Intelligence Feed

2w ago · hacker-news

Researchers from security firm Calif demonstrated a local privilege escalation exploit against OpenBSD 7.9 that chains two kernel vulnerabilities: a 37-year-old integer overflow in the shmat(4) system call and a reference-counting use-after-free flaw. The exploit bypasses OpenBSD's KARL kernel-address randomization as well as SMAP and SMEP hardware protections by leveraging predictable kernel memory allocators. Full proof-of-concept code was published alongside a detailed writeup after OpenBSD released patches in September. There is no evidence of prior exploitation in the wild.

2w ago · hacker-news

UAT-11985, an advanced persistent threat group, has conducted a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations using fake event invitations. The emails impersonate legitimate institutions and include malicious links or QR codes that direct victims to adversary-in-the-middle (AitM) phishing sites mimicking Google Forms and Google login pages. These sites harvest Google credentials and multi-factor authentication codes in real time, enabling full account takeover, with infrastructure tailored to Chinese-speaking users by supporting Simplified and Traditional Chinese locales.

2w ago · hacker-news

NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities, including potential remote code execution (RCE) and a TLS session forgery flaw that could bypass client-certificate checks. The most severe flaws are heap overflows and a use-after-free condition, exploitable under specific configurations involving alias with rewrite, regex maps, AIO with SSI, or shared TLS session caches. The TLS flaw (CVE-2026-97629) stems from improper rotation of session ticket keys, allowing non-deterministic forged session resumption. No active exploitation has been reported, but prior NGINX flaws have seen rapid weaponization post-disclosure.

2w ago · hacker-news

Citizen Lab identified a zero-click spyware campaign conducted by the Israeli firm Candiru, targeting Al Jazeera staff through malicious online ads served via Discover-Tech, a company posing as a legitimate digital advertising vendor. The attack exploited ad delivery infrastructure to silently deploy spyware without user interaction, with initial access established when targeted devices loaded malicious ads that triggered callbacks to attacker-controlled servers. At least 45 devices were targeted in 2024 and 2025, and the attack chain was confirmed through traffic logs and a recovered Windows malware sample linked to Candiru's known toolset.

2w ago · hacker-news

Multiple active threats were reported, including ransomware groups Qilin and Settra exploiting a PAN-OS authentication bypass vulnerability (CVE-2026-0257). A cryptocurrency wallet drainer kit called Noir uses DNS TXT records hosted on Cloudflare Pages to locate backend infrastructure. A new Rust-based remote access trojan, CikaBika Bot, leverages Discord for C2 communications. The KGB RAT malware, advertised on cybercrime forums, combines data theft with psychological harassment features. Adobe Experience Manager cloud instances are vulnerable to an unauthenticated RCE chain. Samsung patched a critical unauthenticated RCE in its QA-Board tool, while NVIDIA's Linux GPU driver has a privilege escalation and container escape flaw.

2w ago · hacker-news

A critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows guest virtual machines to read host memory, crash the host, and potentially execute code on it. The flaw resides in the kernel's networking code and was demonstrated against Vercel's production sandboxes, where specially crafted network packets from a guest VM could exfiltrate up to 32 bytes of host memory per packet. Although the vulnerability has not been exploited in the wild, it poses a broad risk to cloud providers using shared Linux kernel infrastructure, as it enables VM escape and host-level compromise.

2w ago · hacker-news

Drupal has patched a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-108097, in its Field UI module. The flaw allows unauthenticated attackers to execute arbitrary code on affected servers through exploit paths involving contributed modules. While the core vulnerability cannot be exploited directly, at least one known path via contributed modules requires no authentication. The fix was released in multiple supported versions, but older branches including Drupal 8, 9, and earlier end-of-life versions remain unpatched. Additionally, the Entity List module is affected by a similar RCE flaw, CVE-2026-108099, with identical exploitation conditions.

2w ago · hacker-news

Next.js released an out-of-band security update on October 14, 2026, to address two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) flaw. The first RCE flaw, in React Server Components, affects apps using Cache Components with a use cache function returning multiple typed arrays. The second RCE stems from a memory bug in the librsvg library, accessible through the sharp package when processing attacker-supplied SVG files on glibc-based Linux systems. The DoS vulnerability affects App Router applications with Server Actions, allowing attackers to cause full CPU utilization on a server process.

