ThreatsDay Roundup: Critical Apache OFBiz RCE Flaws, DreamHost Breach Exposes FTP/Webmail Credentials, PAYLOAD Ransomware Abuses AD GPOs
This week's ThreatsDay bulletin from The Hacker News bundles 20 separate security stories, the most operationally significant being a pair of critical Apache OFBiz vulnerabilities, a confirmed data breach at hosting provider DreamHost, and a novel encryptionless extortion technique using Active Directory Group Policy Objects. Apache OFBiz maintainers patched 46 flaws in version 24.09.08, including CVE-2026-68524 (pre-authentication remote code execution) and CVE-2026-109928 (full admin account takeover via a broken authentication algorithm). DreamHost disclosed that an attacker exploited a vulnerability in its web-based File Manager (files.dreamhost.com) between August and October 23, 2026, exposing FTP/SFTP credentials and webmail session data; billing and control panel data were reportedly not accessed. Separately, Kaspersky detailed a PAYLOAD ransomware intrusion against a Middle East manufacturer where attackers achieved domain-admin control and delivered ransom notes, hijacked desktops, and disabled local admin accounts purely via a malicious GPO, without deploying an encryptor on Windows hosts (only an ESXi-targeting PAYLOAD sample was found). The roundup also covers a Docker Sandboxes file-access bypass (CVE-2026-103916), a $4.5M Europol-led takedown of an investment fraud crime-as-a-service network, U.S. charges against two Canadians for university cryptojacking, weaknesses found in HYFLOCK ransomware's encryption, persistent smart TV ACR tracking despite opt-outs, Microsoft's new Edge scam-notification blocking, Google's $250K Cloud VRP tier, Anthropic's FlashProve verification prototype, and NCSC/Microsoft research on AI-accelerated vulnerability discovery and slow network-appliance patching.
Entenda a falha
A vulnerabilidade
Three CVEs. CVE-2026-68524 is a critical pre-authentication remote code execution flaw in Apache OFBiz, so an unauthenticated attacker who can reach the application could run code on the server. CVE-2026-109928 is a full admin account takeover in OFBiz caused by an incorrectly implemented authentication algorithm. Both were fixed in OFBiz 24.09.08, a release that patched 46 flaws; the articles do not give the affected version range. CVE-2026-103916 is a Docker Sandboxes flaw where the sbx cp command did not enforce access restrictions, so symbolic-link abuse could copy files such as cloud credentials out of the sandbox. It is fixed in 0.51.0. The articles do not say what access the Docker attacker needs.
Como funciona
For OFBiz, the articles give no technical detail on the request path, only that CVE-2026-68524 is reachable before authentication and ends in code execution. For CVE-2026-109928, the authentication logic takes the credentials presented and decides whether they are valid. Because the algorithm is implemented incorrectly, that decision can be wrong and an attacker can end up as an administrator. For Docker Sandboxes, sbx cp copies files between the sandbox and the host. When it meets a symbolic link, it follows it without checking that the target stays inside the sandbox boundary, so files outside the sandbox get copied.
Por que é vulnerável
For CVE-2026-109928 the root cause is an incorrect implementation of the authentication algorithm. For CVE-2026-103916 it is a missing access-restriction check in sbx cp, which lets symbolic links point outside the sandbox. The articles give no root cause for CVE-2026-68524 and do not explain why any of the three went unnoticed. The fixes are in OFBiz 24.09.08 and Docker Sandboxes 0.51.0, but the articles do not describe what exactly the patches change.
Onde está
For CVE-2026-103916 the affected component is the sbx cp command of Docker Sandboxes; no article names a file, function or commit for any of the three CVEs.
Como foi descoberta
The articles do not say who found these flaws or how. They only report that the Apache OFBiz maintainers patched 46 flaws in version 24.09.08, including the two CVEs, and that the Docker Sandboxes issue was fixed in 0.51.0. They mention no exploitation in the wild for these three CVEs. The details reached the public through The Hacker News ThreatsDay bulletin.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 14:16.
Detalhes técnicos
- Apache OFBiz: 46 flaws patched in 24.09.08; CVE-2026-68524 enables pre-auth RCE, CVE-2026-109928 enables account takeover due to incorrect authentication algorithm implementation.
- DreamHost: attacker exploited a File Manager software vulnerability to harvest FTP/SFTP usernames/passwords and webmail session credentials for users who logged in between August and October 23, 2026.
