Intelligence Feed

3w ago · bleeping-computer

Atlassian has disclosed a critical arbitrary file-access vulnerability, CVE-2026-21589, affecting multiple self-hosted Data Center products including Confluence, Jira, Bitbucket, and others. The flaw allows unauthenticated attackers to read specific files within the web root directory if they know the exact file path, though directory enumeration is not possible. Atlassian has released patches for all affected products and recommends immediate updates, with temporary mitigations such as WAF rules or access restrictions for environments unable to patch promptly. There is no current evidence of active exploitation, but customers are urged to review logs and secure self-hosted instances.

3w ago · bleeping-computer

Hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins to install backdoors and create rogue administrator accounts. The vulnerabilities, CVE-2026-93836 and CVE-2026-94504, require authenticated access and have been exploited since October 4, 2026. A malicious JavaScript payload delivered from imgcdn1[.]com executes in the context of logged-in administrators, deploying a malicious plugin named 'WP Smart Thumbnails' and establishing multiple persistence mechanisms, including hidden admin accounts and secret login URLs. The same threat actor is linked to both campaigns due to identical payloads.

3w ago · hacker-news

A critical path traversal vulnerability, CVE-2026-21589, affects 8 self-hosted Atlassian Data Center products, allowing unauthenticated attackers to read specific files in the web application root directory if they know the exact filename and path. The vulnerability is rated 9.3 on the CVSS v4.0 scale due to its network accessibility and high confidentiality impact. Atlassian has released fixed versions for affected Data Center products and applied patches to its cloud instances, while advising self-hosted customers to either upgrade or implement temporary mitigations such as WAF rules or Tomcat rewrite rules to block malicious URL patterns containing '..' adjacent to path separators.

3w ago · hacker-news

A vulnerability in LibreOffice and Apache OpenOffice allows malicious spreadsheets to execute arbitrary code without macro warnings by leveraging Java-based database drivers. The attack abuses legitimate features like database ranges and JDBC drivers, automatically downloading and executing a malicious JAR file when the document is opened. While LibreOffice has patched the issue (CVE-2026-63277), Apache OpenOffice remains vulnerable (CVE-2026-59265) in all versions up to 4.1.16. Users are advised to disable Java support or avoid untrusted spreadsheets until updates are available.

3w ago · bleeping-computer

Japanese media conglomerate Nikkei disclosed two separate breaches involving employee email accounts. In late July 2026, an attacker accessed a Google Workspace account, exposing personal information of 1,646 employees and business partners. In September 2026, another employee's Microsoft 365 account was compromised and used to send approximately 9,000 phishing emails to internal staff and interviewees. The malicious emails contained links to malicious websites, prompting Nikkei to reset passwords and notify affected recipients. The company has not attributed the attacks to any specific threat actor or confirmed if the incidents are related.

3w ago · step-security

On October 5, 2026, a malicious version of the npm package @subql/common@5.8.3 was discovered containing a hidden payload that steals credentials and enables remote shell access. The backdoor activates during installation or import, targeting developer workstations and CI environments such as GitHub Actions runners. The package downloads malicious artifacts from ci-artifacts.dev, collects sensitive files and environment variables, attempts cloud and Kubernetes secret exfiltration, and can inject malicious GitHub Actions workflows to further propagate. The attacker used a temporary GitHub branch with two commits to publish the compromised version, obfuscating the payload through multiple encryption layers.

3w ago · hacker-news

A critical vulnerability, CVE-2026-61500, in Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 is under active exploitation, enabling attackers to forge administrator session cookies and achieve remote code execution. The flaw stems from the use of a predictable pseudo-random number generator (Math.random()) for session-cookie signing keys, which can be reconstructed by unauthenticated attackers through login responses. A proof-of-concept exploit was publicly released by researcher Alejandro Ramos (aramosf), and exploitation attempts have been observed, including by an unnamed threat actor based in China targeting U.S. systems. The vulnerability follows previous exploitation of another Rejetto HFS flaw, CVE-2024-23692, which was used to deploy cryptocurrency miners and malware such as HATVIBE.

3w ago · hacker-news

Multiple critical zero-day vulnerabilities were exploited in the wild this week, including CVE-2026-88779 in Citrix NetScaler ADC and Gateway, and CVE-2026-104286 in Fortinet FortiMail, both allowing remote code execution or arbitrary file writes. Russian state-sponsored group Star Blizzard deployed a new malware delivery technique called RedFlick to install the CosmicPulse backdoor via phishing. A Chinese-linked post-compromise malware, NeedyMantis, has been used in targeted operations since October 2025. Additionally, law enforcement disrupted the KillSec ransomware group and arrested members of ShinyHunters. A new Spectre v2 variant, BTR, enables rapid extraction of Linux root password hashes on Intel systems.

