9 casos · pág. 1/1
A command-injection flaw in the OpenCode AI coding agent (Anomaly) lets a malicious or hijacked remote MCP server execute code on a developer's Windows or WSL machine during OAuth sign-in. The code runs with the developer's own privileges. Pillar Security found the flaw, reported it privately on August 29 and disclosed it on October 19, p…
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …
A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a…
Researcher Quentin Kaiser disclosed on October 16 an unauthenticated memory-corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It lets an attacker within radio range execute code as root on affected routers, with no Wi-Fi password or pairing step. Kaiser demonstrated working exploits against Belgian ISP gateways: th…
Railway, a Platform-as-a-Service provider, disclosed "anomalous activity" affecting systems that store customer environment variables. An unauthorized third party may have accessed encrypted variables and in some cases obtained the decrypted contents, affecting a "subset of users" (number undisclosed). Railway said the incident is likely …