- PAYLOAD ransomware (Kaspersky): attacker obtained domain-admin-equivalent AD control, created a GPO named "PAYLOAD" linked at the domain root to push ransom notes, change wallpaper/lock screens, enforce logon banners, and disable local admin accounts domain-wide — no Windows encryptor used; a Linux/ESXi PAYLOAD sample was the only ransomware binary found.
- Docker Sandboxes (CVE-2026-103916): the
sbx cpcommand failed to enforce access restrictions, allowing symbolic-link abuse to copy files (e.g., cloud credentials) outside the sandbox boundary; fixed in version 0.51.0. - HYFLOCK ransomware: researchers found encryption weaknesses in updated builds; the group began publicly naming victims in October 2026.
Remediação
Organizations should upgrade to Apache OFBiz 24.09.08, update Docker Sandboxes to version 0.51.0, rotate FTP/SFTP and webmail credentials if they used DreamHost's File Manager during the exposure window, and audit Active Directory GPO changes for unauthorized domain-root policies as part of ransomware/extortion detection.
Linha do tempo
-
ThreatsDay Roundup: Critical Apache OFBiz RCE Flaws, DreamHost Breach Exposes FTP/Webmail Credentials, PAYLOAD Ransomware Abuses AD GPOs
ler a análise desta fonte ocultar
This week's ThreatsDay bulletin from The Hacker News bundles 20 separate security stories, the most operationally significant being a pair of critical Apache OFBiz vulnerabilities, a confirmed data breach at hosting provider DreamHost, and a novel encryptionless extortion technique using Active Directory Group Policy Objects. Apache OFBiz maintainers patched 46 flaws in version 24.09.08, including CVE-2026-68524 (pre-authentication remote code execution) and CVE-2026-109928 (full admin account takeover via a broken authentication algorithm). DreamHost disclosed that an attacker exploited a vulnerability in its web-based File Manager (files.dreamhost.com) between August and October 23, 2026, exposing FTP/SFTP credentials and webmail session data; billing and control panel data were reportedly not accessed. Separately, Kaspersky detailed a PAYLOAD ransomware intrusion against a Middle East manufacturer where attackers achieved domain-admin control and delivered ransom notes, hijacked desktops, and disabled local admin accounts purely via a malicious GPO, without deploying an encryptor on Windows hosts (only an ESXi-targeting PAYLOAD sample was found). The roundup also covers a Docker Sandboxes file-access bypass (CVE-2026-103916), a $4.5M Europol-led takedown of an investment fraud crime-as-a-service network, U.S. charges against two Canadians for university cryptojacking, weaknesses found in HYFLOCK ransomware's encryption, persistent smart TV ACR tracking despite opt-outs, Microsoft's new Edge scam-notification blocking, Google's $250K Cloud VRP tier, Anthropic's FlashProve verification prototype, and NCSC/Microsoft research on AI-accelerated vulnerability discovery and slow network-appliance patching.
Technical Details
- Apache OFBiz: 46 flaws patched in 24.09.08; CVE-2026-68524 enables pre-auth RCE, CVE-2026-109928 enables account takeover due to incorrect authentication algorithm implementation.
- DreamHost: attacker exploited a File Manager software vulnerability to harvest FTP/SFTP usernames/passwords and webmail session credentials for users who logged in between August and October 23, 2026.
- PAYLOAD ransomware (Kaspersky): attacker obtained domain-admin-equivalent AD control, created a GPO named "PAYLOAD" linked at the domain root to push ransom notes, change wallpaper/lock screens, enforce logon banners, and disable local admin accounts domain-wide — no Windows encryptor used; a Linux/ESXi PAYLOAD sample was the only ransomware binary found.
- Docker Sandboxes (CVE-2026-103916): the
sbx cpcommand failed to enforce access restrictions, allowing symbolic-link abuse to copy files (e.g., cloud credentials) outside the sandbox boundary; fixed in version 0.51.0. - HYFLOCK ransomware: researchers found encryption weaknesses in updated builds; the group began publicly naming victims in October 2026.
Remediation
Organizations should upgrade to Apache OFBiz 24.09.08, update Docker Sandboxes to version 0.51.0, rotate FTP/SFTP and webmail credentials if they used DreamHost's File Manager during the exposure window, and audit Active Directory GPO changes for unauthorized domain-root policies as part of ransomware/extortion detection.