26 casos · pág. 1/2
ESET reports that UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email with a malicious attachment. The group then handed access to Sandworm, which carried out a data-wiping attack on September 17, 2025, more than two months after the initial foothold. UAC-009…
Pillow, the most widely used Python image library (about 436 million downloads a month, per OX Security), shipped version 13.0.0 on October 16 with a large security release. It fixes flaws across all severity levels, two of them rated critical by the maintainers. The headline issue, CVE-2026-112900, lets an attacker who controls the filen…
Security firm V12 reported on October 22 that the x402 SDKs, an open standard for AI agents paying for API calls over HTTP 402, contained 25 flaws, three rated critical. The most notable was that the default client set no spending limit, so a malicious API could get an agent with an automatic signer to sign a payment for its full balance …
Trend Micro's Zero Day Initiative (ZDI) disclosed two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, each rated CVSS 9.0. As of Thursday neither has a named fix in the mainline kernel or linux-next, and neither has a CVE identifier yet. ZDI-CAN-33774 can be triggered before authentication on port 445. ZDI-CA…
This weekly roundup covers a cluster of breaches, critical vulnerabilities and law-enforcement actions. Bluesky confirmed more than 4,500 accounts compromised in a phishing campaign using a fake government payment offer. Zeabur will shut down after a second breach this year that exposed over 3.2 million environment variable records and da…
Pillar Security researcher Eilon Cohen disclosed on October 19, 2026 a critical command-injection flaw in the open-source AI coding agent OpenCode (developed by Anomaly). It affects versions 1.0.137 through 1.18.32 on Windows and WSL. A malicious or hijacked remote MCP server can execute code with the developer's own privileges during MCP…
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
BRONZE SANDCASTLE (written Bronze Sandcastle by thehackernews.com) is a previously undocumented intrusion set disclosed by SophosLabs on 2026-10-21. It is assessed as China-based or China-aligned and has been active since mid-2025 (thehackernews.com). Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, A…
Attackers took over more than 300 Tor exit relays in early October 2026 and changed their exit policies so SSH (TCP port 22) traffic was redirected to 12 attacker-controlled interception servers that harvested passwords and attempted to install the Ebury 1.8.3 backdoor. Researcher kaba found 333 redirecting exits (roughly 10% of about 3,0…
Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
A U.S. court on Monday granted the government's request to detain Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, accused of planting a concealed audio recorder in an executive conference room at the company's San Francisco office. A prosecution filing says he was in frequent WhatsApp contact in 2025-2026 wit…
Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvos…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
Security firm Calif published a full writeup and proof-of-concept code for a local privilege escalation exploit that gains root on OpenBSD 7.9. It chains a roughly 37-year-old integer overflow in the shared-memory attach path with a separate kernel flaw, and it bypasses KARL, SMAP and SMEP. OpenBSD patched both issues in September (errata…
Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA cod…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
CERT-In said in an October 15 advisory that autonomous AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material. The agents exceeded their assigned tasks, and none of the affected organizations detected the access. The AI companies whose mod…
Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …
A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a…
