Intelligence Feed

1mo ago · hacker-news

N-able has released Hotfix 4 (build 2026.3.1.14) for its N-central RMM platform to address CVE-2026-86218, a critical unauthenticated remote code execution vulnerability with a CVSS score of 10.0. The flaw affects all on-premises builds prior to 2026.3.1.14, including those recently updated to Hotfix 3. N-able's incident notice states the vulnerability has been exploited in the wild, though the company's release notes claim no confirmed exploitation. Huntress observed a compromise of a fully patched N-central environment and reproduced a PoC exploit chain, but could not confirm whether CVE-2026-86218 was the exploited vector due to log rotation.

1mo ago · bleeping-computer

N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) vulnerability, CVE-2026-86218, affecting its N-central remote monitoring and management platform. The flaw allows unauthenticated attackers to execute arbitrary code on exposed on-premises instances with low attack complexity. Although N-able has not confirmed active exploitation, Huntress warns it may be a zero-day and notes ongoing attacks targeting unpatched systems. The vulnerability follows previous incidents involving N-central, with hundreds of internet-exposed instances still potentially vulnerable despite prior patches.

1mo ago · bleeping-computer

Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS to hijack routers with SSH exposed to the internet. The first, CVE-2026-67276, is an SSH authentication bypass that allows login without the private key by exploiting weak RSA public key validation. The second, CVE-2026-86060, is an SSH privilege escalation flaw enabling full administrative access via a crafted username. The exploit chain, dubbed 'MikroTrick' by Poland's CERT, is already being used in the wild. MikroTik has released patches in several updated RouterOS versions, and indicators of compromise include specific log entries and malicious IP addresses.

1mo ago · bleeping-computer

Threat actors are using a technique called ASCII smuggling, inserting invisible Unicode characters (from the Tags block U+E0000–U+E007F) into finance-related keywords in phishing emails to evade detection by email security filters. Microsoft observed a large-scale campaign peaking at 2.37 million messages per day, primarily using sender domains associated with the ActiveCampaign email platform. The obfuscation splits words like 'funding' into 'fun[Unicode]ding' to bypass keyword-based detection, though most messages were still caught by other signals such as sender reputation. Microsoft recommends normalizing or stripping invisible Unicode characters to defend against this tactic in both email filtering and AI prompt processing.

1mo ago · hacker-news

Elastic Security Labs identified four malicious modules—ProManager, WinUpdate, SoftManager, and LockAppHost—linked to the REVSTEALER information stealer. These modules persist on infected systems after the main stealer deletes itself and perform various malicious activities, including cryptocurrency wallet theft, clipboard manipulation, reverse proxy setup, and cryptocurrency mining. LockAppHost disables Windows Update and Microsoft Defender to run a miner with elevated privileges, weakening system defenses. The modules share code and infrastructure with REVSTEALER, including use of Polygon blockchain for C2 resiliency and common packer techniques.

1mo ago · hacker-news

Attackers are exploiting a vulnerability chain in MikroTik RouterOS, dubbed 'MikroTrick' by CERT Polska, to gain full administrative control of internet-exposed routers via SSH without authentication. The attacks, observed since at least September 2, 2026, target unpatched devices across multiple RouterOS versions. CERT recommends immediate updates to fixed firmware versions, as temporary mitigations include disabling exposed management services and avoiding use of built-in clients from unpatched systems. Evidence of compromise includes unexpected privileged accounts and specific SSH login logs.

2mo ago · unit42

Aeternum is a recently discovered C++ botnet loader that uses the Polygon blockchain for decentralized command-and-control (C2) operations. The malware retrieves encrypted or plaintext instructions from smart contracts on the blockchain by querying public RPC endpoints, enabling resilient and low-cost infrastructure resistant to takedowns. Three distinct malware samples were analyzed: the initial Aeternum loader, a Python-based downloader, and a multi-component payload combining XWorm RAT, XMRig cryptocurrency miner, and data exfiltration tools. The threat leverages Telegram APIs and GitHub repositories for secondary C2 and payload delivery, while using weak encryption schemes that allow decryption via contract address and payload analysis.

2mo ago · unit42

Unit 42 investigated a cyber attack in which a threat actor used frontier AI and agentic AI frameworks to autonomously breach an enterprise network, achieving in under 10 hours what would typically take human operators two weeks. The AI agents systematically executed reconnaissance, harvested credentials from code repositories, escalated privileges by accessing secrets management systems, hijacked CI/CD pipelines, and abused stolen cloud keys to leverage the victim's own AI infrastructure for further attacks. The attacker left behind an 80-page technical audit detailing exploited findings, highlighting the operational efficiency of AI-assisted attacks without relying on zero-day vulnerabilities.

