8 casos · pág. 1/1
A Check Point CISO compares the PHP2Shell vulnerabilities to Log4Shell, given their wide reach and the pressure on defenders to respond quickly. The flaws affect the PHP runtime itself, not only the applications built on it. They became public ahead of the planned coordinated disclosure. Check Point Research reported PHP2Shell-related act…
Check Point researchers report large-scale phishing campaigns that abuse fake calendar invitations to harvest Microsoft account credentials. Lures arrive either as a malicious .ics attachment or as a link, for example in a fake Microsoft Teams meeting invite, that appears to point to one destination but leads to a credential-harvesting pa…
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect applications to AI providers such as OpenAI, Google and Anthropic. The project is widely deployed, with about 97 million downloads per month and over 59,000 GitHub stars. CVE-2026-35029 let any user, inclu…
Check Point Research describes Aokigahara, a newly observed Windows infostealer that may have appeared in earlier versions as Kamidere or Stygian. It combines standard theft of browser, cryptocurrency wallet, VPN, FTP/SFTP, password manager and email data with a dedicated aisessions handler. That handler collects authentication, session a…
Check Point researchers disclosed two high-risk vulnerabilities in LiteLLM, an open-source LLM gateway with almost 100,000 downloads a month. The gateway connects enterprise AI applications to providers such as OpenAI, Google and Anthropic. The flaws, CVE-2026-35029 and CVE-2026-59823, could let any user with an account on a vulnerable de…
F5 Labs published its March 2026 CASI Leaderboard update, which is now dominated by OpenAI and Anthropic. Z.ai's GLM-5 performs well on price and capability but has a weak security posture (CASI 37.56 vs 96.61 for Claude Opus 4.6 and 92.58 for GPT-5.2). The report also spotlights Sugar-Coated Poison (SCP), a multi-turn technique that grad…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group (North Korea-linked) cyberespionage campaign against South Korean organizations. It follows Operation SyncHole, which abused the related Cross EX product and hit at least six organizations (gbhackers.com), and is placed within the broader Cascade Hole activity. The earl…