2w ago · hacker-news

Help TDS, a long-running traffic distribution system active since at least 2017, is linked to the Russian-language affiliate program Hotejka, believed to be a rebranded version of the previously exposed ROI777 operation. The threat actor uses compromised websites, often via a malicious WordPress plugin 'woocommerce_inputs' or custom HTML blocks, to redirect users to tech support scams hosted on disposable Cloudflare Pages domains (*.pages.dev). These scams employ browser fingerprinting and full-screen lock techniques to display fake Microsoft alerts, tricking victims into calling fraudulent support numbers and granting remote access via tools like Ultraviewer. The infrastructure has evolved from cryptocurrency mining campaigns under ROI777 to monetizing traffic through affiliate networks, with historical C2 domains and Telegram activity linking the operations.

2w ago · hacker-news

Attackers exploited a critical command injection vulnerability in the Collabora Online - Built-in CODE Server app (package: richdocumentscode) for Nextcloud, tracked as CVE-2026-110447, to deploy PHP web shells on unpatched servers. The flaw allowed unauthenticated remote code execution via a maliciously crafted request path during server startup or restart, enabling attackers to execute commands as the web server user. Multiple administrators reported compromises starting September 10, 2026, with evidence of post-exploitation activity including credential and cryptocurrency wallet searches. The vulnerability was actively exploited in the wild before a public advisory or CVE was issued on October 14, 2026.

2w ago · hacker-news

Palo Alto Networks has patched a high-severity authenticated remote code execution vulnerability, CVE-2026-0322, in PAN-OS software that is under active exploitation. The flaw allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. Exploitation attempts have been observed from specific IP addresses, and the U.S. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by October 17, 2026.

2w ago · hacker-news

AhsayCBS, a backup solution by Singapore-based Ahsay, contains two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, that have been actively exploited to achieve unauthenticated remote code execution. Threat actors have chained these flaws to deploy web shells and XMRig cryptocurrency miners on exposed systems. Initial patches in versions 9.15.2.59 and 10.3.4.0 were incomplete, and Ahsay has since released hotfixes in versions 9.15.2.70 and 10.3.4.45 to fully address the issues. The U.S. CISA has added the vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 17, 2026.

2w ago · hacker-news

A critical authenticated remote code execution vulnerability, CVE-2026-105740 (CVSS 9.9), in the open-source AI platform Langflow is being actively exploited by threat actors. The flaw allows any authenticated user to execute arbitrary OS commands on the server via maliciously crafted MCP server configurations using the 'stdio' transport, with no input validation or sandboxing. Previdian recorded 1,423 exploit attempts from 27 unique IP addresses since September 19, 2026, with increased activity starting October 11. Attackers are using stolen credentials or weak passwords to authenticate and then deploy payloads to extract environment variables, execute system commands, and attempt lateral movement. Immediate mitigation includes upgrading to a patched version, disabling auto-login, and restricting access to trusted users.

2w ago · hacker-news

The GhostAction campaign, a supply chain attack targeting GitHub accounts, has compromised approximately 1,900 users and targeted over 30,000 repositories to steal CI/CD secrets, cloud credentials, and AI API keys. Attackers use stolen Personal Access Tokens (PATs) or credentials from infostealer logs to gain write access and inject malicious GitHub Actions workflows with deceptive names like 'security-audit.yml'. The latest wave, observed starting August 31, 2026, features evolving payloads that include git history secret-scanning capabilities to extract AWS keys and associated secrets, with GitHub blocking execution starting October 9. Some victims were re-compromised, suggesting unrotated secrets remain exploitable.

2w ago · hacker-news

Microsoft, in collaboration with Health-ISAC, JC3, and private sector partners, disrupted three phishing kits—CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System—linked to over 1 billion phishing messages targeting organizations in more than 150 countries. These kits were sold via an underground marketplace called YAM Store, tracked as Storm-3119, and developed by a group tracked as Storm-2990. The phishing kits enabled large-scale credential theft and financial fraud by impersonating legitimate brands in sectors such as finance, healthcare, and logistics. The operation revealed shared infrastructure and code among the kits, indicating close collaboration or common origins among Chinese-speaking developers.

2w ago · hacker-news

The U.S. Department of Justice has charged 14 individuals and dismantled over 40 laptop farms linked to a North Korean IT worker fraud scheme known as Famous Chollima, purpledelta, and Wagemole. The operation involved North Korean IT workers using fake identities to obtain remote jobs at more than 70 U.S. companies, funneling salaries back to the DPRK to fund its nuclear and military programs. Facilitators in the U.S., including two arrested nationals, hosted company-issued laptops and laundered funds, while the threat actors used social engineering, identity theft, and laptop redirection tactics to evade detection. The FBI warns of escalating tactics, including subcontracting work to freelancers in South Asia and West Africa, and using threats of violence to coerce cooperation.