3w ago · hacker-news

Microsoft disclosed a high-severity vulnerability, CVE-2026-96940, in on-premises Microsoft Exchange Server that allows authenticated attackers to escalate privileges and access other users' mailboxes within the same organization. The flaw stems from weak authorization controls and has been rated 8.8 on the CVSS scale. Although no active exploitation has been observed, Microsoft considers exploitation likely and has issued out-of-band updates for affected versions. Exchange Online has been mitigated via a server-side fix and does not require customer action.

3w ago · bleeping-computer

Anibal Alexander Canelon Aguirre, also known as 'Prometheus' and 'The Engineer,' was arrested and appeared in U.S. court for allegedly developing Ploutus malware, which enabled ATM jackpotting attacks across the United States. Between February 2024 and December 2025, these attacks targeted banks and credit unions in 47 states and the District of Columbia, stealing over $5.4 million in confirmed incidents and attempting to steal an additional $1.4 million. The malware included anti-analysis and self-deletion capabilities to evade detection and forensic investigation. Canelon Aguirre and his co-conspirators laundered the proceeds and transferred them to accounts controlled by the Tren de Aragua (TdA) Venezuelan gang, a designated transnational criminal organization and foreign terrorist organization.

3w ago · bleeping-computer

Dell has disclosed a critical vulnerability in its System Update (DSU) command-line interface tool, tracked as CVE-2026-86360, which allows unauthenticated remote attackers to exploit a path traversal weakness and execute arbitrary code with root privileges. The flaw affects Linux and Windows systems used in PowerEdge enterprise server infrastructure. Dell recommends updating DSU to version 2.3.0.0 or later to mitigate the issue. The company also patched four high-severity flaws in DSU and two maximum-severity vulnerabilities in Container Storage Modules (CSM). While no active exploitation has been confirmed, state-backed groups like Lazarus and UNC6201 have previously exploited Dell vulnerabilities.

3w ago · bleeping-computer

Hackers are actively scanning for a critical remote code execution (RCE) vulnerability, CVE-2026-61500, in Rejetto HFS (HTTP File Server) instances. The flaw stems from a weak session-cookie signing key derived from JavaScript's Math.random() generator, which is also leaked to unauthenticated clients, enabling attackers to reconstruct the key and forge administrator session cookies. Successful exploitation allows full administrative access and remote code execution via server-side JavaScript execution. Probing activity has been observed from a single China Telecom IP address targeting systems in Japan and the United States, likely for reconnaissance ahead of broader exploitation.

3w ago · hacker-news

A high-severity zero-day vulnerability, CVE-2026-88779, in Citrix NetScaler ADC and NetScaler Gateway is being actively exploited in targeted attacks to cause denial-of-service conditions on SAML-enabled deployments. The flaw is a memory overflow issue that can be triggered when the appliance is configured as a SAML service provider or identity provider. Citrix has released patches for affected versions, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 7, 2026. No data integrity impact has been observed, but repeated exploitation can render services unavailable.

3w ago · bleeping-computer

Citrix has released emergency patches for a zero-day vulnerability, CVE-2026-88779, affecting NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled. The flaw, which stems from a memory buffer issue, has been exploited in active attacks to cause denial-of-service conditions, with evidence suggesting potential for remote code execution. Researchers and administrators have observed malicious activity, including shell command injection in authentication attempts and crashes of the nsaaad and Pitboss processes. A specific IP address, 213.209.159.55, has been linked to payload delivery, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 7.

4w ago · hacker-news

China-aligned threat actor TA419 has conducted credential phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and legal organizations since at least April 2025. The attacks involve impersonation of trusted individuals and use a multi-stage phishing flow featuring shortened URLs that redirect to a malicious OneDrive-based adversary-in-the-middle (AitM) page. This page employs a 'Frameless BitB' technique—using HTML, CSS, and JavaScript without iframes—to spoof Microsoft login pages and stealthily capture session cookies while relaying authentication to legitimate Microsoft infrastructure, making detection difficult.

