Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label RCE. Show all posts
Supply Chain
Alpine Linux Cyber Security GitLab RCE Supply Chain

Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack


Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure. 

The attacks targeted a maximum-severity vulnerability tracked as CVE-2026-97229, which carries a CVSS score of 10.0. Although Alpine Linux found no evidence that the attackers successfully executed malicious code or modified its software packages, the project said it could not completely rule out a breach.

Alpine Linux is a lightweight, open-source operating system widely used as the foundation for Docker container images. Its GitLab server hosts development repositories, code reviews and continuous integration (CI) jobs, including the build recipes used to produce Alpine software packages. This makes the server an important target for attackers seeking to compromise the software supply chain.

The vulnerability is caused by an integer overflow in Onigmo, the regular expression engine included in Ruby and used by GitLab's CI/CD system. If successful, this could allow the attacker to execute arbitrary code on the vulnerable server.

GitLab disclosed the vulnerability and released security fixes on October 12. However, Alpine Linux initially installed GitLab version 19.3.4 instead of the patched 19.3.5. The project later upgraded to version 19.3.6 on October 22, but the vulnerability remained because the required Ruby security patch was missing from Alpine's custom container image.

Attackers repeatedly crashed GitLab processes

According to Alpine Linux, an attacker created a new account and began submitting specially crafted CI configurations to its GitLab server on October 20-21.

The security team recorded eight worker crashes during the attacks. Four attempts reportedly progressed partway through the exploitation process before failing to complete. 

The attackers also downloaded Alpine Linux's GitLab container image, suggesting they may have been studying the server's configuration and preparing an exploit specifically designed for that environment.

The project later discovered that upgrading GitLab alone was insufficient to address the problem. The security fix required an updated version of Ruby, which was included in GitLab's official packages but was not present in Alpine's custom image.

No evidence of software tampering found

There were doubts about a possible software supply-chain attack. If attackers had successfully compromised the GitLab server, they could potentially have accessed user information, password hashes, two-factor authentication secrets, CI/CD credentials, integration tokens and private project repositories.

GitLab rebuilt from scratch

The project also advised users to change passwords reused on other websites and to pull the updated alpinelinux/gitlab:19.3.6 container image published on October 27. This image includes Ruby 3.3.13, which contains the necessary security fix.

Read more »
Zero-Day Exploits
Citrix NetScaler Cyber Security RCE Security Patch Zero-Day Exploits

Citrix NetScaler Zero-Days Exploited in Attacks

 

Two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are reportedly being exploited in the wild, raising serious concerns for organisations that rely on the products for remote access and application delivery. Security firm watchTowr disclosed the activity on September 26, stating that attackers had used the flaws to achieve remote code execution before Citrix released patches or detailed technical guidance. The company warned that the vulnerabilities could allow attackers to compromise exposed appliances and potentially gain access to connected networks. 

According to watchTowr, the flaws were discovered during forensic investigations into suspected intrusions. Both vulnerabilities reportedly enable remote code execution, meaning an unauthenticated attacker could potentially execute malicious commands on a vulnerable NetScaler device. Because these appliances frequently sit at the edge of corporate networks and handle VPN or application access, a successful compromise could provide attackers with an important entry point for credential theft, lateral movement, data exfiltration or ransomware deployment. 

At the time of the initial disclosure, Citrix had not confirmed the vulnerabilities, published affected-version information or released a security update. The absence of official indicators of compromise or a reliable workaround left administrators with limited options. Some organisations reportedly chose to take NetScaler appliances offline to reduce the risk, although doing so can disrupt remote workers, business applications and customer-facing services. Researchers expected Citrix to issue communications and patches during the week beginning September 28. 

The situation later developed when Citrix confirmed that two critical NetScaler flaws had been exploited and released fixes alongside patches for six additional vulnerabilities. The issues were identified as CVE-2026-88771 and CVE-2026-88772, both carrying a CVSS score of 9.5. The first is an improper input-validation vulnerability that could allow an unauthenticated attacker to run arbitrary commands, while the second involves improper memory-buffer restrictions and could lead to remote code execution or denial-of-service attacks. 

Security teams should treat these vulnerabilities as an emergency priority. Administrators should identify all internet-facing NetScaler ADC and Gateway systems, apply Citrix’s latest fixes immediately and review logs for unusual authentication, configuration or administrative activity. Organisations should also rotate potentially exposed credentials, inspect connected systems for signs of post-compromise activity and restrict management access wherever possible. CISA’s addition of both flaws to its Known Exploited Vulnerabilities catalogue further underlines the urgency of patching and incident investigation.
Read more »
Vulnerabilities and Exploits
DNSSEC RCE Unbound 1.26.1 Unbound DNS Vulnerabilities and Exploits

Unbound 1.26.1 Patches Critical RCE, DoS, and DNSSEC Flaws

 

A major security update has been issued for Unbound, the widely used validating DNS resolver developed by NLnet Labs. On September 16, 2026, the project disclosed a batch of high-severity vulnerabilities affecting versions up to and including 1.26.0, with fixes released in version 1.26.1. These flaws range from heap buffer overflows and use-after-free bugs to DNSSEC validation bypasses, any of which could allow attackers to crash servers or, in some cases, achieve remote code execution. 

RCE and denial-of-service risks 

Among the most serious issues is a heap buffer overflow in Unbound’s DNSSEC validator that can be triggered by a malicious DNSKEY record containing a self-referential compression pointer. This bug, credited to researchers from Nankai University, can lead to denial of service and potential remote code execution because the digest buffer overflows when processing such crafted records. Two additional memory-corruption bugs were also reported: one in DNSSEC canonicalization that affects long query names over TCP, and another in CNAME synthesis that can progressively corrupt heap memory and, under specific conditions, allow code execution. All three vulnerabilities are fixed in the 1.26.1 release, and manual patches are available for administrators who cannot immediately upgrade. 

Unbound’s support for encrypted DNS transports is also affected. A use-after-free bug in the DNS-over-QUIC (DoQ) implementation can be triggered by a malicious client that sends a RESET_STREAM and withholds ACKs, eventually causing the server to exit abnormally after as few as 20 queries. Similarly, a use-after-free in the DNS-over-HTTPS (DoH) cleanup path can be exploited when RPZ drops queries or under heavy traffic, potentially leading to process termination on hardened allocators. In addition, a degradation-of-service flaw in TCP/DoT handling allows an attacker to monopolize a worker’s event loop by streaming distinct uncached queries over a single connection, with no limit on consecutive reads. Fixes for these issues adjust stream shutdown behavior, correct DoH mesh accounting, and introduce read limits similar to those already used for UDP. 

