoS, and memory disclosure. All vulnerabilities are remotely exploitable with no authentication or user interaction required. The EPICS Community has released version 7.0.11 as the fix. These vulnerabilities were reported by Shubham Raj of Cipher/Causal Security. No known public exploitation has been reported at this time.
Bekijk origineel advisory →