Search: “StackRox”

31 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 9 Industry 8 Tools 3 Policy & legal 2 Advisory 1 Ransomware 1 Malware 1 AI safety & security 1 Data breach 1 Exploit / PoC 1

SeverityAll critical 8 high 3 medium 9 low 3 info 5

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security Newsupdated Sep 16, 13:14 UTC · 19h agofirst Sep 16, 09:24 UTC · 22h agoVulnerability 4 sources CVE-2026-90894

Top 10 Best Kubernetes Security Tools in 2026

Top 10 Kubernetes security tools roundup highlights Sysdig and Aqua as specialists plus strong free options Kubescape, Calico, and Falco.

A buying guide ranks ten Kubernetes security tools across admission control, network policy, runtime detection, and posture management. Sysdig leads runtime depth, Aqua leads full lifecycle, Red Hat ACS owns OpenShift estates, and Wiz offers agentless graph correlation. The guide notes this category has cloud security's strongest open-source floor with Kubescape, Calico, and Falco.

Cyber Security NewsSep 15, 06:41 UTC · 2d agoIndustry1

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security LabsSep 11, 00:00 UTC · 6d agoResearch1

12 Best Kubernetes Security Tools Compared (2026): Features & Pricing

GBHackers compares 12 Kubernetes security vendors including Sysdig, Wiz, Aqua, and Cisco Isovalent on features, pricing units, and procurement strategy.

GBHackers publishes a 2026 buying guide comparing 12 Kubernetes security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, Snyk, Cisco Isovalent, Palo Alto Networks, Fairwinds, Red Hat ACS, and Tigera. It argues CNCF-grade open source (Kubescape, Falco, Trivy, Calico, Cilium/Tetragon) provides free posture, runtime, and network policy coverage that resets price negotiations. Cisco's acquisition of Isovalent places the eBPF data plane under a networking giant, while the paid market focuses on multi-cluster policy, enforcement, and support. The piece emphasizes that pricing units (workload, node, cluster, developer, credits) heavily influence contract costs.

GBHackersSep 16, 09:52 UTC · 22h agoTools 14 sources

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.

A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.

Full DisclosureSep 4, 00:13 UTC · 13d agoVulnerability1

Top 10 Best Container Security Tools in 2026

2026 roundup ranks Aqua, Sysdig, Prisma Cloud, Wiz, Snyk and CrowdStrike among the ten best container security tools across build-ship-run.

Buyer's guide compares ten container security products by lifecycle fit: Aqua leads full lifecycle, Sysdig leads runtime detection via Falco and eBPF, Wiz offers agentless graph visibility, Snyk covers developer-first shift-left. It notes Trivy and Falco as free production-grade open-source foundations. The guide argues standalone container security is increasingly absorbed into CNAPP platforms from Palo Alto, Wiz and CrowdStrike.

Cyber Security NewsSep 15, 06:36 UTC · 2d agoTools1

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-securitySep 4, 21:23 UTC · 12d agoVulnerability

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress analysts trace one X direct message into separate Mac and Windows malware chains delivering AMOS infostealer and NetSupport Manager RAT.

Huntress SOC analysts dissected a malware campaign distributed via an X direct message styled as a Google Docs sidebar. macOS users were routed to the AMOS infostealer, while Windows users received NetSupport Manager remote access malware. The write-up details how a single message branched into two distinct delivery paths per operating system.

HuntressSep 11, 16:36 UTC · 5d agoMalware in the wild

Stack buffer overflow in WAD

FortiOS explicit proxy WAD daemon stack buffer overflow (CVSS 5.1) allows code execution only with Kerberos and SOCKS configured.

Fortinet advisory FG-IR-26-161 describes a stack-based buffer overflow (CWE-121) in the WAD daemon of FortiOS explicit proxy, scored CVSSv3 5.1. Exploitation requires an attacker able to bypass stack protection and ASLR, and the explicit proxy must be configured with Kerberos authentication and SOCKS enabled. If successful, it yields arbitrary code or command execution in the WAD daemon context via crafted sockets. No exploitation is reported in the advisory.

Fortinet PSIRTAug 12, 07:00 UTC · Aug 12, 2026Advisory

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-securitySep 5, 12:16 UTC · 11d agoVulnerability CVE-2026-86137 CVE-2026-86138

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence details the TerminalFix campaign, which uses fake CAPTCHA prompts, DLL sideloading, and reverse tunnels in multistage intrusions.

