Intelligence Feed

2w ago · hacker-news

A critical vulnerability, CVE-2026-15748, exists in the Forminator Forms WordPress plugin that allows unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution on vulnerable sites. The flaw affects all versions prior to and including 1.56.1 and stems from insufficient file type validation in the 'handle_file_upload()' function, which can be bypassed using alternative MIME types. Exploitation is possible when a form contains both a File Upload and a Select field, and custom upload directories without proper .htaccess protection increase the risk of successful code execution.

2w ago · hacker-news

A workflow injection vulnerability was discovered in Snowflake's public GitHub repository 'snowflakedb/snowflake-connector-net' that allowed a crafted GitHub issue to trigger command injection in a CI/CD pipeline. The vulnerable workflow (.github/workflows/jira_issue.yml) directly embedded untrusted issue data into a shell run block, exposing internal Jira credentials including an API token. Researchers from Wiz exploited the flaw during authorized testing, successfully retrieving the Jira API token, which granted read access to internal engineering and security projects. The vulnerability was introduced via a commit on August 25, 2025, and was fixed on June 23, 2026, after being reported via HackerOne; no evidence of external exploitation was found.

2w ago · bleeping-computer

A threat actor using the alias 'TheHatman' is selling alleged employee databases stolen from the Microsoft Azure environments of multiple Fortune 500 companies, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl. The actor claims to have obtained the data using compromised credentials, potentially via password spray and MFA fatigue attacks. The datasets reportedly include employee names, email addresses, job titles, phone numbers, addresses, service accounts, and tenant-specific Azure structures. While some companies like Tata and Gap have stated there is no evidence of a breach and that the data may be outdated, cybersecurity firm Hudson Rock has analyzed samples and confirmed the data contains authentic corporate directory attributes and could be used for social engineering or spearphishing.

2w ago · wiz

Wiz Research's AI-powered Red Agent discovered a critical script injection vulnerability in a GitHub Actions workflow within Snowflake's public repository snowflakedb/snowflake-connector-net. The vulnerability was introduced on June 18, 2026, via an AI-generated 'autofix' commit that removed safe input handling, allowing unauthenticated users to execute arbitrary commands by opening a maliciously titled GitHub issue. Wiz successfully exploited the flaw to exfiltrate Snowflake's Jira API token, which granted read access to internal engineering and security projects. Snowflake patched the workflow, rotated credentials, and confirmed no unauthorized access occurred beyond Wiz's testing.

2w ago · hacker-news

Multiple active threats were reported this week, including exploitation of critical vulnerabilities in VMware, Apple macOS, and GeoServer, as well as ongoing campaigns by state-linked actors. A suspected China-nexus APT exploited CVE-2026-59310 in VMware vCenter to deploy Babuk-derived ransomware, likely as a forensic distraction. The Lazarus Group leveraged a Windows zero-day (CVE-2026-68820) in a campaign dubbed Operation Dream Job, targeting aerospace and defense sectors. GeoServer faced active exploitation of a critical SQL injection flaw prior to patching. Additionally, new macOS malware Amnesia Stealer enables real-time browser hijacking via Chrome DevTools Protocol, stealing authenticated sessions and sensitive data.

2w ago · bleeping-computer

Certighost, tracked as CVE-2026-54121, is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to coerce an Enterprise Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller. This is achieved by exploiting a 'chase' functionality flaw where the CA follows attacker-supplied routing information without validating the target endpoint, enabling the attacker to forge identity data and obtain a certificate impersonating a Domain Controller. The attacker can then use PKINIT to obtain a Ticket Granting Ticket, perform DCSync to extract credentials including the krbtgt hash, and achieve full domain compromise. The vulnerability was patched by Microsoft on July 14, 2026, but the underlying risk stems from standing privileges like default MachineAccountQuota settings that allow unprivileged users to create machine accounts.

2w ago · hacker-news

SpecterOps has detailed a post-exploitation technique leveraging the Chrome DevTools Protocol (CDP) to hijack authenticated browser sessions in live Google Chrome or Microsoft Edge processes on Windows. The technique requires prior code execution and manipulates the running browser process to enable remote debugging via a Beacon Object File (BOF), allowing attackers to extract cookies, saved passwords, browsing history, and perform browser takeover. The method bypasses protections like App-Bound Encryption by operating within the victim's existing browser context, and relies on process injection into chrome.exe or msedge.exe, detectable via Sysmon Event IDs 8 and 10.

