Intelligence Feed

1w ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. CVE-2026-110447 is a command injection flaw in Collabora Online’s Built-in CODE Server used within Nextcloud, allowing remote code execution via a proxy.php endpoint when the document server is offline. Threat actors have exploited this vulnerability to deploy web shells on Nextcloud servers for reconnaissance and credential harvesting. CVE-2026-114625 is a critical SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator instances, exploitable by authenticated attackers with read-only access, enabling access to privileged internal functionality. Arista confirmed active exploitation and identified two malicious IP addresses linked to the attacks, both geolocated to Japan.

1w ago · hacker-news

Between November 2025 and March 2026, Dutch security firm Eye Security conducted Operation IXIM, pushing over 2 million updates to disable a vulnerable updater in the abandoned Time4Popcorn application, which could have been exploited to create a large-scale botnet. The updater, running with SYSTEM/root privileges, fetched updates over unencrypted connections without authentication, making it susceptible to remote code execution. The vulnerability, tracked as CVE-2026-30612, affected Windows, Mac, and Android versions of the app and allowed any actor who registered abandoned domains to push malicious payloads. Eye Security mitigated the threat by registering the domains and pushing a disabling update, later transferring control to the Shadowserver Foundation.

1w ago · hacker-news

An unrevoked master key from LiteLLM's Agent Platform, accidentally exposed in a public GitHub repository in May 2026, was exploited by an attacker on October 10, 2026, to gain access to the organization's GitHub CLI OAuth token with owner-level privileges. The attacker used this access to hijack the release pipeline, publish a malicious version of the LiteLLM Python package (1.107.0) to PyPI, and exfiltrate sensitive credentials via malicious GitHub Actions workflows. The compromised package executes automatically at Python startup, enabling credential theft and backdoor execution, even if LiteLLM is not explicitly imported.

1w ago · hacker-news

A critical memory-corruption vulnerability in Google's Brotli decoder, tracked as CVE-2026-11147, affects multiple widely used software platforms including Node.js, Bun, Python (via Brotli and brotlicffi packages), Envoy, Istio, and cdxgen. The flaw allows attackers to trigger buffer overflows via crafted Brotli-compressed data, potentially leading to remote code execution, memory leaks, or crashes. Imperva demonstrated a working exploit on unpatched Node.js, named Node2Shell, achieving remote code execution on Linux ARM64, though no in-the-wild exploitation has been observed. The vulnerability stems from unpatched code in the Brotli C library that went unfixed in releases for months despite being addressed in source code in February 2026.

1w ago · hacker-news

Threat actors are actively attempting to exploit the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai botnet variant called Potassium. Despite millions of exploit attempts observed globally, no successful remote code execution has been confirmed, suggesting attackers are struggling to reliably weaponize the flaws. The attacks involve scanning, fingerprinting, and payload delivery attempts using infrastructure tied to multiple IP addresses and a C2 server at 134.199.154[.]64. The Potassium malware is designed to conduct DDoS attacks and includes advanced features such as ENS-based C2 resolution and ChaCha20-encrypted configuration. A Python-based 'one-click' exploit tool named aslr_exploit.py has been found on an attacker-controlled server, indicating ongoing development of reliable exploitation methods.

1w ago · hacker-news

Security firm V12 identified three critical flaws in the x402 SDKs used by AI agents to make automated API payments, including a missing spending limit in the default client that could allow malicious APIs to drain an agent's token balance. The TypeScript SDK also accepted Solana token approvals as valid payments, enabling a complete payment bypass, while a flaw in the Sign-In-With-X (SIWx) feature allowed malicious servers to obtain valid login signatures for other websites. All three flaws were patched in releases on August 18, but no public security advisory was issued, and package managers like npm and PyPI did not list the fixes as security updates, leaving developers unaware of the risks.

1w ago · hacker-news

Security researchers at Imperva demonstrated a remote code execution (RCE) exploit named 'Node2Shell' targeting a vulnerability in the Brotli decoder bundled with Node.js. The exploit leverages crafted Brotli-compressed data to trigger an out-of-bounds write, leading to code execution in unpatched versions of Node.js 22.x, 24.x, and 26.x. The vulnerability, tracked as CVE-2026-111497, was patched in Node.js 24.22.1 and other updated releases, with no known in-the-wild exploitation observed as of October 22, 2026.

