category — security

ls ./category/security --page 4

Security

Breaches, vulnerabilities, malware and the patches that matter.

page 4 of 7 — 147 articles

Exploited since January, added to CISA's list in August, due in three days

2026-08-25

CVE-2026-21962 is a CVSS 10.0 flaw in Oracle's HTTP Server and WebLogic proxy plug-in. Oracle patched it on 20 January. Exploit code appeared on 22 January and a honeypot logged attacks the same day. CISA added it to the Known Exploited Vulnerabilities catalog on 24 August with a due date of 27 August — and under a directive nobody noticed replacing the old one, agencies now have to check whether they were already breached.

Spring had 16 CVEs in all of 2025 — it has passed 200 this year, and the reason is that AI is now looking

2026-08-25

Broadcom shipped 91 vulnerability fixes for the Spring framework in one release, including a critical flaw in Spring Security's embedded LDAP server. The count went 22, then 16, then over 200. The jump is attributed to Broadcom putting AI on the problem, which is the same capability the attack stories run on, pointed the other way.

A UK power plant was down for four days — and almost nothing in the headline is confirmed

2026-08-25

The Telegraph reported on 22 August that a small British generator was shut down for four days in July, and the coverage that followed called it Iran-linked. Neither the government nor the NCSC has confirmed that, the plant has not been named, and the CEO of Dragos is publicly warning that this is exactly the situation false flags are built for.

It takes the phone's VPN slot and uses it to cut off Google Play — then installs the payload

2026-08-24

Zimperium's analysis of ToxicPanda 2.0 describes malware that claims the VPN permission, filters the device's own traffic, and blocks Google Play and Play Services so security updates and app verification cannot run. It targets 349 apps across 16 countries and supports 167 remote commands.

The AI picked 170,000 targets — every break-in used a bug from years ago

2026-08-24

Cisco Talos found an exposed directory belonging to UAT-10147 and pulled out target lists of roughly 170,000 URLs, AI tooling across the whole attack lifecycle, and a cross-platform implant called SPECTRE that unlinks EDR callbacks in the kernel using two vulnerable drivers from 2019 and 2021.

The fake Windows lock screen is defeated by Alt+Tab — it is just a window pretending

2026-08-24

Marcus Hutchins at Expel picked apart SynkLoader, pushed through Microsoft Teams by attackers posing as the IT help desk and hosted on Azure so the download looks legitimate. Its PhishLocker module paints a convincing Windows 11 lock screen to harvest the password. It is a borderless full-screen app, and Alt+Tab exposes it.

The malware reads its orders out of an FTP welcome message, before it even logs in

2026-08-23

MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.

526 of the live keys were root — and the biggest single source was Hugging Face

2026-08-23

Truffle Security spent four years pulling AWS keys out of repositories, Git history, Docker images and CI logs. Of the ones it could fully verify, 88% still authenticated this month. The median key was five years old, the oldest 17.4, and only 13.7% had ever been rotated.

CISA gave three days for one flaw and two weeks for the other — both are in the same video server

2026-08-23

Two critical bugs in TrueConf Server, patched in June, are being used by Head Mare to plant PhantomCore. Kaspersky says the attackers replaced a server file with a web shell and pushed malicious client installers. CISA added both to its exploited catalogue on 20 August with two different deadlines.

The sandbox read the array twice and trusted the first answer — a getter was enough to reach the host

2026-08-22

isolated-vm is how a lot of Node applications run untrusted JavaScript without a container. EndorLabs found its ExternalCopy path iterates a transfer list twice and trusts the earlier pass, so a JavaScript getter returning different values each time can point the native layer at attacker-chosen memory. Fixed in 6.2.0 and 7.0.1.

The phishing kit adds its own passkey — so resetting the password does not remove the attacker

2026-08-22

Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.

