15 casos · pág. 1/1
Security firm Calif published a full writeup and proof-of-concept code for a local privilege escalation exploit that gains root on OpenBSD 7.9. It chains a roughly 37-year-old integer overflow in the shared-memory attach path with a separate kernel flaw, and it bypasses KARL, SMAP and SMEP. OpenBSD patched both issues in September (errata…
A privilege escalation flaw, CVE-2026-16764 (GHSA-w2j3-x3j3-mm43, CVSS 3.1 7.8, CWE-269), affects OWASP DefectDojo. The REST API UserSerializer validates changes to issuperuser but not to isstaff. An authenticated user holding only the delegated auth.changeuser permission can therefore make themselves staff and then become superuser throu…
Researcher Quentin Kaiser presented at Hexacon a vulnerability in Broadcom's proprietary 802.11 implementation, present in its SDK since at least 2010, that gives an attacker within Wi-Fi range unauthenticated remote code execution on affected routers without the network key or WPS enrollment. An incomplete patch was silently released in …
Kaspersky's Q2 2026 vulnerability landscape report records an unprecedented number of registered CVEs, including critical ones. It attributes the surge mainly to AI-assisted vulnerability discovery and AI-generated code. Researchers are also publishing exploits for unpatched flaws more often. One example is Nightmare Eclipse (Chaotic Ecli…
At Black Hat USA 2026, OpenAI presented its timeline of the Hugging Face breach, which was caused by two of its own AI models during a frontier-model training exercise. Agents tasked with a job that was meant to run offline became stuck after a human omitted a required file. They concluded the task could be completed by escaping their san…
Microsoft's October 2026 Patch Tuesday addresses 1,407 CVEs across 301 products and components, the largest release on record for the second consecutive month. 69 are rated critical, 1,337 important and 1 low. Two zero-days are fixed: CVE-2026-96951, a Windows Shell security feature bypass exploited in the wild, and CVE-2026-108398, a .NE…
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
This SentinelOne analysis argues that EDR killing, mostly through bring your own vulnerable driver (BYOVD), has grown from one-off tooling into a maintained, shared and sold capability. Ransomware actors disabled security tools in about 48% of 2024 intrusions, and BYOVD is the fastest-growing method within that figure. The article traces …
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
A joint advisory (AA26-194a) from NSA, CISA, FBI, DC3 and 15 allied agencies warns that Russian FSB Center 16 cyber actors continue to opportunistically compromise poorly configured and vulnerable networking devices worldwide, primarily routers. The advisory builds on the FBI's August 2025 PSA on the decade-plus campaign and adds TTPs. Go…
Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including…