1w ago · hacker-news

A critical vulnerability in the Python Pillow library, CVE-2026-112900, allows remote code execution by exploiting how Pillow handles EPS file names when processing images with Ghostscript. The flaw can be triggered by an attacker-controlled filename, not the file content, making upload endpoints that use user-provided filenames particularly vulnerable. Multiple other critical and high-severity flaws were also patched in Pillow 13.0.0, including memory buffer overflows in JPEG and TIFF processing that could lead to crashes or code execution under certain conditions. These vulnerabilities affect all Pillow versions prior to 13.0.0, which is now required to mitigate the risks.

1w ago · hacker-news

Russia-linked threat actor UAC-0099, also known as Earth Sirrush, conducted a spear-phishing attack against a Ukrainian logistics company in July 2025, deploying the MATCHBOIL downloader and subsequently the MATCHWOK backdoor. A novel backdoor named MythicRatatoskr was deployed, which communicates via the Yggdrasil mesh network, enabling stealthy command-and-control. UAC-0099 later handed access to Sandworm, which executed a destructive data-wiping attack in September 2025 using SDelete distributed via Group Policy, highlighting collaboration between Russian-aligned groups.

1w ago · hacker-news

PHP has disclosed an unpatched remote code execution (RCE) vulnerability, CVE-2026-115560, affecting systems with a specific and uncommon configuration involving session upload progress and dynamic changes to session.serialize_handler. The vulnerability arises when applications change the session handler to 'php' at runtime via ini_set() before session_start(), while session.upload_progress.enabled is still active. Although no exploitation has been observed, PHP recommends disabling session.upload_progress.enabled as a mitigation until a fix is included in the next routine release. This follows emergency patches for two critical PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619), which are already under active exploitation.

1w ago · hacker-news

A threat actor known as k0t, also operating under aliases CryptoFeel, Member19, and QazWsxShop, has conducted a large-scale campaign targeting exposed Fortinet and Palo Alto Networks firewall and VPN devices globally. The actor exploited known vulnerabilities CVE-2025-64446 and CVE-2026-0257 using custom Python scripts, performed brute-force attacks, and established persistent access via legitimate remote tools like MeshCentral Agent and AdaptixC2. Over 70,000 credentials were exposed through data exfiltration to Wasabi S3 and MEGA cloud storage, with victims spanning multiple sectors and regions, particularly in Asia Pacific and Latin America.

1w ago · hacker-news

Ransomware affiliates linked to the INC and The Gentlemen groups have been using an AI-driven intrusion framework called Phantom to automate and scale attacks. The operation leverages commercial AI models via OpenCode and OpenRouter, with human operators approving actions, to exploit vulnerabilities in public-facing systems such as FortiClient, SimpleHelp, cPanel, and SonicWall. The attackers achieve initial access, move laterally using tools like RevSocks and Ghost C2, escalate privileges, exfiltrate sensitive data, and prepare for ransomware deployment. At least 62 organizations were targeted, primarily in the U.S. and within industrial, healthcare, and energy sectors.

1w ago · hacker-news

Ruby has released updated versions (4.0.9, 3.4.12, and 3.3.13) to address three critical bugs in its Onigmo regular expression engine, which were exploited to enable remote code execution (RCE) in GitLab. The vulnerabilities stem from memory corruption during regex compilation when processing attacker-controlled input, affecting any Ruby application that compiles untrusted regular expressions. Four critical CVEs were issued by GitLab, two of which (CVE-2026-97229 and CVE-2026-110264) are rated 10.0 and exploitable without authentication, impacting all GitLab versions since 7.0. Although Ruby did not assign its own CVEs, it directed users to track the issues via GitLab's advisories.

1w ago · hacker-news

A sophisticated UEFI bootkit named BlackX has been used to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan, in early 2026. The bootkit exploits the CVE-2022-21894 vulnerability (Baton Drop) to bypass Secure Boot, even on patched systems that have not applied manual revocation updates. The attack is attributed to the China-linked APT41 group, leveraging techniques similar to the BlackLotus bootkit. The malware installs a malicious driver signed with a revoked certificate and deploys espionage payloads, including a .NET-based remote access trojan and a Rust-based DLL sideloaded via googleupdate.exe that communicates with 'archivetj[.]com'.

1w ago · hacker-news

A critical vulnerability in OpenCode versions 1.0.137 through 1.18.32 allows a malicious or compromised MCP (Model Context Protocol) server to execute arbitrary code on a developer's Windows or WSL machine during sign-in. The flaw arises because OpenCode passes an untrusted OAuth authorization endpoint URL from the MCP server to a browser helper without proper escaping, leading to command injection via PowerShell on Windows. The vulnerability was fixed in version 1.18.33, but no CVE was assigned, and it remains unflagged by vulnerability scanners. Although no active exploitation has been observed, the risk persists for unpatched installations connected to untrusted MCP servers.

