Search: “WinRAR”

Fake CVE-2023

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42·Aug 17, 10:57 UTC · Aug 17, 2026MalwareCVE-2023-40477CVE-2023-25157

New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM

Researcher's ShieldCrash PoC claims Microsoft Defender still allows arbitrary file reads as SYSTEM on patched Windows, bypassing the CVE-2026-69414 fix.

Researcher MSNightmare released the ShieldCrash proof of concept showing Microsoft Defender can allegedly be made to read arbitrary files with SYSTEM privileges on fully patched Windows systems, bypassing the September 2026 fix for ShieldBreak (CVE-2026-69414). Microsoft has not confirmed the bypass, and the new flaw has no CVE assignment yet. The PoC repository contains C++ project files, a Warden.dll library, and an EICAR test archive, suggesting interaction with Defender's malware-detection and file-handling workflow. Reading files as SYSTEM could expose configuration files, credentials, private keys, and other users' data, though it does not enable code execution.

Cyber Security News·Sep 9, 09:15 UTC · 7d agoVulnerabilityCVE-2026-69414

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42·Sep 9, 10:00 UTC · 7d agoMalware in the wild1

Wireshark 4.6.8 patches 28 security bugs, nine in file parsers

Wireshark 4.6.8 fixes 28 security bugs, including nine crash-prone capture file parsers, misdecoded 5G fields, and memory-safety issues.

Wireshark 4.6.8 fixes 28 security bugs spanning advisories wnpa-sec-2026-64 through wnpa-sec-2026-91, including nine crash bugs in file parsers such as pcapng, Endace ERF and Tektronix K12xx that trigger when opening capture files. Fixes cover dissectors for RDP, SSH, Kerberos, H.245, CMS, C12.22 and several Bluetooth protocols, plus unnumbered memory-safety issues like a stack buffer overflow in the K12/RF5 writer. The release also corrects eight misdecoded 5G NAS/5GSM fields and moves the Unix extcap path to /usr/libexec/wireshark/extcap.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026Advisory

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers·Sep 11, 12:24 UTC · 4d agoMalware in the wild2

iceener/files-stdio-mcp-server: sandbox escape in fs_search via a symlinked directory (recursive walker validates only the top level)

iceener/files-stdio-mcp-server allows a read-side sandbox escape: fs_search follows symlinked directories while the recursive walker validates confinement only at the top level.

A vulnerability report describes a read-side sandbox escape in iceener/files-stdio-mcp-server, an MCP server for text-based file access that explicitly promises 'Sandboxed filesystem access. Only these paths are available'. The fs_search tool can follow symlinked directories outside the allowed paths, and the recursive directory-listing walker used by fs_search (and by fs_read) validates confinement only at the top level. The same flaw affects fs_read's directory-listing walker. No CVE identifier was assigned in the provided report text.

oss-security·Sep 10, 01:17 UTC · 6d agoVulnerability

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.

Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.

The Hacker News·Sep 8, 13:48 UTC · 7d agoThreat actor in the wild 2 sources1

Codex bundles LibreOffice

OpenAI's Codex desktop app bundles 1.7GB of runtimes including full Python, Node.js, Poppler, git, and LibreOffice binaries.

Blogger Simon Willison found that the OpenAI Codex desktop app (since rebranded to ChatGPT) keeps about 1.7GB in a ~/.cache/codex-runtimes/codex-primary-runtime folder, including full Python and Node.js installations plus native binaries for Poppler, git, and the LibreOffice office suite. Bundled skills in the plugins directory instruct Codex on how to find and use these binaries. The observation highlights the heavyweight local runtime stack shipped with agentic coding tools.

Simon Willison·Sep 1, 19:03 UTC · 14d agoAI tools & infra1

Akira Ransomware Uses Safe Mode to Bypass EDR

An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.

Huntress reports an Akira affiliate gained access on August 4 via an MFA-less SonicWall VPN, enumerated Active Directory, archived file shares with WinRAR, and exfiltrated data to an attacker S3 bucket. The attacker rebooted the host into Safe Mode with Networking and preloaded AnyDesk into the Safe Mode service registry, disabling EDR and Defender's real-time protection for roughly ten minutes. The encryptor failed about 13 seconds after launch with out-of-virtual-memory errors caused by Safe Mode's stripped-down environment, and Defender later removed akira.exe after reboot. Huntress says this is the first observed Safe Mode abuse by Akira, following precedents by Snatch and AvosLocker, and provides detection guidance.