Microsoft Threat Intelligence published analysis of a ClickFix-style campaign dubbed TerminalFix. The intrusion chain relies on fake CAPTCHA social engineering and DLL sideloading, and the attackers deploy a reverse tunnel to maintain access through a multistage intrusion. Microsoft released detections and threat hunting guidance for defenders.

Microsoft Security BlogAug 29, 03:43 UTC · 19d agoThreat actor in the wild

Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory

Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.

Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.

Help Net SecuritySep 9, 11:05 UTC · 7d agoMalware in the wildCVE-2025-535211

'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks

A ClickFix-style campaign called TerminalFix weaponizes PowerShell and reverse tunnels to infiltrate enterprise networks in a multistage attack chain.

Dark Reading reports on the TerminalFix campaign, a sophisticated multistage attack targeting enterprises. It uses a ClickFix-style social engineering lure and heavily weaponizes PowerShell. The chain establishes reverse tunnels into victim organizations' networks, giving operators interactive access for follow-on activity.

Dark ReadingAug 31, 20:25 UTC · 16d agoThreat actor in the wild

Any user process can escalate to root

A disclosed local privilege escalation flaw allows any user process to escalate to root on the affected system.

A Lobsters-linked security write-up describes a vulnerability in which any user process can escalate its privileges to root. The feed text provides no product name, CVE identifier, CVSS score, or exploitation details, limiting available detail. Local privilege escalation flaws are commonly chained with other issues for full system compromise, so defenders should review the full write-up for affected versions and patches.

Lobsters · securityAug 31, 13:46 UTC · 16d agoVulnerability

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.

On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.

Security AffairsSep 9, 08:50 UTC · 7d agoMalware in the wildCVE-2025-53521

Re: Retrospective by 'gpg.fail' authors

Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.

This is an oss-security mailing list reply by Sam James (Gentoo toolchain maintainer) to Werner Koch in the thread on the 'gpg.fail' authors' retrospective about GnuPG. James states that upstream projects like GnuPG should feel free to enable whatever -W* warning flags they need. He adds that distributions should not use -Werror indiscriminately, allowing narrow exceptions such as -Werror=format-security, and may reject warning-driven bugs that do not reflect real issues. No new CVE or vulnerability details are disclosed in this reply.

oss-securityupdated 03:19 UTC · 4h agofirst Sep 16, 05:03 UTC · 1d agoVulnerability 9 sources

Omarchy: Any User Process Can Escalate to Root

A security write-up details how any user process on the Omarchy Linux setup can escalate privileges to root.

A post on 0xcc.io describes a local privilege escalation issue in Omarchy, the Arch-based Linux configuration, where any user process can escalate to root. The disclosure appears to describe a design-level weakness in the distribution's security model. No CVE identifier is mentioned in the available text.

Lobsters · securityAug 30, 18:11 UTC · 17d agoVulnerability

From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.

The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.

Elastic Security LabsAug 28, 00:00 UTC · 20d agoTools in the wild

Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

Zscaler ThreatLabz reports SloppyRAT, a new Windows RAT delivered via ClickFix lures that supports reconnaissance, reverse SOCKS proxying, and lateral movement for ransomware affiliates.

Zscaler ThreatLabz first observed SloppyRAT in June 2026, delivered through multi-stage ClickFix chains that abuse finger.exe, a renamed curl.exe, and IronPython to load a reflective Python payload. The C++ implant implements 47 PowerShell-like commands via native APIs and direct syscalls, modifies Microsoft Defender settings, and establishes a reverse SOCKS proxy that lets operators pivot into internal networks. It is linked to CastleLoader and CastleRAT components and uses certificate-pinned HTTPS C2 with an EtherHiding fallback via Polygon JSON-RPC. Zscaler assesses it as an intrusion-enablement tool for ransomware operations, though flawed persistence logic suggests the family is still under development.

GBHackersupdated Sep 11, 09:12 UTC · 5d agofirst Sep 11, 06:17 UTC · 6d agoMalware in the wild 3 sources

MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra

eSentire uncovered a malware-as-a-service campaign pairing ClickFix social-engineering lures with the ErrTraffic and Cruciferra malware families.

Threat researchers at eSentire identified an ongoing malware-as-a-service (MaaS) campaign that combines ClickFix social-engineering lures with the ErrTraffic and Cruciferra malware families. The campaign relies on ClickFix-style deception to trick users into executing malicious actions that deliver the malware. Further technical detail on affected sectors or infection volumes was not provided in the disclosure.