1w ago · hacker-news

Railway, a Platform-as-a-Service provider, disclosed an incident where an unauthorized third party may have accessed encrypted customer environment variables and, in some cases, obtained decrypted contents. The breach potentially allowed attackers to extract sensitive data such as API keys, database credentials, and cryptocurrency wallet private keys, leading to at least one confirmed cryptocurrency theft. The company urges affected customers to rotate credentials and has taken internal measures including rotating bucket credentials and invalidating API tokens. The incident is suspected to be part of a broader campaign targeting cloud platforms to enable 'LLMjacking'—abusing AI inference resources at the victim's expense.

1w ago · hacker-news

Two critical remote code execution vulnerabilities (CVSS 9.0) in the Linux kernel's built-in KSMBD SMB server have been publicly disclosed via mailing lists before official fixes were available. The first, ZDI-CAN-33774, allows unauthenticated attackers to trigger a race condition in the protocol dispatch handler by sending a burst of SMB1 packets followed by an SMB2 packet, leading to out-of-bounds reads and potential code execution. The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path that can be exploited when an RDMA-capable interface and writable share are present, allowing memory corruption. Neither vulnerability has a patch in the mainline kernel or a CVE identifier yet, increasing the risk of exploitation in exposed systems running KSMBD on port 445.

1w ago · hacker-news

Arista has disclosed a critical SQL injection zero-day vulnerability, tracked as CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users with even read-only access to escalate privileges to operator-level control, enabling full access to the orchestrator and potential compromise of managed SD-WAN infrastructure. The vulnerability affects on-premises VCO instances running vulnerable versions, with exploitation requiring network access and valid credentials. Arista has released patches for affected release trains and identified two IP addresses associated with ongoing attacks.

2w ago · hacker-news

A malicious npm package named 'imgdecode' is part of the MALFEX supply chain attack campaign targeting Windows systems. The package contains a compiled Node.js native addon that loads a malicious DLL, which downloads encrypted shellcode from a GitHub repository, decrypts it using a hardcoded key, and injects it into the dllhost.exe process. The campaign uses multiple interdependent packages and infrastructure, including GitHub repositories and a C2 server, to deliver payloads such as Overlord RAT and a Node.js stealer, while employing anti-analysis techniques and establishing persistence via registry and scheduled tasks.

1w ago · hacker-news

ConnectWise disabled seven of its application identities after discovering that threat actors had gained unauthorized access to them, enabling compromise of Microsoft 365 tenants. The attackers abused stolen application credentials to authenticate as legitimate ConnectWise applications and obtain access tokens via Microsoft Entra ID, potentially accessing mailboxes, SharePoint, Teams, and directory data. A second wave of targeted attacks from IP address 144.172.64[.]128 was observed on October 15, targeting 16 tenants in sensitive sectors, though no further activity has been confirmed. ConnectWise has suspended Cloud Backup and related services while investigation and remediation continue.

2w ago · hacker-news

A sophisticated threat actor exploited CVE-2025-61624, a path traversal vulnerability in Fortinet FortiOS, to deploy a novel memory-resident ARM64 malware named PEERSTITCH. The malware operates entirely in memory, avoids opening network connections, and hijacks legitimate FortiOS processes (miglogd and iked) to create a covert inter-process communication channel for bypassing security checks on tagged VPN sessions. The attack enabled long-term persistence, credential theft, and lateral movement across managed firewalls, with evidence linking it to the CL-STA-0954 (UNC5820) intrusion campaign targeting a telecommunications managed service provider.

2w ago · hacker-news

Threat actors have compromised a Microsoft 365 credential used by ConnectWise Cloud Backup, enabling unauthorized access to 173 Microsoft 365 tenant environments. The attackers used the stolen credential to obtain Microsoft Graph tokens from IP address 144.172.64[.]128, moving systematically through tenants in sorted GUID order, indicating automated tooling. In at least one tenant, a malicious actor assigned the ConnectWise Cloud Management app Global Administrator privileges and added new client secrets to privileged applications, including an MSP management tool and the Huntress Security Platform, expanding access across customer environments. Organizations with the ConnectWise app installed remain at risk until credentials are rotated and the app is disabled.