Security Affairs·Aug 17, 07:15 UTC · Aug 17, 2026Ransomware in the wild

Linux Zoom Client Proactively Reads X11 Clipboard

Simon Tatham reports that Zoom's Linux client proactively reads the X11 clipboard, potentially exposing copied passwords and other sensitive data.

A Mastodon post by Simon Tatham, shared via Lobsters, reports that the Linux Zoom client proactively reads the X11 system clipboard rather than accessing it only on explicit paste. Because X11 allows any running application to query clipboard contents, secrets such as copied passwords or tokens may be captured by the app. The observation highlights the broader privacy gap between X11's unrestricted clipboard access and more restricted display servers like Wayland.

Lobsters · security·Sep 12, 12:38 UTC · 3d agoResearch1

Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.

Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.

Cyber Security News·Sep 14, 08:01 UTC · 2d agoMalware in the wild1

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress dissects MacSync Stealer, a macOS infostealer delivered through fake Claude Code download pages in Google search results.

Huntress SOC analysts published a reverse-engineering analysis of MacSync Stealer, a macOS infostealer distributed through fraudulent Claude Code download pages surfaced via web searches. Users searching for Anthropic's Claude coding tool are redirected to fake download pages that install the stealer, abusing developer trust in popular AI tooling. The writeup covers the analysis of the sample and its delivery chain.

Huntress·Aug 17, 04:00 UTC · Aug 17, 2026Malware in the wild

Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira

Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.

Stratus Security released Sift, a free open-source command line tool that hunts passwords, API keys, and sensitive data across local disks, Windows shares, Active Directory, SharePoint, OneDrive, Teams, Slack, Jira, and Confluence. In the firm's benchmarks, Sift scanned 250,000 files in 10.61 seconds versus Snaffler's 25.48 and averaged 92 MiB memory versus Snaffler's 337 MiB. Optional false-positive filtering runs through a local language model via Ollama, and scans write checkpoints so interrupted runs resume. The tool found thousands of credentials in Jira ticket comments that prior pentesting had missed.

Help Net Security·Sep 2, 00:00 UTC · 14d agoTools

The GNU C Library security advisories update for 2026-09-14

glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.

The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.

oss-security·Sep 14, 19:54 UTC · 1d agoVulnerability 2 sources

Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.

Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.

GBHackers·Sep 9, 08:40 UTC · 7d agoExploit / PoCCVE-2026-69414

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.

The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.

The Hacker News·Sep 9, 06:47 UTC · 7d agoExploit / PoCCVE-2026-694141

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.

A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.

Full Disclosure·Sep 4, 00:13 UTC · 12d agoVulnerability

ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses a Pwn2Own Windows win32kfull use-after-free local privilege escalation flaw (CVE-2026-65775, CVSS 8.8) requiring existing low-privileged code execution.

ZDI advisory ZDI-26-541 describes a use-after-free in Microsoft Windows win32kfull that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute low-privileged code on the target system. The flaw carries a CVSS score of 8.8 and is assigned CVE-2026-65775; it was demonstrated at Pwn2Own.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-657751

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-security·Sep 4, 21:23 UTC · 11d agoVulnerability

VectraRAT Can Hack Windows Enterprises for $250 per Month

VectraRAT malware-as-a-service sells a Windows implant with C2 infrastructure and operator panel for $250 per month.

VectraRAT is a full-service malware-as-a-service platform offering a Windows implant, command-and-control infrastructure, and an operator panel for comprehensive remote access to infected enterprises. Subscriptions cost $250 per month, lowering the barrier for criminal operators. The platform bundles all components needed to run remote-access campaigns.

Dark Reading·Sep 15, 16:45 UTC · 19h agoMalware

How loveholidays is making everyone a builder with Codex

loveholidays uses OpenAI Codex to let business teams build software, shortening the path from ideas to shipped products.

