Intelligence Feed

1d ago · bleeping-computer

A critical vulnerability in GitLab, tracked as CVE-2026-97229, is being actively exploited in the wild. The flaw exists in the CI/CD Regular Expression Compiler and stems from an integer overflow weakness, allowing unauthenticated attackers to execute arbitrary code on vulnerable GitLab servers via a specially crafted regular expression in a CI/CD configuration. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch by a specific deadline, while also urging private sector organizations to prioritize remediation. GitLab has released patches in versions 19.4.2, 19.3.5, and 19.2.8 for both Community and Enterprise Editions.

1d ago · bleeping-computer

A malicious version of the Anthropic Claude Code VS Code extension, version 2.1.313, was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, 2026, potentially affecting up to 5,000 developers. The compromised extension executed malicious JavaScript code upon loading, which collected system and user information, installed an SSH backdoor, and attempted to establish a reverse tunnel to an attacker-controlled server. While coding errors in the malware prevented successful SSH backdoor activation on many systems, reconnaissance data was still exfiltrated to the C2 server at 134.209.82[.]225. Cursor removed the extension, took down its marketplace temporarily, and coordinated takedown of the attacker's infrastructure.

1d ago · bleeping-computer

Trezor has issued a warning about a suspected hardware implant in a Trezor Safe 5 device sold through its reseller CryptoBilis in Southeast Asia. An Indonesian customer reported discovering an unauthorized circuit board with a cellular module and antenna inside the device, which could potentially exfiltrate sensitive data such as recovery phrases over mobile networks. The same reseller was previously implicated in a similar Ledger hardware wallet compromise, suggesting a broader supply-chain attack. Trezor has not yet physically verified the device but advises users who purchased through CryptoBilis since March 2026 to transfer their assets to new wallets and avoid using potentially compromised devices.

1d ago · bleeping-computer

A critical use-after-free vulnerability in the Linux kernel, tracked as CVE-2026-98432, affects TCP connection handling and allows unauthenticated remote attackers to potentially execute code as root on systems with Multipath TCP (MPTCP) enabled. The flaw impacts Linux kernels from version 4.4 onward, including major distributions such as Ubuntu, RHEL, and Rocky Linux. While exploitation is complex, researchers at Anthropic demonstrated remote root code execution under specific conditions using an unreleased AI model. The vulnerability stems from a race condition in tcp_v4_syn_recv_sock() and can be triggered even without MPTCP in some cases, though exploitation has not been publicly demonstrated on standard TCP connections.

17h ago · bleeping-computer

A zero-click denial-of-service vulnerability in Android, tracked as CVE-2026-58882 and dubbed 'SMS of Death', allows attackers to remotely crash unpatched phones or disrupt cellular service by sending a specially crafted SMS message. The flaw exists in the WapPushOverSms.decodeWapPdu function, which fails to validate a header-length value, leading to a negative array size allocation that crashes the com.android.phone process. Google patched the issue in October 2026 for Android 14 through 17, but older Android 12 and 13 devices remain vulnerable. A proof-of-concept exploit has been released, enabling malicious actors to send the crafted message to port 2948, potentially causing reboot loops and blocking emergency calls.

15h ago · bleeping-computer

Northflank, a cloud application hosting platform, suffered a security breach resulting in the unauthorized decryption and theft of customers' environment variables, including AI API keys. The company warned all customers to immediately rotate stored credentials following a threat alert from Wiz. Multiple customers reported abuse of their AI API keys, with attackers potentially leveraging the stolen credentials for 'LLMJacking'—exploiting access to run up costly AI service usage. The breach is part of a broader wave of attacks on AI development platforms observed in October 2026, collectively dubbed 'Black October' by Wiz.

1w ago · bleeping-computer

The BlackX UEFI bootkit, attributed with medium confidence to Chinese state-sponsored threat group APT41 (also known as Brass Typhoon, Wicked Panda, Barium), has been used in an espionage campaign since early 2026 targeting diplomatic agencies in Central Asia. It exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by enrolling custom Machine Owner Keys (MOKs) and loading malicious EFI files, leveraging a previously known flaw that requires manual activation of certificate revocation to be fully mitigated. The bootkit deploys a malicious kernel driver signed with a revoked certificate to disable security processes, tamper with ETW, and deploy follow-on payloads including a RAT using cloud storage for C2 and the OxiDLLRunner DLL loader that executes obfuscated Rust-based plugins from a malicious domain.