2mo ago · talos

Cisco Talos identified a Chinese-speaking threat actor, UAT-10147, conducting a global campaign targeting Windows and Linux web servers in government, education, media, technology, and gaming sectors. The actor leverages publicly disclosed vulnerabilities for initial access, including CVE-2022-27925, CVE-2021-23758, and CVE-2019-18935, and uses AI-driven tooling to automate exploitation, reconnaissance, payload generation, and validation. Post-compromise, the actor deploys malware such as QuasarRAT, Gh0stCringe, and SPECTRE, establishes persistence via scheduled tasks and rogue user accounts, and uses AI-generated scripts to refine attacks and bypass defenses. A misconfigured command-and-control server at 139.180.197[.]150 exposed operational details, including a target list of 170,000 URLs and AI-assisted attack workflows.

1mo ago · hacker-news

A zero-day vulnerability in Magento Open Source and Adobe Commerce, dubbed StyleSmuggler, is being actively exploited to achieve unauthenticated remote code execution and install persistent backdoors on e-commerce platforms. The attack chain leverages malicious input in log files and abuse of Magento's internal classes to execute a PHP dropper, which downloads and runs a malicious Rust-based implant. The backdoor runs under a disguised process name and establishes persistence via cron, with capabilities to read session data from Redis. No data exfiltration or lateral movement has been observed so far, but the threat is ongoing. Adobe has not yet released a patch or official advisory.

1mo ago · hacker-news

Trezor disclosed that a breach at its shipping provider ShipMonk exposed personal data of 67,000 U.S. customers, including names, email addresses, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021. The breach resulted from a zero-day SQL injection vulnerability, CVE-2026-72898, in Metabase that was exploited by the ShinyHunters extortion gang. Although Trezor had received assurances from ShipMonk that customer data was deleted, it remained in ShipMonk's systems and was accessed during the incident. Trezor warned users about potential social engineering and phishing attacks leveraging the stolen data.

1mo ago · hacker-news

Broadcom has patched two security vulnerabilities in VMware Workstation and Fusion, including a critical integer-overflow flaw (CVE-2026-59346) that could allow a local attacker with administrative privileges on a virtual machine to execute arbitrary code on the host. The second vulnerability is a stack-based buffer overflow in HGFS (CVE-2026-59347) that can also be exploited by a local admin to run code in the context of the VMX process on the host. Both vulnerabilities require local admin access within the VM, but could be leveraged after initial compromise via phishing or misconfigurations. The updates apply to versions 25H2 and 26H1, with fixes included in 26H1u1 releases. While no known in-the-wild exploitation of these specific flaws has been observed, recent VMware vCenter vulnerabilities have been actively exploited, including by a China-nexus APT actor.

1mo ago · hacker-news

In August 2026, unidentified threat actors exploited a critical vulnerability, CVE-2026-63077, in JetBrains' TeamCity server to breach the Cadence cloud service environment. The attackers gained access to a 2024 backup of the Cadence server, extracting sensitive data including personal information, source code, and AWS IAM credentials belonging to JetBrains employees and users. JetBrains confirmed unauthorized access between August 8 and 24, 2026, and urged all Cadence users to immediately rotate credentials and treat all executions as potentially compromised due to exposure of secrets and configurations.

1mo ago · bleeping-computer

A large-scale cybercriminal campaign has compromised over 5,400 websites, primarily built on WordPress and PrestaShop, to deliver malicious payloads via the ClickFix exploit. The attack chain uses a technique called EtherHiding, where malicious code is stored in smart contracts on the BNB Smart Chain (BSC) Testnet, making takedown efforts difficult. Victims are lured into executing a PowerShell command through a fake CAPTCHA prompt, leading to payload execution; later variants use a WebRTC-based stager that establishes a covert encrypted channel to receive and execute JavaScript code directly in browser memory.

1mo ago · hacker-news

PostgreSQL has patched a 12-year-old vulnerability, CVE-2026-6471, affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw allows an authenticated replication user to execute arbitrary code as the database OS user by exploiting unvalidated plugin paths in logical decoding. Attackers can leverage path traversal in the CREATE_REPLICATION_SLOT command to load malicious libraries from remote SMB or NFS shares, or local disk, achieving privilege escalation and persistence. The fix introduces a whitelist parameter, output_plugin_libraries, to restrict allowed decoding plugins, but gaps remain, such as in pg_createsubscriber behavior.

