News
438 items in the last 3d
The vulnpocalypse rains iBugs down on Apple with record-setting number of patchesnew
Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.
Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.
55
Acronis warns of actively exploited flaw in its cPanel backup pluginnew
Acronis reports CVE-2026-87886, a CVSS 7.8 Linux privilege escalation in its cPanel/WHM and Plesk backup plugins, exploited in limited targeted attacks.
CVE-2026-87886 is a high-severity local privilege escalation flaw in Acronis Backup plugin for cPanel & WHM (fixed in 1.9.3 HF3) and the Plesk extension (fixed in 1.8.11). A low-privileged attacker can elevate permissions on a vulnerable Linux server to access or modify sensitive data without user interaction. Acronis says it detected exploitation in the wild in limited, targeted attacks based on a single customer report, with no IOCs published yet.
65
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.
38
U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) to KEV; federal agencies must patch by September 17, 2026.
CISA added CVE-2026-76461 (CVSS 9.8), a critical zero-day in Cisco AsyncOS for Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities catalog. The flaw stems from insufficient validation in email parsing, letting an unauthenticated remote attacker send a crafted email with malicious SQL statements to achieve arbitrary command execution with root privileges. Cisco confirmed active exploitation in the wild, notes no workarounds exist, and recommends checking mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM' on every cluster device. Under BOD 22-01, FCEB agencies must remediate by September 17, 2026.
85
Cisco Integrated Management Controller Argument Injection Vulnerabilities
Cisco patched multiple argument-injection vulnerabilities in Cisco IMC's web management interface allowing authenticated attackers root command execution.
Cisco published an advisory covering multiple argument injection vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC). An authenticated, remote attacker could exploit them to execute arbitrary commands on the underlying operating system and elevate privileges to root. Cisco released software updates and states there are no workarounds; the advisory carries a High Security Impact Rating.
28
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Compromised Admin Menu Editor Pro update server distributed backdoored plugin versions installing web shells and hidden admin accounts on roughly 1,500 WordPress sites.
A threat actor with root-level access to adminmenueditor.com pushed trojanized Admin Menu Editor Pro versions 2.35 and 2.36 containing includes/wp-user-consent.php, which installed a web shell and created a hidden wp_-prefixed user account. At least 230 customers and roughly 1,500 sites installed the malicious update, with several hundred more downloads possibly affected. Developer Janis Elsts took the site offline after the attacker recompromised the clean 2.36 release; version 2.34 and the free plugin are believed unaffected.
78
Microsoft Issues Emergency Fixes After Massive Patch Tuesday
Microsoft shipped emergency out-of-band fixes to correct glitches from a record Patch Tuesday covering nearly 1,000 CVEs.
Dark Reading reports that Microsoft issued emergency fixes following a massive Patch Tuesday that addressed nearly 1,000 CVEs. The out-of-band updates correct glitches introduced by the record-sized monthly release. The brief excerpt names no specific CVEs, affected products, or actively exploited flaws.
40
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.
CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.
35
1Password's AI patching benchmark is misleading
Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.
Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.
45
CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.
CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.
30
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.
CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.
30
Norway announces investigations into telecom Telenor’s work with Myanmar junta
Norwegian police opened crimes-against-humanity and sanctions investigations into Telenor's data handovers to Myanmar's junta, raiding its Oslo headquarters.
Norway's National Criminal Investigation Service is investigating Telenor for complicity in crimes against humanity for repeatedly handing over historical customer traffic data to Myanmar's military regime between the February 2021 coup and the March 2022 subsidiary sale. The Police Security Service is separately probing sanctions violations because the sale to M1 Group included sanctioned surveillance equipment transferred without foreign ministry permission. The subsequent resale passed historical call data of over 18 million people to junta-linked owners, and a class action on behalf of 1,200 people alleges the data enabled arrests, torture, and at least one execution.
42
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.
CVE-2026-86462 affects apache-airflow-providers-fab versions 3.2.0 before 3.9.0. Changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie retains full access as that user after the password change. Severity is rated moderate.
30
CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider 2.4.2-3.8.x password reset never deletes sessions because a string/int _user_id comparison is always false.
CVE-2026-82311 affects apache-airflow-providers-fab versions 2.4.2 before 3.9.0. Resetting a user's password fails to delete that user's existing database-backed sessions despite documented behavior saying it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison always evaluates false. Severity is rated moderate.
30
Critical Cisco Secure Email Gateway zero-day gives attackers root access
Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.
Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.
92
CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider 2.0.0-3.8.x lets deactivated users keep unexpired Core API JWTs and mint replacements indefinitely.
CVE-2026-82310 affects apache-airflow-providers-fab versions 2.0.0 before 3.9.0. Deactivating a user account does not stop tokens issued before deactivation. While password authentication correctly rejects the disabled account, the Core API continues to accept an existing unexpired token naming it and lets that token mint a replacement. Severity is rated moderate.
30
Boost Engagement with Free Passkeys by Wordfence
Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.