1w ago · bleeping-computer

Hewlett Packard Enterprise (HPE) has released security updates to address 72 vulnerabilities in Aruba Operating System (ArubaOS), including eight maximum-severity flaws that could allow remote unauthenticated attackers to bypass authentication and execute arbitrary code. These vulnerabilities affect both AOS-8 and AOS-10 software versions and can be exploited without user interaction. HPE recommends immediate patching and advises restricting access to management interfaces to reduce exposure, as no known in-the-wild exploitation has been observed yet.

1w ago · bleeping-computer

The PHP security team has disclosed a new unpatched remote code execution vulnerability, CVE-2026-115560, affecting systems with specific non-default configurations involving session serialization handlers and upload progress enabled. Exploitation requires a rare combination of runtime configuration changes, making widespread impact unlikely, but mitigation is advised. As a temporary measure, users are urged to disable session.upload_progress.enabled. Concurrently, active exploitation attempts are being observed in the wild against previously patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), with multiple actors attempting attacks before patches were released, though confirmed compromises remain unverified.

1w ago · bleeping-computer

Quest Diagnostics confirmed a data breach on October 21, 2026, after unauthorized access was detected in its Quanum LSM system, used by healthcare providers to manage lab services and access test results. The company believes patient records were exposed, though the exact data types and scope remain under investigation. No threat group has claimed responsibility, and operations were not disrupted, but access to affected systems has been paused as a precaution.

1w ago · bleeping-computer

The abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, exposed millions of devices to remote code execution (RCE) attacks due to a vulnerable updater that communicated over unencrypted HTTP and executed unsigned updates. The vulnerability, tracked as CVE-2026-30612, allowed full system-level code execution on Windows and macOS if an attacker controlled the update domain. Researchers from Eye Security mitigated the threat by registering the domain popcorntimeupd.xyz and delivering a benign update to disable the updater, preventing further exploitation.

1w ago · bleeping-computer

GitLab has disclosed and patched a maximum-severity vulnerability, CVE-2026-110264, in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers via a specially crafted regular expression. The flaw stems from an integer overflow weakness and affects multiple versions of GitLab Community Edition (CE) and Enterprise Edition (EE). Users are urged to upgrade immediately, as the vulnerability could lead to full system compromise. This follows recent critical GitLab vulnerabilities, including CVE-2026-97229 and CVE-2026-85706, the latter of which was added to CISA's known exploited vulnerabilities list.

1w ago · bleeping-computer

Attackers began exploiting the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) as early as October 17, 2026, four days before official patches were released. The vulnerabilities, which allow remote code execution, were actively targeted using proof-of-concept exploits from anonymized IP addresses shortly after disclosure. Amazon Threat Intelligence observed exploitation attempts originating from commercial anonymization networks, indicating possible advanced threat actors. While some pre-disclosure activity has been detected, it remains unclear how widespread successful compromises are, though the risk is high due to PHP's extensive use across the web.

1w ago · bleeping-computer

Arista Networks patched a critical zero-day vulnerability, CVE-2026-114625, in its on-premises VeloCloud Orchestrator (VCO) deployments that was actively exploited in attacks. The flaw is a SQL injection allowing authenticated attackers with basic privileges to escalate to operator-level access, enabling them to access internal functionality and compromise the confidentiality, integrity, and availability of the orchestrator and managed data. Arista identified two IP addresses involved in ongoing exploitation and recommends immediate patching and monitoring of access logs.

1w ago · bleeping-computer

The LiteLLM project's release pipeline was compromised on October 21, 2026, leading to the distribution of malicious PyPI wheels and Docker images for version 1.107.0. The attack injected a Python-based info-stealer into the installation packages, which executed at Python startup via malicious .pth and .py files to harvest cloud credentials, AI provider keys, developer secrets, browser data, and system information. The stolen data was exfiltrated to litellm[.]dev and a GitHub-hosted loader enabled remote code execution. The artifacts were quickly detected and removed, but recovery requires more than uninstalling the package due to persistent payloads.