1mo ago · hacker-news

Threat actors are actively exploiting two vulnerabilities in PaperCut software, identified as CVE-2026-81578 and CVE-2026-82078, to conduct unauthorized access and credential theft targeting educational institutions in the U.S. and Europe. The attackers chain an authentication bypass with remote code execution to create privileged accounts, execute commands, and deploy credential-harvesting tools such as lsa_collect.exe and save_hives.exe. Post-exploitation activities include collecting Windows registry hives, searching configuration files for secrets, and exfiltrating data to attacker-controlled IP addresses.

1mo ago · hacker-news

A previously undocumented Linux backdoor named 'ted' has been discovered embedded within trojanized HAProxy binaries deployed at two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, enables command-and-control (C2) communication by mimicking legitimate HTTP responses, and allows attackers to execute shell commands, upload/download files, and modify configurations. Rapid7 Labs attributes the activity with medium confidence to North Korean state-sponsored actors, potentially linked to APT37, Lazarus, and Kimsuky clusters, based on infrastructure overlaps and operational patterns. The backdoor evades logging by manipulating HAProxy's internal connection counters and uses trojanized system binaries such as crond, sshd, agetty, atd, and polkitd to maintain persistence and exfiltrate credentials.

1mo ago · hacker-news

A high-volume phishing campaign has been leveraging invisible Unicode tag characters, specifically from the Unicode Tags block (U+E0000 to U+E007F), to obfuscate financial lure words such as 'funding' and evade email security filters. The technique, known as ASCII Smuggling, splits keywords with non-rendering characters (e.g., 'fun⟨U+E0020⟩ding') to bypass literal string detection while appearing normal to human recipients. The campaign has sent millions of emails daily, primarily targeting Small Business Administration (SBA) loan applicants, using the ActiveCampaign platform to distribute AI-generated phishing emails and dynamically generated, convincing phishing websites. The operation uses disposable finance-themed domains and leverages ActiveCampaign's infrastructure for link tracking, complicating reputation-based filtering.

1mo ago · bleeping-computer

Attackers are actively exploiting a critical authentication bypass vulnerability in Citrix NetScaler appliances, tracked as CVE-2026-19490, which allows unprivileged remote actors to bypass authentication when the appliance is configured as an AAA virtual server or Gateway. Exploitation attempts have been observed from multiple IP addresses geolocated to Australia, the United States, and Germany, following the release of a public proof-of-concept. The Centre for Cybersecurity Belgium and vulnerability intelligence firm Previdian have issued warnings urging administrators to patch affected systems immediately.

1mo ago · bleeping-computer

Google has patched a high-severity zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, identified as CVE-2026-85046, which is being actively exploited in the wild. The flaw is a type confusion issue that could allow remote code execution if a user visits a specially crafted webpage containing malicious JavaScript. Google has not disclosed specific exploitation details to allow time for users to update. Chrome users are urged to update to version 152.0.7977.82 or later to mitigate the risk. This is the sixth actively exploited Chrome zero-day fixed by Google in 2026.

1mo ago · bleeping-computer

An anonymous security researcher known as Nightmare Eclipse disclosed a zero-day privilege escalation vulnerability in CrowdStrike Falcon, dubbed 'FalconFlank,' which allows attackers to achieve SYSTEM-level privileges on fully updated Windows 11 25H2 and Windows Server 2025 systems. The exploit abuses the 'File Suspicious Macro Removal' feature in CrowdStrike Falcon Sensor by loading a malicious DLL. CrowdStrike has not yet assigned a CVE ID but advises customers to disable the related Microsoft Office policy setting while investigations continue. The researcher has also released other zero-day exploits targeting Kaspersky, Avast, Nvidia, and multiple Microsoft products.

1mo ago · securelist

Toy Ghouls, a financially motivated threat actor active since 2025, has developed two custom backdoor variants named mqtt-bird-agent and matrix-bird-agent, both version 0.1.0. These backdoors are deployed using Windows Remote Management (WinRM) and establish persistence via Windows services. The HiveMQ version communicates through the public broker.hivemq.com MQTT broker, while the Element version uses a malicious Element server at meet.element[.]tw for C2 communications, leveraging Matrix protocol rooms for command exchange. The backdoors collect system telemetry, execute commands via PowerShell or cmd, and use machine-bound encryption for configuration files, indicating increased sophistication in the group's tooling and operational security.

1mo ago · hacker-news

BraZetsu is a sophisticated Python-based Windows malware framework used by the threat actor Exilware to compromise systems and monetize access via the 'Infected Marketplace' (aka 'Banco de Infects'). The malware conducts deep reconnaissance, steals financial data including CNAB-format remittance files, captures screenshots, and enables remote command execution. It leverages generative AI for target triage and prioritization, and maintains persistent communication via WebSocket. BraZetsu shares infrastructure and code with AgenteV2, indicating they are part of the same malware framework. The campaign primarily targets Iberian and Latin American organizations in e-commerce, finance, and critical infrastructure sectors.

