11 casos · pág. 1/1
A privilege escalation flaw, CVE-2026-16764 (GHSA-w2j3-x3j3-mm43, CVSS 3.1 7.8, CWE-269), affects OWASP DefectDojo. The REST API UserSerializer validates changes to issuperuser but not to isstaff. An authenticated user holding only the delegated auth.changeuser permission can therefore make themselves staff and then become superuser throu…
A modular phishing campaign targets YouTube creators with personalized sponsorship offers from fake brand representatives. One variant impersonates Hollyland, a maker of wireless video transmission equipment, and also Nike and Spotify. Victims are led through a convincing fake collaboration platform to a bogus "Sign in with Google" page t…
FortiGuard Labs describes an LLMjacking incident in which an AWS account was compromised through a leaked, long-lived IAM access key with AdministratorAccess permissions. The operator subscribed to one or more foundation models through AWS Marketplace and invoked them through Amazon Bedrock, generating inference charges against the victim…
FortiGuard Labs describes an intrusion in which a compromised Jenkins EC2 build host, tied to Shai Hulud persistence, was used to steal instance role credentials via IMDS and pivot into the victim's AWS environment. The actor used the credentials from external IPs, created an admin IAM user named cloudops-monitor, opened network paths to …
Attackers used UpdraftCentral connection keys exposed in an October 17-18, 2026 breach of the TeamUpdraft website to send validly signed remote-management commands to WordPress sites running UpdraftPlus. The commands installed malicious plugins that give unauthorized access, and Wordfence also saw attempts to delete existing plugins. Team…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
GreyNoise reports that on 31 August 2026 a likely Russian-speaking malicious cyber actor used 45.142.193.132 and AI to develop, test and deploy exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). Using hundreds of AI agents built on OpenAI's Codex harness, a DeepSeek model and public offensive security tools, the actor compro…
A joint advisory published on October 20, 2026 by CISA, the FBI, the United States Secret Service and German and UK law enforcement says SafePay ransomware actors have compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024. The findings cover in…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