2w ago · hacker-news

Cisco has confirmed active exploitation of a critical vulnerability, CVE-2026-76519, in its Secure Email Gateway appliances. The flaw allows an unauthenticated attacker to write files to the operating system and potentially execute commands as root by sending a maliciously crafted email attachment. The vulnerability affects systems with the File Reputation service enabled and running a vulnerable version of the Content Scanner Tools package (prior to 25.3.0.5525). Cisco has released fixes via both AsyncOS updates and a standalone Content Scanner Tools update, and advises immediate remediation due to active attacks.

2w ago · hacker-news

A critical vulnerability in the Linux kernel's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local unprivileged users to achieve root privilege escalation by exploiting a flaw in memory mapping validation. The vulnerability also enables a virtual machine guest to break out to the host by writing to the host's memory via a QEMU process hijack when specific virtualization configurations are used. The bug existed due to a cache inconsistency introduced across two code changes in 2017 and 2020, affecting kernels from version 4.11 to 7.2-rc4. Tencent Zhuque Lab discovered the flaw using an AI-assisted research pipeline called Corvus AI and released a fix in August 2026, with a public write-up and working demos provided in October.

2w ago · hacker-news

Hirudo is a new Android banking trojan that replaces legitimate banking apps with tampered versions to bypass built-in security checks. The malware is distributed via dropper apps disguised as shopping, adult video, and entertainment apps, which prompt fake in-app updates to install the payload. It enables on-device credential theft, remote control, screen and camera capture, and SMS theft by leveraging accessibility services and bypassing Play Protect using a non-functional VPN. The trojan specifically targets eight Indonesian banking apps but also has credential harvesting capabilities for users in China, India, Mexico, Morocco, and Thailand.

2w ago · hacker-news

Researchers at XBOW leveraged OpenAI's GPT-5.6 Sol model to rapidly develop a full-chain Chrome exploit within six days, chaining three previously unknown vulnerabilities to achieve remote code execution on Windows without user interaction. The exploit bypassed Chrome's dual sandbox layers by exploiting flaws in V8, the animated WebP decoder, and Crashpad. Google has since patched all three vulnerabilities and awarded XBOW a $250,000 bug bounty. The demonstration highlights a significant reduction in the time and resources required to develop sophisticated browser exploits, raising concerns about future offensive capabilities.

2w ago · hacker-news

A high-severity use-after-free vulnerability in curl and libcurl, tracked as CVE-2026-92392, allows a malicious HTTP/2 server to achieve client-side code execution during file uploads under specific conditions. The flaw affects versions 8.12.0 through 8.22.0 and was patched in version 8.23.0. Successful exploitation requires precise knowledge of the client's build, architecture, and memory layout, making reliable code execution difficult; crashes are more likely than full compromise. The vulnerability was discovered via Anthropic's OSS Scanner and reported through HackerOne by researcher Luna Tong.

2w ago · hacker-news

CISA has urged immediate updates to Ivanti Connect Secure (ICS) appliances due to active exploitation of a critical authentication bypass vulnerability, CVE-2026-104935, which allows unauthenticated remote code execution. The flaw affects multiple ICS versions and is being exploited in the wild, with honeypots detecting 105 exploit attempts originating from 50 unique IP addresses. Threat actor UTA0576 has been observed leveraging the vulnerability in conjunction with a privilege escalation flaw to achieve root-level access, conduct credential theft, exfiltrate Active Directory metadata, and deploy tools for Kerberoast attacks and LDAP reconnaissance.

2w ago · hacker-news

Microsoft released patches for 1,413 vulnerabilities in its October 2026 Patch Tuesday, including three critical flaws actively exploited or publicly disclosed. The most notable is CVE-2026-96951, a command injection vulnerability in Windows Shell that allows attackers to bypass Mark of the Web (MOTW) defenses by tricking users into interacting with a malicious file. The vulnerability has been exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 16, 2026. Another critical flaw, CVE-2026-108398 in .NET Framework, enables local attackers to bypass Windows Defender Application Control without user interaction, making it a dangerous post-compromise technique.