Beyond memory safety, several logic errors undermine Unbound’s security guarantees. A ZONEMD verification bypass creates a window where tampered zone data can be served or written to disk before integrity checks complete, affecting zones below a trust anchor. A cross-zone cache-poisoning bug allows a malicious actor controlling one delegated zone under an NSEC-signed parent to inject insecure wildcard DS records for unrelated sibling domains, effectively forging delegations. Another flaw lets the “serve-expired” feature bypass the wait-limit counter introduced for the DNSBomb mitigation (CVE-2024-33655), enabling pulsing DoS amplification attacks from a single IP. The “ReTrap” family of algorithmic-complexity attacks (TagTrap, DelegationTrap, NsecTrap, AdditionalTrap) can also degrade service by forcing excessive DNSSEC validation work; Unbound 1.26.1 adds throttles and disables validation of the additional section by default to mitigate this. 

Role of administrators 

All users running Unbound 1.26.0 or earlier are urged to upgrade to version 1.26.1 as soon as possible, especially on internet-facing resolvers or those handling DNSSEC-validated traffic. If immediate upgrade is not feasible, NLnet Labs provides individual patches for each CVE that can be applied manually to the source tree. Operators should also review configurations for features like DNS-over-QUIC, DNS-over-HTTPS, DNSCrypt, response-ip/RPZ, and serve-expired, since several vulnerabilities require these options to be enabled. Given Unbound’s role in the DNS infrastructure of countless networks, prompt patching is critical to prevent outages and exploitation in the wild.
Read more »
VPN
Check Point Critical Vulnerability Cyber Security RCE VPN

Check Point Discloses Two Critical VPN Vulnerabilities Allowing RCE


Check Point has addressed two critical flaws in the way its management and firewall products manage VPN certificates. Both vulnerabilities have been assigned a CVSS score of 9.8 out of 10. This makes them one of the most serious flaws impacting the products. The vulnerabilities could permit an unauthorized remote threat actor to run malicious code on compromised devices.

The flaws, tracked as CVE-2026-85103 and CVE-2026-85102, are associated with the validation and processing of digital certificates utilized during VPN connections.

Technical information

The first flaw, CVE-2026-85103, is associated with a heap-based buffer overflow in the VPN certificate data processing. A threat actor may send particularly tailored certificate details to a compromised device and trigger memory corruption.

The second flaw, CVE-2026-85102, is associated with improper verification of certifications during VPN processes. A threat actor could exploit the flaw without getting genuine verification credentials under certain conditions. 

The flaws impact Check Point Security Gateways, while the impacted product range also consists of Security Management Server for the related flaw.

The vulnerabilities affect Check Point Security Gateways, while the affected product range also includes Security Management Server for the relevant flaw.

Potential risks

The flaws can have major risks to enterprises that use Check Point Security Gateways to give site-to-site VPN services or remote-access.

An unauthorized attack may be problematic as the threat actor may not need genuine VPN credentials before trying to abuse the vulnerable component. In case of successful exploitation, remote code execution (RCE) could let a threat actor infect the impacted security infrastructure and may use it as a starting point for more compromise inside an enterprise.

But, Check Point has signalled that it has no proof that these flaws have been abused in the wild. Thus, the incident should be looked at as a critical patching issue and not an active exploitation campaign of the flaws.

Addressing the flaws

The security updates offered by Check Point should be applied to organizations immediately. Admins should check Check Point’s security advisory for the particular product variants and related fixes.

Organizations should also keep an eye for Security Gateway systems and VPN for suspicious activity, unusual certificate-related requests, or suspicious connections.

As both flaws have a CVSS score of 9.8, security teams should prioritize restoration, especially for internet-facing VPN infrastructure. 

Read more »
Zero Day
Adobe Commerce Cyber Attacks Magento RCE Zero Day

StyleSmuggler Flaw Allows Attackers to Exploit Zero Day With Remote Code Execution


Threat actors are exploiting a newly found zero-day flaw in Magento Open Source and Adobe Commerce to install persistent backdoors and compromise online stores.

Dutch e-commerce security firm Sansec found the vulnerability, called “StyleSmuggler,” which lets threat actors run malicious code on compromised servers without needing verification. According to Sansec, it found active attacks starting on September 4,2026 and posted the information after discovering that online stores were already being targeted.

About the vulnerability

StyeSmuggler is a severe remote code execution (RCE) vulnerability impacting present Magento variants. According to Sansec, the flaw successfully reproduced the attack on Magento Open Source variants 2.4.7, 2.4.8 and 2.4.9. This includes the latest 2.4.9 release.

What can impacted merchants do?

For people who are not using Sansec Shield, they can temporarily stop Graphql until Adobe has issued an official patch. “The next Adobe security release is scheduled for Sept 8th, but it is yet unknown if that covers this bug,” Sansec said.

The flaw is notedly troubling as threat actors don’t require any password, admin account, or a username to exploit it. A successful compromise could give attackers the power to run code directly on the server hosting an online store.

Malicious code is injected into Magento's template system by StyleSmuggler. It can get around present safety precautions by utilizing the styles features. It operates in two phases:

  • Create a failure report, for instance, to inject (poison) PHP code.
  • Allow Magento to use a failed payment email to execute the poisoned code.

Threat actors exploit GraphQL and Magento’s template functionality to install malicious code, The attack can then prompt the installed code via Magento’s internal processes, in the end letting them download and run malware on the infected server. 

Stores targeted even after security updates

The attack is not limited to stores running old software, which is a troubling finding.

“The first victim ran 2.4.6-p15 with the July and August 2026 patches applied and security:patch-status clean,” Sansec said. In other words, even having the latest available security updates for the released could not stop the exploit of the new zero-day.

Another group, Disrex found the exploit, a Magento hosting and development company. “One of the Magento servers managed by Disrex was compromised only 50 minutes after the first confirmed StyleSmuggler attack worldwide,” it said.

What’s next?

No official patch has been released at the time of writing this article. 

Read more »
WordPress
Cyber Security data security RCE SQL Injection WordPress

5 Million WordPress Sites Exposed to SQL Injection Vulnerability


A severe security flaw in a famous WordPress migration plugin and backup could allow threat actors to take command of over millions of sites, experts have warned.

About the security flaw

The security flaw is tracked as CVE-2026-19949, it impacts the Backup plugin and All-in-One WP Migration, which is utilized by over five million active wordpress installations. The plugin lets site owners to migrate, import, export, and backup sites, this consists of media files, themes, plugins, and databases.

As per Bleeping Computer, the flaw is a second-order SQL injection vulnerability that could permit an unauthorized threat actor to run malicious code on a compromised site. The flaw impacts variants 7.109 and earlier and has been given high severity, with a 8.8 CVSS score.