Wordfence announced that version 9 of its WordPress security plugin introduces passkeys. The feature removes the need for users to remember or copy passwords from a manager. Wordfence is offering the passkey capability for free.
12
CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.
CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.
30
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider takes authorization tokens from unauthenticated cookies never checked against the signed session identity, enabling cookie substitution.
CVE-2026-76186 affects apache-airflow-providers-keycloak before 0.10.0. From Airflow 3.3, the Keycloak auth manager derives user identity from the signed Airflow session token but reads Keycloak access and refresh tokens used for every authorization decision from separate unauthenticated cookies. It never verifies that the two correspond to the same user, allowing mismatched token cookies to drive authorization decisions. Severity is rated moderate.
30
What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies
CISA officials outline future plans for the CDM program, emphasizing speed, automation, unified data, and data-driven federal risk management.
Speaking at an Elastic Federal Cyber Defense Breakfast, CISA officials described next steps for the Continuous Diagnostics and Mitigation (CDM) program that supplies cybersecurity tools to federal agencies. Acting deputy program manager Richard Grabowski named velocity, unification, and data-driven risk management as core goals, including a three-year roadmap to expand SIEM-as-a-Service. Federal CISO Mike Duffy urged aggregating demand across agencies, buying outcomes rather than products, and designing acquisition for continuous improvement. CISA's Matt House tied the program's evolution to post-SolarWinds needs for a government-wide common operating picture.
22
Low-quality casino sites conceal highly dangerous threat actors
Infoblox reveals China-aligned APT groups hiding PeckBirdy malware C2 domains inside roughly 1.7 million Chinese-language illegal casino websites.
An Infoblox report says it tracks about 1.7 million Chinese-language casino sites enabling illegal gambling, some of which double as command-and-control infrastructure. China-aligned APT groups have hidden PeckBirdy framework C2 domains inside these low-quality casino sites since 2023, injecting scripts that display fake software update pages to deliver malware. Over 3 percent of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, and some sites rely on US cloud providers via 'infrastructure laundering.' Infoblox urges defenders not to dismiss casino-domain alerts as mere employee browsing violations.
58
Building a Linux GPU Driver for the M4 Mac Mini in One Monthnew
Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.
Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.
48
“We Think the Security Control Is Working” Is No Longer Good Enough
Opinion piece argues CISOs must replace point-in-time, sampling-based audits with continuous control monitoring to prove controls work in real time.
The article contends that annual, sampling-based compliance assessments no longer satisfy boards, customers, and regulators who demand live proof that security controls are working. It cites a 2025 Dell study where 69 percent of IT professionals said leadership overestimates cyber readiness, and notes NIST's 2024 CSF update added a Govern function emphasizing continuous, measurable outcomes. The author advocates continuous control monitoring of identity, cloud configuration drift, vulnerability remediation clocks, and vendor posture, feeding automated evidence into existing GRC systems.
15
Docker security advisory (AV26-925)
Canadian Cyber Centre advisory AV26-925 flags a vulnerability in Docker Sandboxes versions prior to 0.43.0 and urges users to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-925 on September 15, 2026, stating Docker is affected by a vulnerability in Docker Sandships prior to version 0.43.0. The advisory directs users and administrators to review Docker sbx-releases and security announcements and apply updates as they become available. No exploitation or technical details are provided.
20
Mozilla security advisory (AV26-924)
Canadian Cyber Centre advisory AV26-924 lists vulnerabilities in Firefox 156 and Firefox ESR 115.41, 140.16, and 153.3, urging users to update.
The Canadian Centre for Cyber Security issued advisory AV26-924 on September 15, 2026, covering vulnerabilities in Firefox versions prior to 156 and Firefox ESR versions prior to 115.41, 140.16, and 153.3. Users and administrators are encouraged to review Mozilla's security advisories and apply updates. No exploitation details are included in the advisory.
25
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.
Elastic Security Labs documents KREMLIN (tracked as REF9334), a Brazilian banking malware toolkit active since at least May 2025 that impersonates a dozen Brazilian banks. It uses multi-stage JavaScript loaders, a C++ installer that DLL-sideloads via a legitimate SentinelOne binary, and a malicious Chrome/Edge extension named 'AVSync System Inc.' Ethereum smart contracts act as dead-drop resolvers for C2 endpoints, a shift that occurred May 19, 2026, making infrastructure hard to disrupt. The extension harvests cookies, sessionStorage/localStorage, browsing history, screenshots, and full page HTML via WebSocket plus CSS-disguised polling endpoints. The group has run seven distinct campaigns and also distributes Pulsar RAT and Remcos RAT.
65
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
Unauthenticated attackers can forge Apache ZooKeeper operational log lines via newline injection in crafted ensemble authentication requests.
CVE-2026-84501 (moderate severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The forged entries could mislead operators or corrupt log-based monitoring and forensics.
30
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
Apache ZooKeeper audit logs are vulnerable to arbitrary field injection by unauthenticated attackers via tab characters in digest auth requests.
