33 casos · pág. 1/2
Between July 14 and September 22, 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations in a token replay campaign. The attacker replayed post-MFA session tokens stolen through AiTM relays, device-code phishing and social engineering, a pattern Huntress calls "token spraying". Replay traffic came from the…
Fortinet published PSIRT advisory FG-IR-26-186 for CVE-2026-109618, a flaw in PHP that can lead to remote code execution (RCE). PHP uses longjmp() to abort request handling on out-of-memory (OOM) errors. Some contexts do not account for this and leave request memory uninitialized before an allocation. Fortinet says it is still investigati…
Cisco disclosed a high-impact local privilege escalation vulnerability, CVE-2026-76462, in the Secure Firewall Posture module of Cisco Secure Client. The flaw is in the interprocess communication (IPC) channel and stems from insufficient validation of user-supplied input. An authenticated local attacker can send crafted IPC messages to a …
Cisco disclosed CVE-2026-76524, a high-severity vulnerability in the control channel socket implementation of Open Source Snort 3. An authenticated local attacker with low privileges could execute arbitrary commands as the Snort 3 process user. A successful exploit also allows reading and writing Snort 3 process memory. Cisco has released…
Cisco published a security hardening release for its Unified Communications portfolio on October 21, 2026. It covers Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM SME and Cisco Unity Connection. The vulnerabilities were found during an intern…
Cisco published a security hardening release for the Cisco Expressway Series (Expressway-C core and Expressway-E edge devices) addressing multiple vulnerabilities found during an internal security review. Cisco states the flaws were discovered in internal testing and are not known to be actively exploited. The issues are grouped by CWE cl…
Cisco disclosed CVE-2026-76505, a High-rated vulnerability in the IPv4 packet processing of Cisco IOS XR Software on Cisco ASR 9000 and 9900 Series routers and ASR 9902/9903 Compact High-Performance Routers. An unauthenticated, remote attacker can send crafted IPv4 packets that trigger network processor (NP) errors, resetting or shutting …
Palo Alto Networks published advisory PAN-SA-2026-0013, its monthly Chromium vulnerability update for October 2026. It states that Prisma Browser is affected by vulnerabilities fixed in recent upstream Chromium Stable Channel releases. The vendor rates severity HIGH with suggested urgency MODERATE. Palo Alto Networks is not aware of any m…
Trend Micro published its State of AI Security Report, 1H 2025, warning that AI infrastructure is being built from unsecured and unpatched components. The research found 200+ ChromaDB servers, 2,000 Redis servers and 10,000+ Ollama servers exposed to the internet with no authentication. It also reports zero-day vulnerabilities and exploit…
FortiGuard Labs describes an intrusion in which a compromised Jenkins EC2 build host, tied to Shai Hulud persistence, was used to steal instance role credentials via IMDS and pivot into the victim's AWS environment. The actor used the credentials from external IPs, created an admin IAM user named cloudops-monitor, opened network paths to …
FortiGuard Labs reports an ongoing Ousaban campaign targeting the Iberian Peninsula. The actor keeps refining its delivery chain and uses geofencing and environmental checks to restrict access to the malware to the intended victims. Ousaban resolves its C2 IP through daily-changing domains and runs a traditional C2 setup as a decoy. Its l…
FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonat…
FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal again…
FortiGuard Labs describes an LLMjacking incident in which an AWS account was compromised through a leaked, long-lived IAM access key with AdministratorAccess permissions. The operator subscribed to one or more foundation models through AWS Marketplace and invoked them through Amazon Bedrock, generating inference charges against the victim…
FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses a…
FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C…
FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discov…
Cisco disclosed CVE-2026-20154, a high-severity vulnerability in the system rate-limiting process for syslog message 419002 in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can cause high CPU utilization on an affected device, r…
Cisco updated its advisory for CVE-2024-20260, a denial-of-service vulnerability in the VPN and management web servers of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The original version covered only the ASAv and FTDv virtual models, but Cisco later found that a…
Cisco published a Software Security Hardening Release advisory for Cisco IOS XE Software. It addresses multiple vulnerabilities found during an internal security review and internal testing. Cisco states the flaws are not known to be actively exploited. It grouped the issues by Common Weakness Enumeration (CWE) class and assigned a single…
