4 casos · pág. 1/1
A denial-of-service vulnerability, CVE-2026-42931, affects the npm endpoint of the Gitea Package Registry. The AddPackageTag function reads the entire HTTP request body into memory with io.ReadAll() before any validation, so a single oversized request can crash the whole Gitea process. Any authenticated user can trigger it against their o…
Attackers took over more than 300 Tor exit relays in early October 2026 and changed their exit policies so SSH (TCP port 22) traffic was redirected to 12 attacker-controlled interception servers that harvested passwords and attempted to install the Ebury 1.8.3 backdoor. Researcher kaba found 333 redirecting exits (roughly 10% of about 3,0…
Throughout October 2026, Wiz observed an actor using tooling associated with ARTEX, an open-source autonomous AI penetration-testing framework, against multiple IT and software vendors. The activity targeted identity providers (Okta, Entra ID, AWS Cognito) and Microsoft 365 integrations, with repeated attempts to bypass authentication, en…
Microsoft reports that the China-linked APT Storm-0940 (active since at least 2021) used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers. ConnectWise suspended several services in response, including Cloud Backup, SaaS Security and Cloud Management. Huntress obse…