Reporting of the flaw

The vulnerability was found by security expert Jack Taylor, who reported the incident to cybersecurity company Wordfence, which investigated and disclosed the flaw. On August 15, 2026, Wordfence informed the plugin’s developer, Servmask, which released variant 7.220 on August 20 to patch the flaw. 

“On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations,” Wordfence reported.

Attack tactic

Contrary to flaws that can be abused immediately, this vulnerability consists of an extra step. Threat actors first place specially tailored data on a compromised website. 

The malicious information remains latent until a website admin does a backup restoration of the archive. “This vulnerability makes it possible for unauthenticated attackers to inject SQL that is later executed when a site administrator performs an archive restore, which can be used to leak the plugin’s secret key and ultimately achieve remote code execution, leading to complete site takeover,” Wordfence said.

Misuse of malicious data

In the restoration stage, the stored malicious data can be used as SQL commands which allows threat actors to take out sensitive data from the website’s database.

An important target is the plugin’s secret ai1wm_secret_key.. If a threat actor accesses this key, it can possibly be used to move from database access to remote code execution (RCE), allowing the threat actor more control over the compromised website.

Through RCE, threat actors could install malicious code, change website files, and create backdoors.

Addressing the flaw

ServMask addressed the CVE-2026-19949 in variant 7.110 of the plugin. Users are advised to update their websites to the latest patched versions of Backup and All-in-One WP Migration.

On August 20, ServMask addressed the CVE-2026-19949 vulnerability in version 7.110 of the plugin.

Read more »
RCE
Critical Vulnerability Cyber Security JFrog Artifactory Organization Security RCE

Attackers Exploit CVE-2026-82329 to Forge JFrog Artifactory Admin Tokens



Cybersecurity researchers have observed attackers exploiting a critical JFrog Artifactory vulnerability shortly after its public disclosure. The flaw allows unauthenticated attackers to obtain administrative privileges on vulnerable self-hosted installations.

Tracked as CVE-2026-82329, the authentication-bypass vulnerability carries a CVSS severity score of 9.8. JFrog published its advisory and released security updates on August 28, 2026. Threat-intelligence researchers subsequently detected exploitation attempts beginning on September 1.

What Is JFrog Artifactory?

JFrog Artifactory is an artifact repository manager used by development teams to store, manage and distribute software packages and binary files.

Because Artifactory often connects directly to software-development and deployment pipelines, administrator-level access could allow attackers to manipulate repositories, steal credentials or introduce malicious components into software builds.

How CVE-2026-82329 Works

The vulnerability affects JFrog Access, the component responsible for authentication and credential management.

According to research shared by watchTowr, Artifactory installations without an additional join key configured may receive a fallback or “phantom” join key. Attackers can potentially abuse this condition to forge access and generate administrator-level authentication tokens.

Successful exploitation does not require an existing account or user interaction. An attacker only needs network access to a vulnerable Artifactory installation operating under the affected configuration.

The vulnerability does not directly provide remote-code execution. However, administrative control over an artifact repository could allow attackers to modify packages, create unauthorized accounts, access sensitive credentials and interfere with connected build systems.

Exploitation Detected in the Wild

WatchTowr researchers reported observing attackers use the vulnerability to generate administrator tokens and enumerate information about users, groups, credentials and federated-access configurations.

Some activity appeared limited to confirming whether a system was vulnerable. In a smaller number of cases, attackers reportedly created backdoor accounts and examined the compromised environment for opportunities to maintain access or expand the intrusion.

Researchers had not observed widespread scanning or mass exploitation when the activity was initially reported. Nevertheless, the rapid transition from public disclosure to exploitation demonstrates the limited time organizations have to secure internet-facing systems.

The Canadian Centre for Cyber Security has also warned that open-source reporting indicates active exploitation of CVE-2026-82329.

Patched JFrog Artifactory Versions

JFrog has released fixes across multiple supported Artifactory branches. Self-hosted customers should upgrade to the applicable fixed release:

  • 7.111.21

  • 7.117.28

  • 7.125.20

  • 7.133.29

  • 7.146.38

  • 7.161.20

JFrog says affected cloud environments have already been fortified and do not require customer action. Administrators of self-hosted deployments should consult the official JFrog security advisory to identify the correct update for their installation.

Recommended Security Measures

Organizations operating self-hosted JFrog Artifactory installations should:

  • Install the appropriate security update immediately.

  • Restrict internet access to Artifactory management interfaces.

  • Review audit logs for unexpected token or administrator-account creation.

  • Revoke unauthorized tokens and remove unfamiliar user accounts.

  • Rotate credentials and secrets accessible through the affected environment.

  • Inspect repositories for unauthorized package or configuration changes.

  • Examine connected CI/CD systems for evidence of lateral movement or artifact tampering.

CVE-2026-82329 is particularly dangerous because compromising a central artifact repository can affect more than the initially targeted server. Attackers with administrative access may be able to interfere with the software-development process and distribute modified components through trusted internal channels.

No public evidence currently confirms that CVE-2026-82329 is connected to the previously reported OpenAI and Hugging Face AI-agent activity involving an internal Artifactory environment. The two stories should be treated as separate security incidents.


Read more »
Zero Day
CVE GeoServer RCE Vulnerabilities and Exploits Zero Day

GeoServer Zero Day Being Probed While No Patch Available


A newly found GeoServer zero-day is already receiving active exploitation efforts, while there is no patch ready yet. Firms using the open-source geospatial platform should keep an eye out for their exposure. 

A cybersecurity expert with the handle q1uf3ng found the vulnerability which has not been given any CVE identifier yet.

Zero-day with no patch

The vulnerability exists in the jsonArrayContains functionality and permits illegal SQL injection. In few configurations, particularly where the flaw can reach a privileged database account, that path may result in remote code execution. The vulnerability has not been given any CVE identifier yet. 

The flaw was publicly revealed on 12 August 2026. Soon after, watchTowr said it started noticing exploitation attempts, with hundreds of attempts coming from a few IP addresses. According to WatchTowr’s Jake Knott, “Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain.”

The timing is crucial here. When enough technical information or proof of concept is public, threat actors don’t have to wait for a well planned exploit. They can compare responses, scan broadly, trigger errors, and make a list of devices to visit later. It is spying with an error message as a compass.

Cyber criminals are probing the flawed GeoServer systems, but no confirmed exploit has been found yet. But experts have warned that exploitation could soon happen. 

According to Knott, “However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix.”

Threat actors are triggering errors to find vulnerable targets before active exploitation, and probing GeoServer systems for unpatched zero-day.