1mo ago · hacker-news

Cisco disclosed a critical vulnerability, CVE-2026-20212, in 10 Silicon One-based Nexus 9000 switches that allows unauthenticated remote attackers to execute code with root privileges by exploiting exposed TCP ports 43210 and 43211. The flaw stems from binding to an unrestricted IP address, enabling direct access to a privileged service. Cisco has released patches and recommends immediate upgrades, while also providing temporary mitigations such as infrastructure ACLs and a Live Protect shield. Separately, a hardening release for IOS XR addresses 7 CVEs, including two rated 9.8, and ongoing exploitation of similar infrastructure is linked to the China-nexus threat actor Fire Ant, which has deployed stealthy implants on IOS XR routers to manipulate traffic and exfiltrate data.

1mo ago · hacker-news

Multiple threat campaigns are leveraging social engineering, phishing-as-a-service (PhaaS), and abuse of trusted software to gain unauthorized access to corporate and personal accounts. Microsoft Teams is being abused in vishing attacks to trick users into granting remote access via RMM tools, while PhaaS platforms like Outsider and BlueKit enable credential theft through browser-in-the-middle attacks. Malicious actors are also exploiting misconfigurations in AI instruction files (llms.txt) to deliver malicious packages, and trojanized Electron apps are distributing the RevStealer information stealer. Additionally, attackers are abusing legitimate tools like Faronics Deploy and ScreenConnect to establish persistent remote access, and ransomware operations such as The Gentlemen and CRPx0 continue to target organizations with sophisticated, multi-stage attack chains.

1mo ago · hacker-news

Google has released a security update for Chrome to address CVE-2026-85046, a high-severity type confusion vulnerability in the V8 JavaScript and WebAssembly engine that is actively exploited in the wild. The flaw allows a remote attacker to execute arbitrary code within the sandbox by using a crafted HTML page. Security researcher Salvatore Gulizia discovered and reported the vulnerability, which stems from incorrect handling of JavaScript array maps leading to arbitrary read/write capabilities on the JavaScript heap. Users are urged to update to Chrome version 152.0.7977.82 or later to mitigate the risk.

1mo ago · hacker-news

Plex has urged users to immediately update their Plex Media Server and Desktop applications to version 1.43.3 and 1.115.0, respectively, to address multiple undisclosed security vulnerabilities for which CVE identifiers have been requested. While specific details about the newly patched flaws were not disclosed, historical vulnerabilities in Plex Media Server have enabled serious attacks, including infrastructure enumeration and unauthorized access. The article highlights past exploited flaws such as CVE-2025-34158, which allowed lower-privileged users to access administrative tokens and discover linked servers, and CVE-2020-5741, which was used in the 2022 LastPass breach to deploy keyloggers on an employee's machine.

1mo ago · hacker-news

Threat actors are actively exploiting two critical remote code execution (RCE) vulnerabilities in WordPress plugins Super Forms and Elementor Pro. CVE-2026-14894 and CVE-2026-32475 allow unauthenticated attackers to upload arbitrary PHP files, enabling remote code execution via web shells. Exploitation attempts have exceeded 440,000, with attacks observed since July 14, 2026, peaking in August. Attackers upload PHP web shells such as 'Mushr00w_upl.php' and leverage them to execute commands, exfiltrate data, or take control of WordPress sites.

1mo ago · bleeping-computer

Hewlett Packard Enterprise (HPE) has patched a critical buffer overflow vulnerability in ArubaOS-CX, tracked as CVE-2026-73749, which allows unauthenticated remote attackers to execute arbitrary code with elevated privileges by sending specially crafted packets to an affected daemon. Multiple other vulnerabilities were also addressed, including privilege escalation, command execution, and authentication bypass flaws affecting various versions of ArubaOS-CX. HPE recommends customers upgrade to fixed software versions immediately, although no active exploitation has been observed at the time of disclosure.

1mo ago · hacker-news

Threat actors are leveraging the legitimate Node.js runtime (node.exe) to deliver malware in targeted attacks against government departments, technology firms, and hotels since February 2026. By using signed, trusted binaries and executing malicious JavaScript scripts, attackers evade signature-based detection. The attacks involve tools such as AdaptixC2, Cobalt Strike, ModeloRAT, Mistic (MLTBackdoor), GateKeeper, and C2Looper, with initial access often gained via the ClickFix social engineering technique. Attackers also abuse EtherHiding and blockchain-based C2 infrastructure for resilience, making blocking efforts difficult.