2w ago · hacker-news

The threat actor Mustang Panda, also known as HoneyMyte, has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit to enhance stealth. The rootkit, deployed as msagent.sys, is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. and enables hiding of malicious processes, files, registry entries, and C2 network activity. The malware is typically deployed after initial compromise via PlugX and uses DLL sideloading through a legitimate Sangfor executable to execute malicious components and establish persistence.

2w ago · hacker-news

Threat actor Sable Squirrel has spent nearly $7 million acquiring expired domains to exploit their inherited reputation, traffic, and backlinks for illegal sports streaming, online gambling promotion, and malware distribution. The group operates a dual-purpose infrastructure where re-registered domains serve both as streaming platforms and command-and-control (C2) servers for malware such as Quasar RAT and HiddenTear ransomware. The operation targets users in Asia and Australia through social media and ad networks, using a traffic distribution system to redirect victims while evading detection. Additional scavenger actors like Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel are also abusing expired domains for ad fraud, tech support scams, and traffic resale.

2w ago · hacker-news

A critical authentication vulnerability in Apple macOS Screen Sharing, tracked as CVE-2026-65400 (CVSS 9.8), is under active exploitation to deploy Monero cryptominers on internet-exposed Mac systems. The flaw allows unauthorized remote authentication to the Screen Sharing service without valid credentials, enabling attackers to gain root access and install malware. The Netherlands NCSC reported confirmed attacks where systems with port 5900 exposed were compromised. Apple has released emergency patches in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. A separate but related pre-authentication flaw in the same component was also patched, both residing in the same codebase and exploitable with minimal effort.

2w ago · hacker-news

A critical vulnerability in SAP Commerce Cloud, tracked as CVE-2026-58231 and rated 10.0 on the CVSS scale, is being actively exploited just days after the patch was released. The flaw stems from insufficient authorization checks and input validation, allowing unauthenticated attackers to execute arbitrary code and compromise internal components. Exploitation attempts were detected by Defused Cyber on honeypot systems three days post-patch, despite the absence of a public proof-of-concept. SAP customers are urged to patch immediately or apply IP filtering as a temporary mitigation.

2w ago · hacker-news

A suspected China-nexus advanced persistent threat (APT) has exploited CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter, to gain remote code execution and deploy a Babuk-derived ransomware. The attackers used the flaw to execute arbitrary code as root, deploy backdoors such as 'linuxFile', establish persistence via cron and systemd, and create malicious accounts. The campaign targeted 361 unique IP addresses across 47 countries, with evidence of operational patterns aligned with the UTC+08:00 timezone and use of Chinese-language tools and artifacts.

2w ago · hacker-news

Security researchers at SSD Secure Disclosure disclosed a two-stage exploit chain that enables full Android kernel access on devices using Unisoc modem firmware via a VoLTE video call. The chain begins with a remote code execution vulnerability in the modem firmware (disclosed in March 2026), followed by a privilege escalation exploit that leverages improper isolation of shared resources (CWE-1189) to gain kernel-level access. The attacker must control a private 4G network and trick the victim into answering a video call. No CVE has been assigned, and no patch is available from Unisoc or device manufacturers. The vulnerability affects multiple Unisoc chipsets used in Motorola, Realme, and Xiaomi devices.

2w ago · bleeping-computer

The Clop ransomware gang is conducting data theft attacks against organizations using PTC Windchill and PTC FlexPLM platforms, exploiting a critical vulnerability, CVE-2026-12569, that allows improper input validation. Companies including Philips, General Electric (GE), and Shell have confirmed they are investigating or have confirmed breaches. The attackers deploy JSP webshells to exfiltrate sensitive data such as project plans, blueprints, and internal backups. The U.S. CISA and Germany's BSI have issued urgent warnings, mandating immediate patching due to active exploitation in the wild.

2w ago · bleeping-computer

Microsoft is actively working on a security patch for a newly disclosed zero-day vulnerability in Microsoft Defender named 'ShieldBreak', tracked as CVE-2026-69414. The vulnerability, disclosed by security researcher Nightmare Eclipse, allows local attackers with limited privileges to escalate to SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit acts as a bypass for the previously patched RoguePlanet vulnerability (CVE-2026-50656), indicating an incomplete fix. Microsoft has acknowledged the issue but has not yet released a patch, while the researcher has publicly released a proof-of-concept exploit due to an ongoing dispute over disclosure practices.

