11 casos · pág. 1/1
The U.S. Department of Homeland Security (Secretary Markwayne Mullin) ordered federal civilian agencies to remove DeepSeek products, and any third-party products or services "developed using DeepSeek implementations", from their IT systems. The order is dated July 24, 2026, was issued under the Federal Acquisition Supply Chain Security Ac…
CISA added exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. They include four Plex Media Server flaws collectively named Plex2Shell, which researcher Zach Main says can be chained for unauthenticated remote code execution. Researcher boredhackerblog reports that threat actors are weaponizing them to deploy c…
A U.S. court on Monday granted the government's request to detain Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, accused of planting a concealed audio recorder in an executive conference room at the company's San Francisco office. A prosecution filing says he was in frequent WhatsApp contact in 2025-2026 wit…
Citizen Lab reported that Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera through targeted online ads that needed no user interaction. It calls this the first public technical confirmation of mercenary spyware reaching real devices via ad delivery. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and …
Mozilla and the Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate CA certificates (emSign brand) are compromised. Anyone holding these keys could issue certificates for any website that a browser would accept. A researcher credited as "Wayne" reported the compromise on October 17, and Chrome a…
On October 20, the Go team released Go 1.27.3 and Go 1.26.10 on its URGENT track. The certificate verifier now rejects any chain passing through one of eight intermediate CA keys, citing unspecified "specific security concerns around their operation." A commenter on the Go issue matched the SHA-256 key hashes to intermediates of the India…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