1w ago · bleeping-computer

Railway, a cloud hosting platform for developers, detected suspicious activity indicating a potential breach of its systems storing customer environment variables. The investigation suggests that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained decrypted contents containing sensitive secrets such as API keys and database credentials. As a precaution, Railway urges all users to rotate their secrets immediately, especially AI inference providers who were directly targeted. The company has paused deployments during the investigation, with partial restoration for Pro and Enterprise workspaces.

1w ago · bleeping-computer

The Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have identified SafePay, a private ransomware group active since August 2024, as responsible for breaching over 600 critical infrastructure organizations globally. The group gains initial access through credential exposure, brute force attacks, and exploitation of VPN vulnerabilities, particularly targeting Mullvad VPN IP addresses. SafePay employs double-extortion tactics, exfiltrating sensitive data before encryption and threatening to leak it if ransoms are unpaid. The group does not use affiliates and has increasingly filled the operational gap left by the decline of BlackCat and LockBit ransomware groups.

1w ago · bleeping-computer

Hackers breached the infrastructure of Onamae Desktop Cloud, a VPS service provided by GMO Internet, and installed malicious programs on up to 26,739 customer servers. The company detected the intrusion and began shutting down affected servers starting October 21, 2026. While no confirmed data misuse has been reported, customer data may have been exposed, and users are advised to rotate secrets. The attackers may also attempt follow-on phishing campaigns leveraging the incident.

1w ago · bleeping-computer

Hackers are actively exploiting a critical OS command-injection vulnerability, CVE-2026-106931, in the SiteGuard Server Edition web application firewall (WAF). The flaw exists in the statistics feature, which is enabled by default, and allows attackers to execute arbitrary commands with root or SYSTEM privileges on affected systems. The vulnerability impacts multiple versions of SiteGuard Server Edition for Apache httpd, Nginx, and IIS, excluding FreeBSD, prior to 8.00 Update 5, and FreeBSD versions before 7.00 Update 6. Exploitation in the wild has been confirmed, though details about the threat actors, victims, or attack scope remain undisclosed.

2w ago · bleeping-computer

BeyondTrust has patched a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support (RS) and Privileged Remote Access (PRA) appliances that was exploited in attacks since August 2026. The flaw is an authentication bypass allowing unprivileged remote attackers to perform file operations on unpatched systems. The China-nexus espionage actor 'Armory Castle' (also known as UNC5221 or 'Warp Panda') exploited the vulnerability to gain initial access, escalate to root privileges, deploy Sawfly web shell and Bareclaw tunneler malware, and move laterally using stolen credentials. Organizations with internet-exposed appliances during the exploitation window should assume compromise.

2w ago · bleeping-computer

Hackers conducted a supply-chain attack by compromising ConnectWise's Cloud Backup service, leveraging stolen application identities to gain unauthorized access to Microsoft 365 tenants. The attackers used a single IP address (144.172.64[.]128) to authenticate as the backup application via its secret, bypassing MFA and exploiting broad permissions previously granted in customer tenants. Multiple cybersecurity firms observed malicious activity including reconnaissance, privilege escalation to Exchange and Global Administrator roles, and attempts to establish persistence by adding credentials to third-party tools. ConnectWise shut down customer access to the service, but existing tokens remain valid until expiration, requiring manual review and revocation by administrators.

2w ago · bleeping-computer

Drupal has patched two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both flaws could allow unauthenticated attackers to execute arbitrary code on affected servers, especially when combined with contributed or custom modules. The Drupal Security Team warns that exploits could emerge within hours or days of disclosure, urging immediate patching to versions 10.6.19, 11.3.19, 11.4.10, or Entity List 3.0.10.

2w ago · bleeping-computer

Candiru spyware was delivered via a zero-click attack technique dubbed AdFection, in which malicious JavaScript was embedded in targeted online advertisements served through Discover-Tech's Controlium platform. The attack targeted devices at Al Jazeera Media Network and others, with evidence showing that at least 45 devices were targeted between 2024 and 2025. The malicious ads contacted Discover-Tech's NOAS server, which selectively delivered exploit code to specific devices based on identifiers like IP address, leading to infections linked to Candiru command-and-control infrastructure. A DLL file recovered from a compromised Windows system was attributed to Candiru with high confidence.

