11 casos · pág. 1/1
The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…
Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…
Central Ohio Primary Care Physicians, a large physician-owned primary care group based in Westerville, Ohio, with more than 80 locations, disclosed a breach affecting about 1.4 million current and former patients. In August 2026, an unauthorized third party used a voice phishing (vishing) attack to obtain credentials that gave access to i…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
FortiGuard Labs describes an intrusion in which a compromised Jenkins EC2 build host, tied to Shai Hulud persistence, was used to steal instance role credentials via IMDS and pivot into the victim's AWS environment. The actor used the credentials from external IPs, created an admin IAM user named cloudops-monitor, opened network paths to …
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
F5 Labs published its March 2026 CASI Leaderboard update, which is now dominated by OpenAI and Anthropic. Z.ai's GLM-5 performs well on price and capability but has a weak security posture (CASI 37.56 vs 96.61 for Claude Opus 4.6 and 92.58 for GPT-5.2). The report also spotlights Sugar-Coated Poison (SCP), a multi-turn technique that grad…
The Wiz Customer Incident Response Team (CIRT) reports a growing number of intrusions in which an AI agent system ran the entire operation: finding entry points, harvesting credentials, pivoting across platforms and debugging its own scripts in real time. In one investigated case, the agent compromised a large multi-cloud organization (GC…
Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including…