OpenAI published a customer story describing how travel company loveholidays deploys Codex to make software development accessible across business teams. The company says the approach helps non-engineers turn ideas into products faster. The piece is a vendor case study rather than new technical or research output.

OpenAI News·Aug 26, 00:00 UTC · 21d agoAI industry

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackers·Sep 9, 07:05 UTC · 7d agoMalware in the wild1

ClickFix Campaigns Abuse Legitimate Services for Persistent Access

Dark Reading reports two ClickFix social engineering campaigns abusing legitimate services to compromise organizations and maintain persistent access.

Dark Reading describes two separate attacks in which threat actors used the ClickFix social engineering tactic to compromise organizations. The campaigns abuse legitimate, trusted services to gain and maintain persistent access to victim environments. No specific victims, actors, or indicators were named in the available text.

Dark Reading·Sep 8, 17:25 UTC · 7d agoThreat actor in the wild

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers·Sep 15, 05:51 UTC · 1d agoResearch in the wild1

12 Best Endpoint Encryption Software Compared (2026): Features & Pricing

2026 buying guide compares 12 endpoint encryption tools, framing paid products as management layers over free BitLocker and VeraCrypt engines.

An editorial comparison evaluates twelve endpoint encryption offerings, arguing that full-disk encryption itself is largely solved with free options like Microsoft BitLocker and open-source VeraCrypt. Paid products such as Sophos Central Device Encryption, Broadcom Symantec Endpoint Encryption, and Check Point Full Disk Encryption are positioned around management: central enforcement, recovery-key escrow, pre-boot authentication, and compliance evidence. The guide also warns against unmaintained tools like Rohos for business use and stresses operational concerns over cipher selection.

GBHackers·updated 09:52 UTC · 2h ago·first Sep 11, 07:12 UTC · 5d agoIndustry 13 sources

Novel-reading apps used users' phones to generate fake ad traffic

Help Net Security·Aug 6, 00:00 UTC · Aug 6, 2026Threat actor1

Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.

Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.

Cyber Security News·Sep 15, 13:55 UTC · 22h agoTools

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News·Sep 9, 11:41 UTC · 7d agoMalware in the wild2

VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability

OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.

CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.

CERT/CC Vulnerability Notes·Aug 10, 14:47 UTC · Aug 10, 2026VulnerabilityCVE-2026-184121

ZDI-26-540: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Information Disclosure Vulnerability

ZDI discloses CVE-2026-65776, a Pwn2Own win32kfull use-after-free in Windows enabling local information disclosure, CVSS 6.5.

ZDI-26-540 describes a use-after-free vulnerability in Microsoft Windows win32kfull, demonstrated at Pwn2Own, that allows local attackers to disclose sensitive information. Exploitation requires the attacker to first execute low-privileged code on the target system. ZDI assigned a CVSS score of 6.5, tracked as CVE-2026-65776.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-65776

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoAdvisoryCVE-2026-19781

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.

The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026VulnerabilityCVE-2026-202151

USN-8737-2: GNU C Library vulnerabilities

Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.

USN-8737-2 provides the Ubuntu 24.04 LTS counterpart to fixes released in USN-8737-1 for GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in strfmon when handling right-justification padding, potentially allowing denial of service or arbitrary code execution on Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in tdelete that could also result in denial of service or code execution.

Ubuntu Security Notices·updated Sep 11, 12:03 UTC · 5d ago·first Sep 10, 11:25 UTC · 6d agoAdvisory 13 sourcesCVE-2026-19499CVE-2026-195421

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress analysts trace one X direct message into separate Mac and Windows malware chains delivering AMOS infostealer and NetSupport Manager RAT.

Huntress SOC analysts dissected a malware campaign distributed via an X direct message styled as a Google Docs sidebar. macOS users were routed to the AMOS infostealer, while Windows users received NetSupport Manager remote access malware. The write-up details how a single message branched into two distinct delivery paths per operating system.

Huntress·Sep 11, 16:36 UTC · 4d agoMalware in the wild 4 sources

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-security·Sep 5, 12:16 UTC · 11d agoVulnerabilityCVE-2026-86137CVE-2026-86138