ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “flow matching”

126 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 114Vulnerability 81Ransomware 46Phishing & fraud 40Threat actor 37Data breach 30Industry 28Policy & legal 25Exploit / PoC 25AI research 13AI safety & security 12AI tools & infra 10Research 10Tools 9
SeverityAllcritical 126high 126medium 137low 60info 49

The skb that wasn't freed - the Fragnesia primitive via Open vSwitch

Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.

Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.

Lobsters · security · 2h agoVulnerabilityCVE-2026-90049CVE-2026-89487CVE-2026-80977+2 CVEs

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft warns of a high-volume phishing campaign using invisible Unicode characters to split keywords like 'funding' and evade filters, peaking at 2.37 million daily messages.

Microsoft's Security Research team documented a high-volume phishing operation inserting deprecated Unicode Tags characters (U+E0000-U+E007F) inside financial keywords such as 'funding' so literal-string and regex email filters stop matching them. The campaign ran on a weekly cadence with 1-2.37 million weekday messages between February and May 15, 2026, peaking on February 26, 2026. It used hundreds of disposable finance-themed sender domains and relayed mail through ActiveCampaign's click-tracking infrastructure (acemlnd[.]com, activehosted[.]com), lending legitimate platform reputation. Microsoft ties the activity to an AI-assisted SBA loan phishing campaign that Fortra's FIRE team disclosed in September 2025.

The Hacker News · 12d agoPhishing & fraud in the wild1

Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution

NASA/JPL's AIT-GUI web console (CVSS 9.4) lacked authentication and CSRF protection, letting anyone send unauthenticated commands to spacecraft instruments; fixed in 2.5.2.

Cycode researchers found that AIT-GUI, the browser console of NASA/JPL's open-source AMMOS Instrument Toolkit, ran an HTTP server with no authentication, no session checks, and no CSRF protection on state-changing endpoints, allowing arbitrary commands to spacecraft instruments. The issue combines four weaknesses: binding to 0.0.0.0 regardless of configured host, missing authentication, missing CSRF defense, and path traversal in the /seq and /script/run endpoints. Tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, it is fixed in AIT-GUI 2.5.2. The findings came from AI-assisted code analysis confirmed with working proofs-of-concept, including a headless-browser CSRF demonstration.

Security Affairs · 26d agoVulnerability1

Hackers Abuse AutoIt to Inject AsyncRAT Into Microsoft-Signed Windows Process

Attackers use AutoIt and an invoice-themed batch file to inject AsyncRAT into Microsoft-signed charmap.exe for stealthy remote access.

Point Wild Threat Intelligence documented a five-stage campaign starting with 'Right-click to open Invoice Details.bat' that launches hidden PowerShell, drops a renamed AutoIt interpreter and encrypted loader into a random Temp folder, and persists via a Startup-folder batch file. The loader decrypts AsyncRAT only in memory and injects it into the Microsoft-signed charmap.exe (Windows Character Map) process, leaving no payload file on disk. The final payload patches AMSI inside the infected process and includes screen-capture code that prepares images for transfer to a command-and-control server at 158[.]51[.]122[.]136:4944.

Cyber Security News · 3d agoMalware in the wild1