4w ago · hacker-news

ShinyHunters, a prolific cybercriminal group known for data breaches and extortion, is under increased law enforcement pressure following the reported detention of a key suspect, Saif al-Din Khader (alias Rey/ReyXBF), in Jordan. Khader, allegedly a former administrator of BreachForums and Scattered LAPSUS$ Hunters, is cooperating with the FBI to identify other group members. The group has been linked to over 140 breaches and $70 million in extortion payments, recently exploiting a Grav CMS vulnerability to hijack the Cl0p ransomware group's darknet site and breaching the FBI’s job portal, stealing approximately three terabytes of data. ShinyHunters claims the FBI breach was not financially motivated but intended to challenge false allegations and their alleged ties to The Com cybercrime collective.

4w ago · hacker-news

The China-linked threat actor Warlock, also known as Longlegs or Gold Salem, is actively exploiting vulnerabilities in on-premises Microsoft SharePoint Server deployments to gain initial access, deploy web shells, and achieve remote code execution. The group targets organizations in Portuguese- and Spanish-speaking countries, including critical infrastructure, government, and education sectors. After gaining access, Warlock uses DLL sideloading, legitimate cloud storage services for payload delivery, and the BYOVD technique with a vulnerable driver to disable security tools. The attackers then deploy ransomware at scale by staging payloads in the SYSVOL share and leveraging living-off-the-land techniques such as VS Code tunnels for persistence and lateral movement.

4w ago · bleeping-computer

A suspected member of the ShinyHunters hacking group, known online as 'Rey' and identified as Saif al-Din Khader, has been reportedly detained in Jordan and is cooperating with the FBI. The ShinyHunters group claimed responsibility for breaching FBI systems via an alleged Oracle PeopleSoft zero-day vulnerability, later moving laterally into AWS GovCloud environments and exfiltrating 2–3TB of sensitive data. The group has been linked to multiple high-profile breaches, including attacks on Google, Cisco, Instructure Canvas, and Jaguar Land Rover, often exploiting third-party integrations and stolen authentication tokens. Following recent arrests and detentions, ShinyHunters-linked infrastructure showed signs of disruption, including the temporary takedown of their data leak site, though a new site later emerged indicating ongoing operations.

4w ago · bleeping-computer

The Technical University of Denmark (DTU) suffered a data breach in which an attacker used compromised credentials to access DTUBasen, its identity and access management system, and exfiltrated a large volume of user data. The breach potentially exposed personal information of up to 200,000 individuals, including current and former students, employees, guests, and external partners, with data dating back to 2003. Exposed information includes Danish civil registration numbers (CPR), names, home addresses, job titles, office locations, next of kin details, and profile pictures. DTU warns that the stolen data could be used for identity fraud and highly targeted phishing attacks.

4w ago · socket-dev

Socket discovered a cluster of malicious and high-risk VS Code extensions linked to the GlassWorm supply chain campaign, spanning both the Visual Studio Marketplace and Open VSX. Two confirmed malicious extensions—Aurora Nocturne Night Theme and Cosmic Nebula Themes—were found to deploy JavaScript-based malware loaders that execute obfuscated code, exfiltrate data, and dynamically resolve follow-on payloads via Solana blockchain transaction memos. The threat actor used deceptive tactics including brandjacking, code obfuscation, and Git history manipulation to distribute malicious themes. The campaign avoids Russian systems and has reused infrastructure, code patterns, and publisher identities across multiple extensions, indicating coordinated activity. Although some extensions are no longer weaponized, they retain dangerous executable capabilities and are assessed as high-risk due to their development lineage.

4w ago · step-security

A supply chain attack has compromised specific versions of the @memtensor/memos-cloud-openclaw-plugin npm package (0.1.21, 0.1.23, 0.1.25) and the MemoryOS PyPI package (version 2.0.34). The malicious releases include a hidden launcher that executes a credential-harvesting payload during plugin initialization or import, potentially capturing environment variables, prompts, and secrets. The payload targets developer environments by harvesting credentials for cloud platforms, source control, package registries, and AI services, and exfiltrates data to attacker-controlled domains. The attack includes multiple stages, including a TLS trust fallback, embedded configuration with expiration, and a conditional CI delivery mechanism designed to propagate further compromises.

4w ago · talos

Cisco Talos identified a threat actor group, UAT-11587, linked to China, targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia. The campaign delivers a previously undocumented backdoor named 'Antino', identified from developer artifacts. The actors are using targeted malware deployments, with specific malicious files observed in telemetry. This activity represents a focused espionage effort against high-value geopolitical targets.