About GeoServer

A well-liked framework for exchanging and publishing geographic data via web services is called GeoServer. Public sector portals, environmental platforms, mapping initiatives, utilities, transportation systems, academic institutions, and internal corporate applications are some of the places where it can be found. Because of this, a remotely reachable instance becomes more than just a technical detail; it may provide credentials, backend services, geographic data, or a path to a larger network.

Read more »
Spear Phishing
data security Hollow Frame malware Matryoshka RCE Spear Phishing

HollowFrame Loader and Matryoshka Malware Used in Spear-Phishing Attack

Experts discovered a recently undocumented Go-based loader framework termed HollowFrame and a Rust-based malware strain called Matryoshka.

Spear-phishing for attacks

Blackpoint Cyber said that the hack starts with a spear-phishing message consisting of a link to an encoded archive, which contains a Windows Shortcut (LNK). Running a file prompts a multi-level strain that consists of privilege escalation, compromising Microsoft Defender protections, while downloading extra payloads.

About Matryoshka

Matryoshka is available in two versions: one that supports HTTP-based communication and command execution, and another that uses GitHub for command-and-control (C2), including beaconing, tasking, reconnaissance, file transfer, and secondary payload delivery. HollowFrame is launched via a DLL side-loading pair consisting of the legitimate Python binary ("python.exe") and a rogue DLL ("python311.dll").

"Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance, file transfer, and deployment of follow-on tooling. These capabilities could support credential theft, lateral movement, and broader domain compromise through additional tools delivered after initial access,” Blackpoint experts Nevan Beal and Sam Decker said.

Attack tactic

The multi-stage hack attacks two endpoints at an unknown law firm. The LNK file mimicked to be Case Documents to lure the victim into opening and triggering a command sequence that deploys PowerShell to get next-stage components from a remote server.

Hollowframe works as a modular loader and persistent framework that assists multiple tactics to deploy auxiliary components, while performing anti-analysis diagnosis to escape running inside sandboxed environments. This is decided based on installed memory, cursor movement, file count in the user profile, and system uptime. Persistence is gained by setting up a scheduled task.

Matryoshka ("version.dll"), a Rust-based backdoor that talks with its C2 server ("45.158.196[.]184:8888") over HTTP to spawn a shell and provide additional tooling, is deployed by unpacking the encrypted container that the Go loader comes with.

Another DLL gained in association with the same activity has been labeled as a version of Matryoshka that uses a private GitHub repository for polling target-specific commands, submitting results, and fetching payloads.

"The repository functioned as a collection of per-host mailboxes, with each victim assigned a dedicated <computer>_<username> directory. These directories contained beacon.json, cmd.json, result.json, and, in some cases, an upload/ tree for file delivery,” Blackpoint said.  

Read more »
Vulnerabilities and Exploits
PostgreSQL RCE Splunk Unauthorised Access Vulnerabilities and Exploits

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

 

Splunk has issued urgent security updates to address a catastrophic vulnerability in Splunk Enterprise that enables unauthenticated remote code execution (RCE). Tracked as CVE-2026-20253, the flaw carries a maximum CVSS score of 9.8, marking it as one of the most severe security issues seen in enterprise data platforms this year. Attackers can exploit this vulnerability to perform arbitrary file operations and execute malicious code without providing any credentials, potentially leading to complete infrastructure compromise. 

The vulnerability stems from the PostgreSQL Sidecar Service introduced in Splunk version 10, which lacks proper authentication controls at its endpoint. Specifically, the service listens locally on port 5435 and allows any network-reachable user to invoke file operations without credentials. According to Splunk's official alert, "an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint" in versions below 10.2.4 and 10.0.7. This missing authentication layer transforms what appeared to be an arbitrary file-creation issue into a full-blown unauthenticated RCE vulnerability. 

Affected versions include all Splunk Enterprise releases below 10.2.4 and 10.0.7, impacting multiple release branches across the 10.x series. The flaw specifically targets the PostgreSQL Sidecar Service API, which was introduced as part of Splunk version 10's architecture. Cybersecurity experts warn that due to the potential for full infrastructure compromise in both enterprise and cloud environments, immediate patching is absolutely required. Organizations running unpatched Splunk instances face extreme risk since the vulnerability requires no authentication whatsoever. 

Splunk has released security updates that properly address this critical flaw by implementing authentication controls at the PostgreSQL Sidecar Service endpoint. Security administrators should prioritize upgrading to version 10.2.4 or 10.0.7 (or newer) immediately to close this attack vector. The cybersecurity community has noted the ironic danger here: Splunk is supposed to be your security monitoring tool, so if this unpatched vulnerability sits on your network, attackers can bypass your very security infrastructure. No active detections in the wild have been confirmed yet, but the severity makes this a likely target for rapid exploitation. 

This vulnerability represents a critical security gap that demands immediate attention from all Splunk Enterprise users worldwide. With a CVSS score of 9.8, CVE-2026-20253 elevates what was initially reported as an arbitrary file-creation flaw into a dangerous unauthenticated remote code execution threat. Organizations must treat this as a top-priority security incident and apply Splunk's patches without delay to prevent potential data breaches, system compromise, or complete infrastructure takeover by malicious actors.
Read more »
Vulnerabilities and Exploits
Anthropic Claude Code MCP RCE Vulnerabilities and Exploits

Claude Code Bugs Enable Remote Code Execution and API Key Theft

 

Claude Code, the coding assistant developed by Anthropic, is in the news after three major vulnerabilities were discovered, which can allow remote code execution and the theft of API keys if the developer opens an untrusted project. The vulnerabilities, discovered by Check Point researchers Aviv Donenfeld and Oded Vanunu, take advantage of the way in which Claude Code deals with configuration features such as Hooks, Model Context Protocol (MCP) servers, and environment variables, which can turn project files into an attack vector. 

The first bug is a high-severity vulnerability, rated 8.7 on the Common Vulnerability Scoring System (CVSS), though it doesn’t have a CVE number. The flaw is related to the bypassing of user consent when the attacker starts the project in an untrusted directory. Using the hooks defined in the repository’s .claude/settings.json, an attacker with commit access can add shell commands in the project, which can be automatically executed when the project is opened in the victim’s environment. In essence, an attacker can execute remote code execution without the need for further user interaction. All the attacker needs to do is ask the victim to open the malicious project, and the attacker can execute the hidden command in the background. 

The second vulnerability, tracked as CVE-2025-59536 and also rated 8.7, extends this risk by targeting Claude Code’s integration with external tools via MCP. Here, attackers can weaponize repository-controlled configuration files like .mcp.json and claude/settings.json to override explicit user approval, for example by enabling the “enableAllProjectMcpServers” option, causing arbitrary shell commands to run automatically when the tool initializes. This effectively transforms the normal startup process into a trigger point for remote code execution from an attacker-controlled configuration. 