2w ago · bleeping-computer

The French Ministry of the Economy and Finance disclosed a data breach affecting 678,000 individuals after a threat actor using the handle 'ZeroBytes' claimed responsibility and listed a stolen database for sale on the PwnForums hacking forum on August 12, 2026. The attacker accessed the General Directorate of Public Finances (DGFiP) systems, extracting sensitive tax and cadastral data, including reference tax income, family quotient, withholding tax rate, company names, SIREN numbers, and property records. Access to sensitive systems was shut down, and the incident is under investigation with support from ANSSI, though user credentials were not compromised.

2w ago · bleeping-computer

Cryptocurrency hardware wallet provider SafePal suffered a data breach affecting approximately 39,798 customers due to an authorization flaw in an order-tracking plugin, which allowed unauthorized access to customer order information. The exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details, but not wallet seed phrases, private keys, or payment information. A threat actor is now claiming to sell the stolen data on a cybercrime forum, and customers have reported receiving phishing emails and phone calls impersonating SafePal, warning of a firmware vulnerability in the X1 device to trick users into compromising their wallets.

2w ago · bleeping-computer

Threema, a secure messaging service, was disrupted by large-scale distributed denial-of-service (DDoS) attacks that targeted both its infrastructure and its colocation partner, Nine. The attacks caused intermittent outages and service degradation for users in Switzerland, India, and China, despite internal status pages showing normal operations. The threat actor continuously changed attack patterns, making mitigation difficult, and an unrelated technical issue prevented timely status updates. Threema has since implemented specialized upstream DDoS protection to reduce future impact.

2w ago · bleeping-computer

AmnesiaStealer is a macOS-targeting information-stealing malware distributed via ClickFix campaigns using fake GitHub download pages. It steals browser profiles, passwords, cryptocurrency wallets, Apple Notes, keychain data, and documents. A key capability is its 'stream_module' component, which enables remote operators to control a headless browser instance loaded with the victim's cloned Chromium profile, allowing interactive access to authenticated web sessions via WebSocket-based remote control. This provides attackers with live screencast access and full input control (keyboard, mouse) over the victim's active sessions.

2w ago · security-com

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducts parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web. The group targets government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises, while simultaneously running a for-profit crypto fraud scheme targeting Chinese-speaking users. Their primary malware includes the Antino Windows backdoor and a malicious 'PDF Viewer' browser extension, both deployed via fake software installers and HTA downloaders. The group leverages compromised hosting providers to scale attacks, stealing over 580,000 browser cookies and more than one million implant check-ins in under three months.

3w ago · talos

Microsoft's August 2026 Patch Tuesday addresses 421 vulnerabilities across various products, including 62 labeled as 'critical'. One actively exploited vulnerability, CVE-2026-68820, is an elevation of privilege issue in the Windows Ancillary Function Driver for WinSock. Multiple remote code execution vulnerabilities are present in Windows, SharePoint, Office, Azure, and other Microsoft services, with several rated high or critical severity. Cisco Talos has released Snort rules to detect exploitation attempts against some of these vulnerabilities, emphasizing those deemed more likely to be exploited, such as CVE-2026-62893 in Windows Deployment Services and CVE-2026-65665 in SharePoint Server.

2w ago · bleeping-computer

Evooo1Bot is a new Mirai-based modular Linux botnet targeting internet-facing routers and gateway devices to turn them into SOCKS5 traffic relay nodes. It exploits known vulnerabilities in devices from vendors including Alcatel, NETGEAR, Tenda, and D-Link, and includes capabilities such as SSH brute-forcing, credential sniffing, DDoS attacks, and encrypted C2 communications over port 443. The malware performs anti-analysis checks, establishes persistence via multiple methods, and supports file transfer and interactive shell access for remote control by attackers.

3w ago · securelist

In Q2 2026, mobile threats continued to evolve with a notable presence of banking Trojans, particularly variants of Mamont and Creduz. Attackers increasingly used malicious loaders distributed through Google Play, including trojanized apps like a PDF reader and the Cleanova app, to deliver banking malware such as Anatsa. These loaders employed sophisticated evasion techniques, including conditional payload delivery based on installation source telemetry, to bypass app store reviews and target specific users.

