Written by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing Introduction Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as "LLMJacking." Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail,…
Rilevate quattro vulnerabilità di sicurezza, di cui 2 con gravità “alta”, in Chamilo LMS, sistema di e-learning e gestione dei contenuti. Tali vulnerabilità potrebbero consentire a un attaccante remoto, in determinate condizioni, di eseguire codice arbitrario o di compromettere un account esistente, anche amministrativo.
Aggiornamenti di sicurezza sanano tre vulnerabilità con gravità “alta” che interessano i prodotti ManageEngine SharePoint Manager Plus, soluzione per la gestione e il monitoraggio degli ambienti SharePoint, nonché ManageEngine Password Manager Pro e PAM360, piattaforme per la gestione di credenziali, account privilegiati e accessi amministrativi.
Canonical heeft een kwetsbaarheid verholpen in LXD. De kwetsbaarheid (CVE-2026-112816) wordt veroorzaakt door onjuiste validatie van certificaatketens binnen de HTTPS API van Canonical LXD. De kwetsbaarheid treft LXD-versies vóór 4.0.15, 5.0.11, 5.21.9 en 6.10.1 binnen de betreffende releasebranches. Hierdoor kunnen niet-geauthenticeerde aanvallers die netwerktoegang hebben tot de HTTPS API en beschikken over het publieke certificaat van een vertrouwde client, zich voordoen als die client. Dit…
De multiples vulnérabilités ont été découvertes dans Ivanti Connect Secure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité. Ivanti indique que les vulnérabilités CVE-2026-104935,...
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. [...]
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. [...]
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts. [...]
VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value. If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails. This stealer is self-deleting, and there is no attacker-owned infrastructure. The…
In this article Activity overview Attack chain overview Portable runtime staging and execution variants Host discovery and AD CS assessment Case 1: ESC1 abuse and the cost of an identity exclusion Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity Why the response outcomes differed Actionable investigation methods References Learn More Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages and…
Tenable ha rilasciato aggiornamenti di sicurezza per risolvere 3 vulnerabilità, di cui una con gravità "critica", in Tenable Identity Exposure, piattaforma dedicata al rilevamento e alla gestione delle esposizioni negli ambienti Microsoft Active Directory. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente autenticato con privilegi limitati di eseguire codice arbitrario con privilegi elevati sul controller di dominio interessato.
Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. [...]
As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.” Here’s what those checks would involve: Photo ID matching: Comparing a live image of you with the…
Upozorňujeme na aktivně zneužívané zranitelnosti CVE-2026-88771 a CVE-2026-88772 v produktu Citrix Netscaler, které umožňují vzdálené spuštění kódu. Doporučujeme bezodkladně aktualizovat na verzi 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS nebo 13.1-37.279 a novější podle používané produktové řady. Dále doporučujeme prověřit indikátory kompromitace, jelikož aktualizace nemusí kompromitaci odstranit. Zranitelnosti Zranitelnost CVE-2026-88771 spočívá v nesprávném ověřování vstupů a umožňuje…
Elastic ha rilasciato aggiornamenti di sicurezza per Elastic Cloud Enterprise (ECE), piattaforma per la gestione centralizzata di ambienti Elastic, che sanano alcune vulnerabilità, di cui 3 con gravità "alta". Tali vulnerabilità, riconducibili a una risoluzione non adeguata dei collegamenti prima dell'accesso ai file, potrebbero consentire a un attaccante locale di accedere a informazioni riservate, modificare o causare la perdita di dati ed eludere i meccanismi di autenticazione.
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users. [...]
View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Mendix SAML Module are affected: Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.4 (CVE-2026-89209) Mendix SAML …
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP…
Group-IB uncovers MadApe, a previously undocumented Microsoft Device Code phishing kit that uses business-themed PDF lures, configurable redirects and fake document-sharing pages to trick victims into completing Microsoft Device Code authentication across a broad infrastructure cluster.
This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118626.
Serial number: AV26-028 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The…
October is Cybersecurity Awareness Month, and it’s a good time to think about how much the world has changed for chief information security officers (CISOs) in the last 12 months. A year ago, we thought we were already in the thick of AI and starting to understand it. Since then, agents have spread across the enterprise faster than most organizations anticipated. According to our Work Trend Index Annual Report, the number of active agents in the Microsoft 365 ecosystem grew 15-fold year over…
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...]