A $99.99 backdoor with a plain-English front end — and importing the package is enough to start it

2026-08-22

TrendAI found 14 npm packages posing as calendar utilities and carrying RedC2 4.0, a Linux implant sold on Hack Forums. There is no install hook: the payload launches when the module loads, so one transitive import runs it. The framework's Red Agent turns natural-language prompts into intrusion command sequences.

Five CVSS 10.0 flaws in one Cisco release — and the company found all of them itself

2026-08-22

Nine vulnerabilities across Crosswork and Secure Workload, five of them scoring a maximum 10.0, including two separate authentication bypasses and a SQL injection. None are known to be exploited. All came out of Cisco's own internal review, which is the second such batch in a fortnight.

Defender ships a driver built to delete locked files at boot — and its encryption key has been the same since Windows 7

2026-08-22

Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.

Microsoft spent ten years removing one command, because criminals used it more than administrators did

2026-08-21

WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.

A CVSS 9.3 authentication bypass in NetScaler, no exploitation yet, and every reason to treat that as temporary

2026-08-21

CVE-2026-19490 lets a remote unauthenticated attacker walk past authentication on NetScaler appliances configured as a gateway or AAA virtual server. Nothing has been seen in the wild. Rapid7's advice is to patch on an emergency basis anyway, and NetScaler's history is the argument.

A crate in three quarters of Rust builds was poisoned and pulled in 86 minutes — compiling was enough to run it

2026-08-21

arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.

Attackers can forge a merge record so it looks like the fix landed — GitLab's flaw went from patch to exploitation in days

2026-08-21

watchTowr reproduced CVE-2026-19478 within minutes of disclosure and then saw it used against its own honeypots. Beyond deleting repositories, it lets an attacker fabricate merge records and ban maintainers — which means the log that says a security fix was applied can itself be the lie.

Microsoft's advisory said the CVSS 10 was exploited — by evening it said it was not, and the headlines had already gone

2026-08-21

CVE-2026-69836 is a real maximum-severity flaw in Entra ID, and Microsoft fixed it cloud-side with nothing for customers to do. For most of 21 August its own bulletin marked it exploited in the wild. Microsoft corrected that field to No after a reporter asked. The correction has not travelled the way the original did.

They shipped sports-score add-ons, waited, then turned them into wallet stealers under the same extension ID

2026-08-20

Socket found 40 malicious Firefox extensions posing as OKX, Rabby Wallet and TronLink, inside a wider set of 77 sharing code and infrastructure. The clever part is not the theft — it is that many started life as harmless utilities and were repurposed later, keeping the ID, the listing and whatever trust it had accumulated.

Fifteen of the twenty-three had MFA — and it did not apply to the door the attacker used

2026-08-20

Huntress reports password spraying up 155x in the first half of 2026, driven by a campaign against Azure CLI that abuses ROPC, a deprecated OAuth grant which posts your username and password straight to the token endpoint with no interactive MFA prompt. In two weeks it made 81 million login attempts.

Five US agencies say the tooling aimed at Siemens PLCs was written with AI — and it is disguised as monitoring software

2026-08-20

The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on Siemens S7 controllers. The exploitation scripts are Python built on snap7, they masquerade as legitimate OT monitoring tools, and they give read and write access to PLC memory and ladder logic. The assessed purpose is not disruption yet — it is being ready for it.

Two loops disagreed about empty fields — and that was an unauthenticated PHP upload on any Elementor form

2026-08-20

CVE-2026-32475 is a CVSS 9.0 in Elementor Pro's Forms module. Validation and file-moving run in separate loops that handle empty entries differently, so submitting two file parts for one field skips the extension blocklist entirely. All versions to 4.2.1 are affected; 4.2.2 fixes it.

The defence only acted when a request finished — so the researchers never finished the request

2026-08-20

Cloudflare and University of Edinburgh researchers pulled a JWT out of a co-located Worker at 12 bits a second with 99% accuracy, in production. No V8 exploit, no sandbox escape. The detection system was bypassed by holding one invocation open for hours, and the fix in the end was hardware.