2w ago · socket-dev

A large-scale malicious Chrome extension campaign involving 737 extensions has been identified, primarily targeting Russian-speaking users seeking access to blocked services like Instagram and YouTube. These extensions impersonate 66 legitimate VPN brands—including Proton VPN, NordVPN, and AmneziaVPN—and route all browser traffic through attacker-controlled SOCKS5 proxies on port 1082, enabling man-in-the-middle attacks. The campaign uses DNS-over-HTTPS for evasion, falsely advertises premium server locations that do not exist, and employs post-approval code substitution to bypass store review. One threat actor behind the operation runs a subscription-based business under the name 'Myxa VPN', which also sells access to the malicious extensions.

2w ago · bleeping-computer

The Netherlands' National Cyber Security Centre (NCSC) has issued a warning that attackers are actively exploiting a macOS Screen Sharing vulnerability, CVE-2026-65400, to gain unauthorized access to systems with exposed port 5900. The flaw allows network-based attackers to bypass authentication and obtain root access without valid credentials. In confirmed attacks, the threat actors have deployed Monero cryptocurrency miners on compromised systems. Apple has patched the vulnerability in recent macOS updates, including Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

2w ago · bleeping-computer

A critical remote code execution vulnerability, CVE-2026-58231, in SAP Commerce Cloud is being actively exploited in the wild just three days after the patch was released. The flaw, which has a CVSS score of 10.0, stems from improper authorization in the Data Hub Adapter extension, allowing unauthenticated attackers to execute arbitrary code by exploiting a default authentication client. Threat intelligence firm Defused confirmed exploitation attempts are already occurring, as observed through honeypot traffic, despite the absence of a public proof-of-concept. The vulnerability affects internet-exposed SAP Commerce Cloud instances, with over 4,200 such systems identified globally, primarily in Europe and North America.

2w ago · bleeping-computer

The Clop ransomware gang claimed responsibility for stealing 89GB of data from energy giant Shell, allegedly exploiting a critical vulnerability, CVE-2026-12569, in Internet-exposed PTC Windchill and FlexPLM instances. The same vulnerability was actively exploited to target other major companies, including General Electric and Philips, with attackers deploying JSP webshells to exfiltrate sensitive data such as engineering drawings, project plans, and facility reports. U.S. CISA and German BSI issued urgent advisories urging immediate patching, and the flaw has been added to CISA's Known Exploited Vulnerabilities catalog.

2w ago · bleeping-computer

In July 2026, the ShinyHunters extortion group breached RingCentral through a sophisticated social engineering campaign, exfiltrating personal information from 1.6 million customer accounts. The stolen data included names, email addresses, phone numbers, and physical addresses. After RingCentral refused to pay a ransom, ShinyHunters leaked a 280GB compressed archive of the stolen data on their dark web leak site. The breach did not impact RingCentral's core platform, and no further unauthorized activity has been observed since remediation efforts were implemented.

2w ago · securelist

The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with a kernel-mode Windows rootkit to enhance stealth and persistence. The new variant uses a signed kernel driver, msagent.sys, deployed as a Windows service to hide malicious processes, files, registry keys, and network connections. The malware chain begins with DLL sideloading via a renamed Sangfor executable (defender.exe), establishes persistence through scheduled tasks and registry entries, performs UAC bypass using RPC techniques, and injects into synchost.exe before deploying the driver. The driver communicates with user-mode components via IOCTLs and employs minifilter and registry callbacks to protect its artifacts.

2w ago · securelist

In May 2026, the Armored Likho (aka Eagle Werewolf) threat actor group expanded its cyber-espionage operations targeting individuals and organizations in Russia through a fake donation app dropper written in Rust using the Tauri framework. The campaign delivers a new Rust-based toolkit called Still Toolkit, consisting of two components: Still Sync, which steals Telegram session data and exfiltrates chat logs and media via the Telegram API, and Still Audio, an audio surveillance implant that records microphone input when voice activity is detected. The malware uses gRPC and FlatBuffers for C2 communication, leverages the SeBackupPrivilege for file access, and employs a Dead Drop Resolver via a GitHub repository to retrieve updated C2 addresses.