2w ago · bleeping-computer

A critical vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento and Adobe Commerce platforms, allowing remote attackers to execute arbitrary PHP code on server systems through a second-pass template injection in email templates. The flaw exists due to improper neutralization of special elements in the template engine, enabling attacker-controlled content to be re-processed at root level, executing malicious {{block}} directives. Although active exploitation has not yet been observed, researchers warn that the complexity of the attack path is mitigated by AI tools that can rapidly reverse-engineer working exploits from patches, making mass exploitation likely in the near term. The vulnerability impacts Magento Open Source and Adobe Commerce up to version 2.4.9 and Adobe Commerce B2B up to 1.5.3, requiring both the BlockStrap and prior StyleSmuggler fixes to be applied for full protection.

2w ago · bleeping-computer

A proxyjacking campaign has compromised D-Link, Ubiquiti, and other edge devices across 34 countries, leveraging known vulnerabilities to install the legitimate bandwidth-sharing app Pawns.app without user consent. The attackers monetize victims' internet bandwidth by enrolling devices into a residential proxy network, potentially earning payouts through unauthorized participation. The campaign exploited specific vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver, with evidence of SSH key configuration for persistent access. Organizations are advised to patch known vulnerabilities and secure internet-facing devices to prevent compromise.

2w ago · bleeping-computer

A threat actor uploaded malicious packages to the Arch User Repository (AUR) under the username 'marchos1as', impersonating popular AUR helper tools 'yay' and 'paru' using typosquatted names like 'yyay'. These packages contained legitimate source code combined with a malicious install script that executed a remote shell script with root privileges. The payload was fetched via a Wayback Machine URL pointing to a GitFlic-hosted repository 'hellscripter/install-scripts'. Potential connections exist to the 'DirtyBlanket' npm campaign involving the same infrastructure, though no definitive link has been confirmed. Arch Linux maintainers removed the packages and banned the account.

2w ago · bleeping-computer

Threat actors are actively exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The flaw exists in versions prior to 26.4.303 and allows unauthenticated OS command injection via the proxy.php endpoint when the built-in server is stopped. Attackers are deploying PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets. Exploitation began in mid-September, over four weeks before the CVE was published on October 14, highlighting a dangerous gap between patch availability and formal disclosure.

2w ago · bleeping-computer

In April 2025, the UK Legal Aid Agency (LAA) suffered a cyberattack resulting in the theft of sensitive data spanning nearly five decades, with records dating back to 1978. The breach exposed personal and financial information of legal aid applicants and recipients, including contact details, dates of birth, national ID numbers, criminal history, and payment data. Additionally, legal aid providers' data such as contracts, financial information, and LAA Online Portal credentials were compromised. The agency has confirmed no evidence of exfiltrated data being published, and the UK government is investing over £200 million to modernize digital services and strengthen cybersecurity across public legal aid systems.

2w ago · bleeping-computer

Cisco has patched a new actively exploited zero-day vulnerability, CVE-2026-76519, in its Secure Email Gateway (SEG) product. The flaw is a path traversal vulnerability in the Advanced Malware Protection (AMP) feature that allows unauthenticated remote attackers to execute arbitrary commands with root privileges by sending a maliciously crafted email attachment. The vulnerability affects SEG instances with the File Reputation service enabled and Content Scanner Tools versions earlier than 25.3.0.5525. Cisco has observed active exploitation in the wild and recommends immediate remediation, including software updates, credential renewal, and access control hardening.

2w ago · bleeping-computer

Palo Alto Networks has disclosed a high-severity remote code execution (RCE) vulnerability in PAN-OS, tracked as CVE-2026-0322, that has been actively exploited in limited attacks. The flaw affects the management interface of PA-Series, VM-Series, Panorama, and M-Series appliances, allowing authenticated attackers with network access to execute code as root. Exploitation requires valid credentials and access to the management interface, and no workarounds exist aside from restricting access and applying updates. Palo Alto Networks has released patches for multiple PAN-OS versions and identified three malicious IP addresses involved in the attacks.