The third flaw, CVE-2026-21852, is an information disclosure bug rated 5.3 that affects Claude Code’s project-load flow.By manipulating settings so that ANTHROPIC_BASE_URL points to an attacker-controlled endpoint, a malicious repository can cause Claude Code to send API requests, including the user’s Anthropic API key, before any trust prompt is displayed. As a result, simply opening a crafted repository can leak active API credentials, allowing adversaries to redirect authenticated traffic, steal keys, and pivot deeper into an organization’s AI infrastructure.

Anthropic has patched all three issues, with fixes rolled out across versions 1.0.87, 1.0.111, and 2.0.65 between September 2025 and January 2026, and has published advisories detailing the impact and mitigations. Nonetheless, the incident underscores how AI coding assistants introduce new supply-chain attack surfaces by trusting project-level configuration files, and it highlights the need for developers to treat untrusted repositories with the same caution as untrusted code, keeping tools updated and reviewing configuration behavior closely.
Read more »
Solar Winds
Cloud Cyber Security Data RCE Solar Winds

SolarWinds Web Help Desk Compromised for RCE Multi Stage


SolarWinds compromised 

The threat actors used internet-exposed SolarWinds Web Help Desk (WHD) instances to gain initial access and then proceed laterally across the organization's network to other high-value assets, according to Microsoft's disclosure of a multi-stage attack. 

However, it is unclear if the activity used a previously patched vulnerability (CVE-2025-26399, CVSS score: 9.8) or recently revealed vulnerabilities (CVE-2025-40551, CVSS score: 9.8, and CVE-2025-40536, CVSS score: 8.1), according to the Microsoft Defender Security Research Team.

"Since the attacks occurred in December 2025 and on machines vulnerable to both the old and new set of CVEs at the same time, we cannot reliably confirm the exact CVE used to gain an initial foothold," the company said in the report. 

About the exploit

CVE-2025-40551 and CVE-2025-26399 both relate to untrusted data deserialization vulnerabilities that could result in remote code execution, and CVE-2025-400536 is a security control bypass vulnerability that might enable an unauthenticated attacker to access some restricted functionality.

Citing proof of active exploitation in the field, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-40551 to its list of known exploited vulnerabilities (KEVs) last week. By February 6, 2026, agencies of the Federal Civilian Executive Branch (FCEB) were required to implement the solutions for the defect. 

The impact 

The successful exploitation of the exposed SolarWinds WHD instance in the attacks that Microsoft discovered gave the attackers the ability to execute arbitrary commands within the WHD application environment and accomplish unauthenticated remote code execution.

Microsoft claimed that in at least one instance, the threat actors used a DCSync attack, in which they impersonated a Domain Controller (DC) and asked an Active Directory (AD) database for password hashes and other private data. 

What can users do?

Users are recommended to update WHD instances, identify and eliminate any unauthorized RMM tools, rotate admin and service accounts, and isolate vulnerable workstations to minimize the breach in order to combat the attack. 

"This activity reflects a common but high-impact pattern: a single exposed application can provide a path to full domain compromise when vulnerabilities are unpatched or insufficiently monitored," the creator of Windows stated.

Read more »
RCE
Aviatrix critical vulnerabilities CVE exploits CVE vulnerability Cyber Security Data Exfiltration data security RCE

Critical Command Injection Vulnerability Found in Aviatrix Network Controller (CVE-2024-50603)

 


Jakub Korepta, Principal Security Consultant at Securing, has discovered a critical command injection vulnerability in the Aviatrix Network Controller, identified as CVE-2024-50603. This flaw, impacting versions 7.x through 7.2.4820, has been assigned the highest possible CVSS severity score of 10.0. It allows unauthenticated attackers to remotely execute arbitrary code, posing a severe threat to enterprises utilizing Aviatrix’s cloud networking solutions.

The root of this vulnerability lies in improper input handling within the Aviatrix Controller's API. While certain input parameters are sanitized using functions like escapeshellarg, others—most notably the cloud_type parameter in the list_flightpath_destination_instances action—remain unprotected. This oversight permits attackers to inject malicious commands into API requests, leading to remote code execution (RCE).

Jakub Korepta demonstrated this flaw by crafting a malicious HTTP request that redirected sensitive system files to an attacker-controlled server. By appending harmful commands to the vulnerable parameter, attackers can gain unauthorized access and execute arbitrary code on the targeted system.


In a proof-of-concept attack, Korepta successfully extracted the contents of the /etc/passwd file, highlighting the potential for data theft. However, the threat extends beyond data exfiltration. Exploiting this vulnerability could allow attackers to:
  • Execute Remote Code: Attackers can run commands with full system privileges, gaining complete control over the Aviatrix Controller.
  • Steal or Manipulate Data: Sensitive data stored on the system can be accessed, stolen, or altered.
  • Compromise Entire Networks: Successful exploitation could lead to lateral movement within enterprise networks, escalating the attack's impact.

Research uncovered 681 publicly exposed Aviatrix Controllers accessible via the Shodan search engine. These exposed systems significantly increase the risk, providing attackers with easily identifiable targets for exploitation.

Aviatrix has responded promptly by releasing version 7.2.4996, which addresses this vulnerability through enhanced input sanitization. This update effectively neutralizes the identified risk. All users are strongly urged to upgrade to this patched version immediately to secure their systems and prevent exploitation. Failure to apply this update leaves systems vulnerable to severe attacks.

Recommended actions for organizations include:
  • Immediate Patch Deployment: Upgrade to version 7.2.4996 or later to eliminate the vulnerability.
  • Network Access Controls: Restrict public access to Aviatrix Controllers and enforce strict network segmentation.
  • Continuous Monitoring: Implement robust monitoring systems to detect unauthorized activity or anomalies.

Lessons in Proactive Security

This incident underscores the critical need for proactive cybersecurity measures and routine software updates. Even advanced networking solutions can be compromised if proper input validation and security controls are neglected. Organizations must remain vigilant, ensuring that both internal systems and third-party solutions adhere to stringent security standards.