Infosecurity MagazineAug 19, 15:00 UTC · 28d agoMalware in the wild

[webapps] PodcastGenerator 3.2.9 - Stored XSS

A stored cross-site scripting flaw in PodcastGenerator 3.2.9 is documented with a public proof-of-concept exploit on Exploit-DB.

Exploit-DB published exploit ID 52677 targeting PodcastGenerator 3.2.9, a web application affected by stored cross-site scripting. The listing provides a proof-of-concept for the flaw but includes no CVE identifier or reports of active exploitation.

Exploit-DBSep 2, 00:00 UTC · 15d agoExploit / PoC1

Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks

Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.

Cisco Talos tracks a ClickFix-style campaign that tricks cryptocurrency traders into pasting JavaScript into Chrome's address bar or a Tampermonkey extension, promising fake bonuses on SwapZone and SimpleSwap. The loader pulls obfuscated JavaScript from cells in a public Google Sheet via the Visualization API, then behaves like a web skimmer, rewriting deposit addresses on screen, in web responses, and in the clipboard. Researchers counted 49 attacker-controlled Bitcoin addresses, with 24 receiving a combined 0.159 BTC, roughly $10,000, by early August 2026. A Tampermonkey variant re-injects the payload on every return visit, giving the attackers persistence despite takedown efforts.

Cyber Security NewsSep 9, 10:57 UTC · 7d agoPhishing & fraud in the wild

GNU security advisory (AV26-923)

Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.

The Canadian Centre for Cyber Security issued advisory AV26-923 on September 15, 2026, covering CVE-2026-91752, a stack overflow vulnerability in GNU libextractor versions prior to 1.15 triggered via OLE2 file parsing. The Cyber Centre encourages users and administrators to review the provided links and apply necessary updates as they become available.

Canadian Centre for Cyber Securityupdated Sep 16, 23:13 UTC · 9h agofirst Sep 15, 15:10 UTC · 1d agoAdvisory 2 sources CVE-2026-91752

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.

Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.

Rapid7 BlogAug 14, 21:27 UTC · Aug 14, 2026Tools CVE-2026-46300

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker NewsSep 7, 18:12 UTC · 9d agoMalware in the wild1

Technical Manual for a Toolkit for Measuring Contextual Individuation in Transformer Language Models

An open methodology toolkit measures whether transformer language models contextualize fixed word forms across domains using bridge forms and layer-wise silhouette analysis.

The manual documents an open toolkit built around 'bridge forms' - identical written words recurring across two or more subject domains with a different sense in each - to test whether transformer language models individuate word occurrences by context beyond the embedding layer. It covers declarative specification of bridge forms, Wikipedia corpus acquisition, occurrence localization, layer-wise representation extraction, domain-pairwise silhouette measurement, and visualization, justifying each choice against failure modes such as sense contamination and subword-tokenization misalignment. It is a methodological and implementation reference and reports no empirical results.

arXiv cs.AI / cs.LG / cs.CLSep 4, 16:38 UTC · 12d agoAI research

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security NewsSep 15, 13:52 UTC · 1d agoVulnerability

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.

Cisco Talos reports that the tracked threat actor UAT-10147 is deploying a newly identified implant named SPECTRE. SPECTRE supports cross-platform command-and-control, process injection, credential theft, and anti-analysis protections. It also includes a Linux rootkit and BYOVD (bring your own vulnerable driver) capability enabling kernel-level EDR bypass, marking an evolution in commodity intrusion tooling.

Cisco TalosAug 20, 10:00 UTC · 27d agoThreat actor in the wild

Rosetta at AlexandriaX-2026: LoRA-Adapted NileChat for Context-Aware Dialectal Arabic Dialogue Translation

Rosetta ranks 4th and 5th in AlexandriaX-2026 dialectal Arabic dialogue translation using a LoRA adapter on NileChat-3B, finding limited pretraining benefit.

The Rosetta system for the AlexandriaX-2026 shared task fine-tunes a LoRA adapter on NileChat-3B for context-aware English-to-dialectal Arabic dialogue translation. The adapter was additionally pretrained on MADAR and PADIC dialect corpora for the unconstrained track. It achieved spBLEU 26.10 (4th, constrained) and 25.09 (5th, unconstrained). External dialect pretraining improved only two of thirteen dialects while slightly degrading overall performance, indicating negative transfer.

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:15 UTC · 7d agoAI research1

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commitsSep 8, 19:22 UTC · 8d agoTools

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.

In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.

Zscaler ThreatLabzAug 17, 14:06 UTC · Aug 17, 2026Malware in the wild1