2w ago · hacker-news

The China-linked cyber espionage group Armory Castle (UNC5221/Warp Panda) exploited a zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support appliances to gain unauthorized file access and compromise self-hosted servers. The flaw, an improper origin validation in an internal messaging component, was exploited starting August 29, 2026, on a single appliance. Following compromise, the actor deployed a PHP web shell named SAWFLY, established persistence via a custom SOCKS5 proxy (BARECLAW), escalated privileges, stole credentials using proprietary tools, and conducted lateral movement across downstream systems, while also obfuscating activity by deleting logs.

2w ago · hacker-news

Attackers temporarily compromised AOMEI Backupper's update servers between May and July 2026, altering update files for brief windows of 5–10 minutes to deliver a backdoor. The malicious update fetched a downloader named CROSSROAD, which deployed a signed Radmin executable and an attacker-controlled DLL to load the SHINYROAD implant, enabling remote code execution. The attackers also used a WebDAV-based pop-up to harvest NetNTLMv2 authentication tokens without executing code. The campaign, tracked by Google Threat Intelligence Group (GTIG) as UNC7017, targeted organizations across 11 countries opportunistically, affecting systems that happened to check for updates during the tampering windows.

2w ago · hacker-news

Researchers from security firm Calif demonstrated a local privilege escalation exploit against OpenBSD 7.9 that chains two kernel vulnerabilities: a 37-year-old integer overflow in the shmat(4) system call and a reference-counting use-after-free flaw. The exploit bypasses OpenBSD's KARL kernel-address randomization as well as SMAP and SMEP hardware protections by leveraging predictable kernel memory allocators. Full proof-of-concept code was published alongside a detailed writeup after OpenBSD released patches in September. There is no evidence of prior exploitation in the wild.

2w ago · hacker-news

UAT-11985, an advanced persistent threat group, has conducted a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations using fake event invitations. The emails impersonate legitimate institutions and include malicious links or QR codes that direct victims to adversary-in-the-middle (AitM) phishing sites mimicking Google Forms and Google login pages. These sites harvest Google credentials and multi-factor authentication codes in real time, enabling full account takeover, with infrastructure tailored to Chinese-speaking users by supporting Simplified and Traditional Chinese locales.

2w ago · hacker-news

NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities, including potential remote code execution (RCE) and a TLS session forgery flaw that could bypass client-certificate checks. The most severe flaws are heap overflows and a use-after-free condition, exploitable under specific configurations involving alias with rewrite, regex maps, AIO with SSI, or shared TLS session caches. The TLS flaw (CVE-2026-97629) stems from improper rotation of session ticket keys, allowing non-deterministic forged session resumption. No active exploitation has been reported, but prior NGINX flaws have seen rapid weaponization post-disclosure.

2w ago · hacker-news

Citizen Lab identified a zero-click spyware campaign conducted by the Israeli firm Candiru, targeting Al Jazeera staff through malicious online ads served via Discover-Tech, a company posing as a legitimate digital advertising vendor. The attack exploited ad delivery infrastructure to silently deploy spyware without user interaction, with initial access established when targeted devices loaded malicious ads that triggered callbacks to attacker-controlled servers. At least 45 devices were targeted in 2024 and 2025, and the attack chain was confirmed through traffic logs and a recovered Windows malware sample linked to Candiru's known toolset.

2w ago · hacker-news

Multiple active threats were reported, including ransomware groups Qilin and Settra exploiting a PAN-OS authentication bypass vulnerability (CVE-2026-0257). A cryptocurrency wallet drainer kit called Noir uses DNS TXT records hosted on Cloudflare Pages to locate backend infrastructure. A new Rust-based remote access trojan, CikaBika Bot, leverages Discord for C2 communications. The KGB RAT malware, advertised on cybercrime forums, combines data theft with psychological harassment features. Adobe Experience Manager cloud instances are vulnerable to an unauthenticated RCE chain. Samsung patched a critical unauthenticated RCE in its QA-Board tool, while NVIDIA's Linux GPU driver has a privilege escalation and container escape flaw.

2w ago · hacker-news

A critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows guest virtual machines to read host memory, crash the host, and potentially execute code on it. The flaw resides in the kernel's networking code and was demonstrated against Vercel's production sandboxes, where specially crafted network packets from a guest VM could exfiltrate up to 32 bytes of host memory per packet. Although the vulnerability has not been exploited in the wild, it poses a broad risk to cloud providers using shared Linux kernel infrastructure, as it enables VM escape and host-level compromise.