The discovery of CVE-2024-50603 serves as a stark reminder of how overlooked vulnerabilities can escalate into significant threats. Timely updates and consistent security practices are vital to protecting enterprise networks from evolving cyber risks.
Read more »
Spam
critical vulnerabilities CVE CVE vulnerability CVEs Cyber Security Plugin Flaws plugin security Plugins RCE Spam

Critical Vulnerabilities in CleanTalk WordPress Plugin Put 200,000 Websites at Risk

 

Defiant has raised alarms about two significant vulnerabilities affecting CleanTalk’s anti-spam WordPress plugin, which could enable attackers to execute arbitrary code remotely without requiring authentication. These vulnerabilities, tracked as CVE-2024-10542 and CVE-2024-10781, are classified with a high severity score of 9.8 on the CVSS scale. They impact the “Spam protection, Anti-Spam, FireWall by CleanTalk” plugin, which boasts over 200,000 active installations on WordPress sites globally. 

The flaws pose a significant risk by allowing remote attackers to install and activate arbitrary plugins, including potentially vulnerable ones that can then be exploited for remote code execution (RCE). According to Defiant, the first vulnerability, CVE-2024-10542, involves an authorization bypass issue. This weakness exists in a function responsible for handling remote calls and plugin installations, where token-based authorization is used to secure these actions. 

However, two related functions intended to verify the originating IP address and domain name are vulnerable to exploitation. Attackers can manipulate these checks through IP and DNS spoofing, enabling them to specify an IP address or subdomain under their control. This bypasses the plugin’s authorization process, allowing the attacker to carry out actions such as installing, activating, deactivating, or uninstalling plugins without proper permissions. The vulnerability was discovered in late October and was addressed with the release of version 6.44 of the plugin on November 1. 

However, this update inadvertently introduced another vulnerability, CVE-2024-10781, which provided attackers with an alternative method of bypassing token authorization. CVE-2024-10781 arises from a flaw in how the plugin processes tokens for authorization. Specifically, if a website has not configured an API key in the plugin, attackers can use a token that matches an empty hash value to authenticate themselves. This effectively nullifies the intended security measures and allows attackers to install and activate arbitrary plugins, which can then be exploited for malicious purposes, such as executing remote code. 

The CleanTalk development team addressed this second vulnerability with the release of version 6.45 on November 14, which contains fixes for both CVE-2024-10542 and CVE-2024-10781. Despite the availability of this updated version, data from WordPress indicates that as of November 26, approximately half of the plugin’s active installations are still running outdated and vulnerable versions. This exposes a significant number of websites to potential exploitation. The risks associated with these vulnerabilities are considerable, as attackers could gain complete control over affected websites by leveraging these flaws. This includes the ability to install additional plugins, some of which may themselves contain vulnerabilities that could be exploited for further malicious activities. 

Website administrators using the CleanTalk anti-spam plugin are strongly urged to update to version 6.45 or later as soon as possible. Keeping plugins up to date is a critical step in maintaining the security of WordPress websites. By applying the latest updates, administrators can protect their sites against known vulnerabilities and reduce the risk of being targeted by cyberattacks. In addition to updating plugins, security experts recommend implementing additional security measures, such as monitoring for unauthorized changes, using a robust firewall, and conducting regular security audits. 

These practices can help ensure that websites remain secure against evolving threats. By addressing these vulnerabilities and staying proactive about updates, WordPress site owners can safeguard their online presence and protect the sensitive data entrusted to their platforms.
Read more »
RCE
AI Models Cross Site Scripting Cyber Security Enterprise security Jailbreak Tool Jailbreaking LLM LLM security RCE

Managing LLM Security Risks in Enterprises: Preventing Insider Threats

 

Large language models (LLMs) are transforming enterprise automation and efficiency but come with significant security risks. These AI models, which lack critical thinking, can be manipulated to disclose sensitive data or even trigger actions within integrated business systems. Jailbreaking LLMs can lead to unauthorized access, phishing, and remote code execution vulnerabilities. Mitigating these risks requires strict security protocols, such as enforcing least privilege, limiting LLM actions, and sanitizing input and output data. LLMs in corporate environments pose threats because they can be tricked into sharing sensitive information or be used to trigger harmful actions within systems. 

Unlike traditional tools, their intelligent, responsive nature can be exploited through jailbreaking—altering the model’s behavior with crafted prompts. For instance, LLMs integrated with a company’s financial system could be compromised, leading to data manipulation, phishing attacks, or broader security vulnerabilities such as remote code execution. The severity of these risks grows when LLMs are deeply integrated into essential business operations, expanding potential attack vectors. In some cases, threats like remote code execution (RCE) can be facilitated by LLMs, allowing hackers to exploit weaknesses in frameworks like LangChain. This not only threatens sensitive data but can also lead to significant business harm, from financial document manipulation to broader lateral movement within a company’s systems.  

Although some content-filtering and guardrails exist, the black-box nature of LLMs makes specific vulnerabilities challenging to detect and fix through traditional patching. Meta’s Llama Guard and other similar tools provide external solutions, but a more comprehensive approach is needed to address the underlying risks posed by LLMs. To mitigate the risks, companies should enforce strict security measures. This includes applying the principle of least privilege—restricting LLM access and functionality to the minimum necessary for specific tasks—and avoiding reliance on LLMs as a security perimeter. 

Organizations should also ensure that input data is sanitized and validate all outputs for potential threats like cross-site scripting (XSS) attacks. Another important measure is limiting the actions that LLMs can perform, preventing them from mimicking end-users or executing actions outside their intended purpose. For cases where LLMs are used to run code, employing a sandbox environment can help isolate the system and protect sensitive data. 

While LLMs bring incredible potential to enterprises, their integration into critical systems must be carefully managed. Organizations need to implement robust security measures, from limiting access privileges to scrutinizing training data and ensuring that sensitive data is protected. This strategic approach will help mitigate the risks associated with LLMs and reduce the chance of exploitation by malicious actors.
Read more »
Vulnerabilities and Exploits
Apache CyberCrime Cyberhackers Cybersecurity Cyberthreats RCE Software Vulnerabilities and Exploits

Apache Addresses Severe RCE Vulnerability in OFBiz with an Urgent Patch

 


In a recent release, the Apache OFBiz project developers have been working on a patch to fix a new critical flaw of software that can be exploited by unauthenticated attackers to execute arbitrary code on the server. Considering that attackers are likely to exploit this vulnerability in real-world attacks, users are advised to deploy the patch as soon as possible to avoid falling victim to this vulnerability.

There was a high-severity vulnerability identified as CVE-2024-45195 (CVSS score: 7.5) affecting Apache OFBiz, a popular open-source business enterprise resource planning (ERP) system that is adapted from Apache OFBiz. In the field of enterprise process automation, Apache OFBiz® from the Apache Software Foundation consists of framework components and applications as well as a business process automation framework. 

This vulnerability is caused by Apache's OFBiz implementation of Direct Request ('Forced Browsing'). It has been found that all versions of the software before 18.12.16 are affected by this bug. The project maintainers have been working on CVE-2024-45195 for several months now to prevent the occurrence of a severe sequence of vulnerabilities, CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856, which were already addressed by the project maintainers previously. 