CVE-2026-84439 (important severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6 when audit logging is enabled (zookeeper.audit.enable=true). An unauthenticated attacker can inject arbitrary fields into the audit log by sending a digest authentication request with embedded tab characters, undermining audit trail integrity and potentially enabling log-analysis evasion or spoofing.
35
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.
CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.
50
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.
35
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.
45
We got admin access to Baseten's production GitHub in 25 minutes
Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.
Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.
58
Iranian spies hit Windows machines with Chosen Brick data-stealing malware
FBI, UK NCSC, and Dutch AIVD warn Iranian intelligence uses Chosen Brick spyware against dissidents, stealing contacts, emails, and messaging data.
A joint advisory from the FBI, UK NCSC, and Dutch AIVD says Iranian state cyber actors have used the Chosen Brick Windows malware since at least 2025 to surveil dissidents, activists, and journalists. Attacks begin with heavily researched WhatsApp and Telegram messages impersonating trusted contacts, tricking victims into opening fake installers resembling Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The malware persists via the HKCU Run registry key, adds Microsoft Defender exclusions, uses victim-specific Telegram bots for C2, captures screen and audio, steals emails and Telegram/WhatsApp data, and can wipe systems.
68
CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse
CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.
NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.
35
VectraRAT Can Hack Windows Enterprises for $250 per Month
VectraRAT malware-as-a-service sells a Windows implant with C2 infrastructure and operator panel for $250 per month.
VectraRAT is a full-service malware-as-a-service platform offering a Windows implant, command-and-control infrastructure, and an operator panel for comprehensive remote access to infected enterprises. Subscriptions cost $250 per month, lowering the barrier for criminal operators. The platform bundles all components needed to run remote-access campaigns.
45
CenterPoint Energy confirms customer data stolen in cyberattack
CenterPoint Energy confirms attackers stole customer personal data, with a threat actor leaking 7.49 million records scraped from an unprotected API.
CenterPoint Energy, a utility serving about 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, confirmed in an SEC filing that an unauthorized third party obtained customer personal information via an external-facing system. A threat actor using the alias "4d722e4d656f77" leaked 7.49 million records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The actor claims the data was exfiltrated by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting and WAF protections. Electric and gas services were not impacted, but multiple federal class-action lawsuits have already been filed.
78
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.
A September 15 joint advisory from the FBI, UK NCSC, and Dutch AIVD attributes the Windows spyware HEAVYGRAM (NCSC name CHOSEN BRICK) to Iran's Ministry of Intelligence and Security, with the campaign dating to autumn 2023 and targeting dissidents, journalists, and activists in the UK, US, Netherlands, and worldwide. Delivered via messages impersonating known contacts or tech support, the malware assigns each victim a dedicated Telegram bot for command-and-control and exfiltration, and can take screenshots, record microphone audio, steal Telegram/WhatsApp data, saved passwords, and emails, download more malware, and wipe the computer. Persistence uses a registry Run key (SMQDService or winappx) plus Microsoft Defender exclusions, with stolen data exiting via Telegram and cloud storage services like Vultr and Storj. The US Justice Department seized four pro-Iranian leak sites in March that had published stolen victim data.
65
Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’
UK, US, and Dutch agencies expose CHOSEN BRICK spyware used by Iranian MOIS hackers to surveil dissidents, journalists, and activists via fake MRI lures.
The UK NCSC, FBI, and Dutch AIVD jointly warned that Iranian state-sponsored hackers deploy CHOSEN BRICK Windows spyware against dissidents, activists, and journalists since at least 2025. Operators build rapport over WhatsApp and Telegram, often posing as known contacts or tech support, then deliver malicious files disguised as an MRI scan or installers for Pictory, RunwayML, Norton, Telegram, Adobe Flash Player, and KeePass. The malware steals contacts, emails, and social media messages, captures screen content and microphone audio, adds Microsoft Defender exclusions, and uses per-victim Telegram bots for command and control. The FBI attributes the tradecraft to Iran's Ministry of Intelligence and Security, including the 'Handala Hack' persona, and stolen data has surfaced on pro-Iranian leak sites.
76
USN-8770-1: SimpleSAMLphp vulnerabilities
Ubuntu patches SimpleSAMLphp signature validation and XXE flaws enabling user impersonation, privilege escalation, and information disclosure.
Ubuntu security notice USN-8770-1 fixes multiple SimpleSAMLphp vulnerabilities. CVE-2019-3465 stems from incorrect cryptographic signature validation in XML messages, allowing an authenticated attacker to impersonate users or gain elevated privileges; it only affected Ubuntu 16.04 LTS and 18.04 LTS. CVE-2024-52596 involves improper handling of external entities when parsing untrusted XML, allowing a remote attacker to obtain sensitive information, and did not affect Ubuntu 24.04 LTS. An additional flaw in signature verification for SAML messages using the HTTP-Redirect binding is also addressed.
20