4w ago · bleeping-computer

Frontline Education suffered a data breach in August 2026 after attackers exploited a vulnerability in a third-party software product, leading to unauthorized access to employee data. The compromised information includes Social Security numbers, email addresses, and physical addresses of school district employees. The company has not disclosed the specific third-party application involved or the exact timeline of the breach, but is offering affected individuals two years of credit monitoring and identity theft protection through TransUnion.

4w ago · hacker-news

Dell has disclosed multiple critical vulnerabilities in its Container Storage Modules (CSM) affecting versions prior to 1.17.0, which were patched in version 1.18.0. The most severe flaws include CVE-2026-63688 and CVE-2026-63692, both with a CVSS score of 10.0, enabling unauthenticated remote attackers to gain administrative access to storage infrastructure and Kubernetes clusters. Exploitation of these vulnerabilities could allow full control over storage systems, privilege escalation to root, and unauthorized manipulation of access policies across tenants.

4w ago · hacker-news

A China-nexus threat actor tracked as UAT-11587 has been conducting a cyber espionage campaign since September 2025, targeting government and policy organizations across Asia and Syria. The campaign uses a previously undocumented Rust-compiled Windows backdoor named Antino, which leverages Microsoft 365 services—specifically Outlook and OneDrive—for command-and-control (C2) communications. Initial access is achieved via spear-phishing emails with spoofed sender identities and a fake Gmail attachment preview widget, leading to a multi-stage infection chain culminating in the deployment of the Antino backdoor using DLL sideloading.

4w ago · hacker-news

GitLab has patched a critical vulnerability, CVE-2026-90970, in its self-hosted AI Gateway that could allow a logged-in user with access to the Duo Agent Platform to execute arbitrary commands on the gateway via a crafted custom flow configuration. The flaw, rated 9.9 on the CVSS scale, stems from a prompt template sandbox escape in the AI Gateway's custom flow feature. Organizations hosting their own AI Gateway instances are advised to update immediately to fixed versions 19.2.4, 19.3.2, or 19.4.1, as no workaround is available and exploitation could lead to command execution on the underlying system.

4w ago · bleeping-computer

Dell has patched two maximum severity vulnerabilities in its Container Storage Modules (CSM) that affect enterprise storage integration with Kubernetes environments. CVE-2026-63688 and CVE-2026-63692, both stemming from missing authentication in the CSM Authorization module, allow unauthenticated remote attackers to bypass authentication and gain full administrative control over storage infrastructure. Dell advises immediate upgrade to CSM version 1.18.0 or later to mitigate these critical risks. Additionally, four other critical vulnerabilities were patched, enabling privilege escalation, token forgery, and unauthorized access to Kubernetes secrets.

4w ago · bleeping-computer

The U.S. Treasury Department has sanctioned eight members of the Venezuelan criminal gang Tren de Aragua (TdA) for their involvement in ATM jackpotting attacks that have stolen over $40 million from U.S. financial institutions. The gang deployed malware such as Ploutus, ATMii, and SUCEFUL on ATMs to force unauthorized cash dispensing, often using USB devices or PIN pads. Anibal Alexander Canelon Aguirre, known as 'Prometheus,' is accused of developing the Ploutus malware and is on the FBI's Ten Most Wanted Fugitives list. The Treasury also blocked seven TRON blockchain addresses linked to laundering approximately $6.1 million from the attacks.

4w ago · bleeping-computer

GitLab has disclosed a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-90970, in its AI Gateway service that affects self-hosted instances. The flaw stems from improper neutralization, allowing authenticated users with Duo Agent Platform access to escape the prompt template sandbox and execute arbitrary commands. GitLab has released patched versions 19.2.4, 19.3.2, and 19.4.1 for Self-Hosted AI Gateway users, urging immediate updates. Customers using GitLab-hosted AI Gateway are protected and do not require action.

4w ago · hacker-news

A critical zero-day vulnerability, CVE-2026-104286, in Fortinet FortiMail has been actively exploited in the wild, allowing unauthenticated attackers to perform arbitrary file writes via path traversal and NULL byte injection. The flaw affects multiple versions of FortiMail, and CISA has added it to its Known Exploited Vulnerabilities catalog. Fortinet has provided workarounds, including disabling the IBE feature and restricting management interface access, while patches are pending for some versions. Indicators of compromise include specific malicious IP addresses and file modifications on affected systems.