CVE-2024-32113 and CVE-2024-38856, both of which appear to be exploited actively in the wild and the former of which is used to distribute the Mirai botnet malware, are exploited extensively. This was due to Rapid7's inability to desynchronize the controller state from the view map state, something that was never completely resolved in any of the patches that were released, but which led to all three of the earlier shortcomings. 

Because of the vulnerability, attackers may be able to exploit it to execute code, and SQL queries, and remotely execute the code without the need for authentication by exploiting it. This latest patch was put in place to validate that a view should allow anonymous access if a user is not authenticated (rather than performing authorization checks solely based on the target controller)." CVE-2024-38856 and CVE-2024-32113 are, in fact, critical vulnerabilities, and they've been actively targeted by attackers in the past few months. 

The Cybersecurity and Infrastructure Security Agency has listed them in its catalogue of Known Exploited Vulnerabilities in August. There has been speculation that companies can have a hard time resolving the underlying causes of vulnerabilities because of their size. Sometimes it is difficult to judge whether a patch will be effective until several researchers have tried bypassing it to test its effectiveness. It was Rapid7 that identified and reported the vulnerability, and they suggest that the three security defects are essentially the same bug because they are both caused by the same source code. 

In a report published in early May, CVE-2024-32113 was described as an issue in which a malicious user would be able to navigate through an unauthenticated controller and interact with an authenticated view map, granting them access to an admin-only view map or allowing them to execute SQL commands on it. It has been observed that there have been attempts to exploit people in July.  

A second vulnerability, CVE-2024-36104, which was disclosed in early June, was also explained as a path traversal vulnerability. There were multiple issues with the URI, including semicolons and URL-encoded periods that need to be removed. In early August, Apache drew attention to a vulnerability referred to as CVE-2024-38856. 

This has been described as a security flaw that could allow code execution due to an incorrect authorization. CISA, the United States Cyber Defense agency, announced that the bug had been added to its list of Known Exploited Vulnerabilities (KEVs) towards the end of August. Rapid7 said that all three issues are the result of controller-view map state fragmentation, which can occur when an application begins receiving URI patterns that are not expected. 

Assuming the root cause of the three vulnerabilities is the same, CVE-2024-38856 works on systems that are affected by CVE-2024-32113 and CVE-2024-36104, "since the payload for all three vulnerabilities is the same". There was a CVE-2024-32113 OFBiz vulnerability (patched in May) that was being exploited in attacks by hacker groups, just days after SonicWall researchers published detailed technical details on CVE-2024-38856, a bug involving pre-authentication RCE. 

CISA issued a warning regarding this CVE in early August. In addition to adding the two security bugs to its catalogue of actively exploited vulnerabilities, CISA also announced that federal agencies must patch their servers as soon as possible after the three-week deadline mandated by the binding operational directive (BOD 22-01) issued in November 2021. 

Even though BOD 22-01 only applies to agencies of the Federal Civilian Executive Branch (FCEB), the Center for Information Security and Assurance (CISA) is urging organizations to patch these security flaws immediately to prevent the onset of attacks against their networks. A public proof of concept exploit for OFBiz pre-authentication remote code execution vulnerability (CVE-2023-49070) was used in December to identify Confluence servers that were vulnerable to the exploit. 

The exploit was based on public proof of concept exploits. Having discovered that Emmons now had a new view map to abuse called XmlDsDump, he could query the underlying database for any data that may be available and then write the results to any file, anywhere on the disk, without any restrictions. 

Among the data displayed in this presentation could be hashed passwords of users defined in the system, which could then be cracked to reveal their passwords. As a result of this study, the researcher has taken it one step further by combining it with a script he discovered that was present in the system, named ViewDataFile.groovy, which could write files to disk from requests and used it to build a web shell that enabled remote code execution on the server using the script. 

In response to this flaw, OFBiz developers came up with a more comprehensive fix that does not rely only on non-centralized authorization checks on view maps anymore but also takes into account non-centralized authorization checks for target controllers for the view maps as well.
Read more »
RCE
Cloud Platform Data Breach Data Leak GitHub RCE

Major Security Flaw Discovered in Popular Cloud Logging Tool

 



Researchers at Tenable have identified a severe memory corruption vulnerability in Fluent Bit, an open-source logging utility integral to major cloud services. With over 3 billion downloads as of 2022 and an additional 10 million deployments daily, Fluent Bit is a cornerstone of cloud infrastructure used by prominent organisations such as VMware, Cisco, Adobe, Walmart, LinkedIn, and cloud giants like AWS, Microsoft, and Google Cloud.

The issue, dubbed "Linguistic Lumberjack" by Tenable, stems from how Fluent Bit's embedded HTTP server handles trace requests. The vulnerability can be exploited to cause denial of service (DoS), data leaks, or even remote code execution (RCE) in cloud environments.

"While vulnerabilities in major cloud providers like Azure, AWS, and GCP grab headlines, it's crucial to scrutinise the underlying technologies these services rely on," says Jimi Sebree, senior staff research engineer at Tenable. "Critical components like Fluent Bit, which are embedded in many cloud services, pose significant risks if compromised."

Tenable's researchers stumbled upon this flaw while investigating another security issue in a cloud service. They discovered they could access various internal metrics and logging endpoints of the cloud service provider, which included Fluent Bit instances. This cross-tenant data leakage revealed a more profound problem.

The vulnerability lies in the /api/v1/traces endpoint of Fluent Bit's monitoring API. The service fails to validate data types properly, allowing attackers to input non-string values that cause memory corruption. By manipulating these inputs, attackers can crash the service and leak sensitive data. Although exploiting this for RCE would require sophisticated, targeted efforts, the potential for harm remains high.

The bug affects Fluent Bit versions 2.0.7 through 3.0.3 and is tracked under CVE-2024-4323, with critical CVSS scores exceeding 9.5 out of 10. After reporting the issue on April 30, Fluent Bit's developers promptly addressed it by validating input data types in the problematic endpoint. The fix was implemented in the project's main branch on GitHub by May 15.

Organisations using Fluent Bit are strongly advised to update their software to the latest version immediately. Alternatively, administrators should review and restrict access to Fluent Bit's monitoring API to authorised users only, or disable it entirely if feasible.

The discovery of this vulnerability accentuates the importance of scrutinising not just the cloud services themselves but also the foundational technologies they depend on. Ensuring the security of tools like Fluent Bit is vital for maintaining the integrity of cloud environments across industries.