2w ago · hacker-news

Researchers from Doyensec demonstrated a proof-of-concept exploit against a Windows VBS enclave (SFAPE.dll) used by Microsoft Defender SmartScreen's Enhanced Phishing Protection, achieving code execution within the isolated environment. The attack leveraged a four-byte write vulnerability and a timing bug to bypass memory isolation, ultimately allowing an attacker with local SYSTEM access to load and execute arbitrary code inside the enclave. The vulnerability, tracked as CVE-2026-83498, was patched by Microsoft in the September 8, 2026 update (KB5124008). Although not exploited in the wild, the research highlights risks from loadable vulnerable enclaves, as older flawed enclaves like one affected by CVE-2023-36880 remain allowed to load despite known exploits.

2w ago · hacker-news

GitHub has implemented changes to npm's trusted publishing mechanism after a vulnerability was discovered that allowed attackers to hijack over 1,500 packages by exploiting repository name reuse (slug reuse). The flaw, named SlugFest by Bloom Security, stemmed from npm's reliance on mutable repository slugs rather than immutable IDs for trusted publishing configurations, enabling attackers to claim abandoned repository paths and publish malicious versions of legitimate packages without credential theft. The attack could lead to large-scale supply chain compromises, especially when combined with AI agents that automatically pull dependencies without human oversight. GitHub now expires unvalidated trusted publishing configurations after 48 hours and requires re-validation upon repository changes to mitigate the risk.

2w ago · hacker-news

SAP disclosed a critical CVSS 10.0 vulnerability, CVE-2026-89111, in its Cloud SDK for Python that allows server-side request forgery (SSRF), enabling attackers to steal OAuth2 client credentials from multi-tenant applications on SAP Business Technology Platform (BTP). The flaw occurs when an attacker controls the tenant subdomain passed to the SDK, which can result in the SDK sending the application's client ID and client secret to an attacker-controlled server. The vulnerability was introduced in version 0.45.2 and reappeared in versions 0.53.0 through 0.55.0 due to a missing validation check in shared token request code, with the fix reintroduced in version 0.55.1. Older versions in the 0.36 line, including 0.36.1 and 0.36.2, also lack the necessary validation.

2w ago · hacker-news

A threat actor tracked as UTA0576 exploited three zero-day vulnerabilities in Ivanti Connect Secure appliances to achieve root-level command execution without authentication. The attack chain combines an authentication bypass and remote code execution (CVE-2026-104935) with an unpatched privilege escalation flaw to gain full system access. The exploitation was observed in the wild starting October 3, 2026, on fully patched systems, indicating active targeting. The attacker exfiltrated LDAP credentials, performed password spraying, and avoided persistence mechanisms by re-executing the exploit for each command.

2w ago · hacker-news

Docker fixed a critical vulnerability, tracked as CVE-2026-105445, that existed in Docker Hub from August 26, 2024, until September 30, 2026. The flaw allowed a user to convert a personal account into an organization and transfer ownership of personal access tokens (PATs) to another user without consent or notification, enabling unauthorized access to repositories. This could allow an attacker to push, pull, or delete images under another user's identity, including publishing malicious images under legitimate names. Docker found no evidence of exploitation despite reviewing over 304,000 pushes, and the vulnerability was reported by researchers Peter Molnar and Krisztian Hozak of mptrdev.com, who named it GhostPat.

2w ago · hacker-news

Low-cost Android smartphones, primarily built on MediaTek platforms, have been found shipping with preinstalled malware named 'Midnight Mimosa' by Bitdefender. The malware, disguised as 'com.android.system.lite', runs with system-level privileges and enables remote operators to silently install and uninstall apps, conduct ad fraud, and turn devices into residential proxies. It communicates with external command-and-control servers to download additional payloads and has been linked to at least 13 apps on Google Play that exhibit similar behavior. The campaign has affected thousands of devices across over 150 countries, with a majority located in Mexico, and is believed to stem from a supply chain compromise involving firmware signed by Shenzhen Zediel Co., Ltd.

2w ago · hacker-news

GitLab has patched a critical vulnerability, CVE-2026-97229, with a CVSS score of 10.0, affecting its Community and Enterprise Editions. The flaw is an integer overflow issue that could allow unauthenticated users to execute arbitrary code on the GitLab server by exploiting insufficient validation of regular expressions in CI/CD configurations. The vulnerability impacts multiple versions prior to 19.4.2, 19.3.5, and 19.2.8, and users are urged to update immediately to remediate the risk.