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]
This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules. Bianco Research president Jim Bianco raised the question during Unchained’s Bits + Bips livestream on October 26: “Are you protecting me, or are you protecting your own profits?” Bianco described traditional finance’s…
Cisco heeft kwetsbaarheden verholpen in Secure Firewall ASA, Threat Defense en Management Center softwareproducten. Cisco heeft de kwetsbaarheden gegroepeerd naar acht verschillende kwetsbaarheidsklassen (CWE's) en aan iedere groep één CVE-kenmerk toegekend. De kwetsbaarheden betreffen verschillende beveiligingsproblemen, waaronder onvoldoende toegangscontrole, onjuiste verwerking van invoergegevens, fouten in beveiligingsmechanismen en onjuiste afhandeling van uitzonderingssituaties. Vier van…
Aggiornamenti di sicurezza sanano una vulnerabilità con gravità "alta" in OAuthLib, libreria open source per Python ampiamente utilizzata per l'implementazione dei protocolli di autorizzazione OAuth 1.0 e OAuth 2.0. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di eludere i meccanismi di autenticazione sui sistemi interessati.
This technical analysis details a sophisticated Android malware campaign targeting the Indian banking sector. The report examines seven distinct trojan families that facilitate banking fraud through coordinated phishing, credential theft, and unauthorized cryptojacking. Group-IB provides an in-depth breakdown of the attack chain, malware capabilities, and the infrastructure used to compromise mobile devices.
SQL injection (SQLi) in the user authentication module of Futurum Software Wed, 10/28/2026 - 09:52 Aviso Affected Resources User authentication module for the business management platform. Description INCIBE has coordinated the disclosure of a critical severity vulnerability affecting the user authentication module of Futurum Software, a cloud-based business management platform designed to create and manage multi-level marketing businesses. The vulnerability was discovered by Diego González…
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118601.
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks. [...]
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-107145 to CVE-2026-107147) found in twofactor_gauthenticator plugin for Roundcube.
DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]
A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does. [...]
Serial number: AV26-1083 Date: October 26, 2026 As of October 26, 2026, Siemens is affected by a vulnerability in the following products: Mendix SAML (Mendix 10 compatible) Prior to V4.2.4 Mendix SAML (Mendix 11 compatible) Prior to V4.2.4 Mendix SAML (Mendix 9 compatible) Prior to V3.6.29 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SSA-137528: Authentication Bypass Vulnerability in Mendix SAML…
LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week.
Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in areas such as cancer, infectious diseases, and neurology. What happened and what was…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2026-114820, Summary: This Security Alert addresses CVE-2026-114820 by providing Java updates which removes the set of impacted root CA certificates related to eMudhra. To address this CVE, update to the latest Java version or apply the recommended mitigations. Affected Products and Versions: - Oracle GraalVM Enterprise Edition, version 21.3.20.0.2 - Oracle GraalVM for JDK, versions 17.0.21…
Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected intermediates have been revoked and blocked by major platform vendors, including Chrome, Mozilla, Apple, and Microsoft. The issue is tracked as CVE-2026-111943 and CVE-2026-111944. The eMudhra Certificate…
In this article Attack overview Technical details Mitigation and protection guidance Indicators of compromise References Learn More On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the Python Package Index (PyPI) and distributed through official container images. The malicious package added files that Python could execute during normal interpreter initialization. An application did not need to import LiteLLM for the payload to run: starting Python in an affected…
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise…
Serial number: AV26-1078 Date: October 22, 2026 As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product: C# Driver Prior to 3.13.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization Authentication bypass via issuer-and-serial-only certificate equality in shared cluster…
Key Points Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets. AI applications and development tools are notable targets. The stealer collects authentication files, session data, and configuration files associated with…
È stata resa pubblica la compromissione delle chiavi private associate ai certificati di otto autorità di certificazione (CA) intermedie di eMudhra , sei destinate all'emissione di certificati TLS e due alla firma del codice. Risultano interessate anche le corrispondenti versioni dei certificati intermedi oggetto di certificazione incrociata (cross-signing) da parte di Sectigo.
When we are building detections for various threats, we regularly run the exploits on representative systems to help us build high-quality rules. The Common Vulnerabilities and Exposures (CVE) entry CVE-2026-73570 for Zimbra is no exception. Zimbra is a widely used enterprise email and collaboration software platform, known for its SMTP platform, among other services. SMTP plays a critical role in the infrastructure of many organizations by providing email services that often include either…
Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. [...]
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-2026-111594) CVSS Vendor Equipment v3 8.1 InterSystems Corporation InterSystems IRIS for Health 1 Vulnerability Cleartext Transmission of…