Read more »
RCE
Black Cat Data Breach Encryption Microsoft Phishing Attacks Python Maintainers Ransomware Attacks. RCE

Microsoft Discovers BlackCat's Sphynx Ransomware Exploiting Impacket & RemCom

A new strain of ransomware known as BlackCat's Sphynx has recently been discovered by cybersecurity researchers at Microsoft. It has gained notice because it incorporates advanced hacking tools like Impacket and RemCom. This finding highlights the increasing sophistication and power of current ransomware attacks, creating concerns for both individuals and companies.

A new strain of ransomware known as BlackCat's Sphynx has recently been discovered by cybersecurity researchers at Microsoft. It has gained notice because it incorporates advanced hacking tools like Impacket and RemCom. This finding highlights the increasing sophistication and power of current ransomware attacks, creating concerns for both individuals and companies.

Impacket, an open-source collection of Python classes, enables the manipulation of network protocols and facilitates the creation of network-aware tools. It has legitimate uses in areas like network testing and penetration testing but can be weaponized by threat actors to infiltrate systems. RemCom, on the other hand, is a tool that grants remote access and control over compromised systems, allowing hackers to execute arbitrary commands.

Microsoft's analysis reveals that BlackCat's Sphynx leverages these tools to infiltrate networks, escalate privileges, and finally deploy ransomware to encrypt victims' data. The combination of these powerful tools amplifies the threat potential, as it grants attackers multiple avenues to compromise systems and ensure the success of their ransom demands.

The implications of this discovery extend beyond the immediate threat posed by BlackCat's Sphynx ransomware. The integration of well-established tools like Impacket and RemCom indicates an evolution in the tactics and techniques employed by ransomware operators. This also highlights the importance of organizations and individuals staying updated on the latest cybersecurity threats and fortifying their defenses against emerging attack vectors.

As ransomware attacks continue to surge and become increasingly sophisticated, cybersecurity experts stress the significance of a multi-layered defense strategy. Regularly updating software, educating users about phishing and social engineering tactics, and implementing robust network segmentation are among the recommended measures to minimize the risk of falling victim to such attacks.


Read more »
Windows MSHTML
CVE-2023-32046 CVE-2023-36884 Microsoft Microsoft Security Update Guide Rapid7 RCE Remote Code Execution Security Flaws Vulnerabilities and Exploits Windows MSHTML

Microsoft Confirms Zero Day Exploits, Prompts Users to Update


This week Microsoft confirmed around 132 security vulnerabilities in its product lines, including a total of six zero-day flaws that are currently being actively exploited. Because of this, security professionals advise Windows users to upgrade right away.

One of these zero-day vulnerabilities is of remote code executive (RCE) type, affecting Windows HTML and Microsoft Office. Microsoft has surprisingly not yet released a patch for CVE-2023-36884, opting instead to provide configuration mitigation methods, despite this being a Patch Tuesday rollout. Microsoft has connected the exploitation of this vulnerability to the Russian cybercrime group RomCom, which is suspected to be acting in the interests of Russian intelligence.

According to Rapid7 vulnerability risk management specialist Adam Barnett, the RomCom gang has also been linked to ransomware assaults that have been directed at a variety of targets. More such security experts are raising concerns given the number of vulnerabilities and the multiple zero-days that they are coming across, regarding which they are warning Windows users to adopt the updated versions promptly. The Microsoft Security Update Guide contains a comprehensive list of the vulnerabilities fixed by the most recent Patch Tuesday release. Security professionals have, however, drawn attention to some of the more crucial ones.

CVE-2023-36884 

According to Microsoft, “investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.”

While this vulnerability is still unpatched, Microsoft says it will “take the appropriate action to help protect our customers” ones they are done with the investigations. However, speculations claims that this will happen via an out-of-band security update rather than leaving an actively exploited zero-day up for patch for next month’s Patch Tuesday rollout. Microsoft directs users to a threat intelligence blog article that offers workaround mitigations in the meantime.

CVE-2023-32046 

This flaw is a Windows MSHTML platform elevation of privilege vulnerability that is being exploited. The zero-day flaw exploits the MSHTML core Windows components, that are used to produce content like HTML.

According to Kev Breen, director of cyber threat research at Immersive Labs, “This is not limited to browsers.” He warns, “other applications like Office, Outlook, and Skype also make use of this component.” It is likely that the attack vectors would include typical suspects—a malicious document attached to an email or a malicious website or web page. . “This vulnerability would likely be used as an initial infection vector[…]allowing the attacker to gain code execution in the context of the user clicking the link or opening the document,” says Breen.

Read more »
Vulnerabilities and Exploits
CISA Netwrix Auditor RCE Security Bug Vulnerabilities and Exploits

Netwrix Auditor RCE Bug Abused in Truebot Malware Campaign

 

A severe remote code execution (RCE) vulnerability in the Netwrix Auditor software was used in attacks against organisations across the United States and Canada, according to a warning issued today by CISA and the FBI. These assaults targeted organisations in the United States and Canada. 

Unauthorised attackers can run malicious code with the privileges of the SYSTEM user thanks to a security flaw that affects the Netwrix Auditor server and the agents installed on monitored network systems (tagged as CVE-2022-31199). 

Since December 2022, TA505 hackers (connected with the FIN11 organisation) have exploited TrueBot, a malware downloader related to the Russian-speaking Silence cybercrime group, to install Clop ransomware on compromised networks. 

After installing TrueBot on compromised networks, the hackers install the FlawedGrace Remote Access Trojan (RAT), which is likewise affiliated with the TA505 group and allows them to escalate privileges and establish persistence on the compromised systems. 

Hackers will also deploy Cobalt Strike beacons hours after the initial breach, which might potentially be exploited to perform various post-exploitation tasks such as data theft and delivering other malware payloads such as ransomware. 

"Previous Truebot malware variants were primarily delivered by cyber threat actors via malicious phishing email attachments; however, newer versions allow cyber threat actors to also gain initial access through exploiting CVE-2022-31199," the two federal agencies explained in a joint report with MS-ISAC and the Canadian Centre for Cyber Security.

"As recently as May 2023, cyber threat actors used this common vulnerability and exposure to deliver new Truebot malware variants and to collect and exfiltrate information against organisations in the U.S. and Canada."

Based on the nature of Truebot operations documented thus far, the primary purpose of attackers behind Truebot is to acquire confidential data from compromised systems for monetary gain.

Following the guidelines laid out in joint advisory, security teams are advised to search for evidence of malicious activity pointing to a Truebot infection.

If they find any indicators of compromise (IOCs) within their organization's network, they should immediately implement the mitigation and incident response steps suggested in the advisory and report the incident to CISA or the FBI.
Read more »
Subscribe to: Posts (Atom)