Search: “dns”

10 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 5 Vulnerability 4 Advisory 2 Malware 1

SeverityAll critical 1 high 6 medium 5 low 0 info 0

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability

Cisco disclosed a TCP DNS flaw in ASA and FTD firewall software letting unauthenticated remote attackers trigger device reloads and denial of service.

A logic error in the DNS over TCP implementation of Cisco Secure Firewall ASA and FTD software mishandles buffer-size tracking when parsing DNS queries. An unauthenticated, remote attacker can send a crafted reply to a DNS query sent from the targeted device, causing the TCP DNS response handler to restart and the device to reload. The result is a denial of service condition on affected firewalls.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 21h agoAdvisory 9 sources

ISC Patches 14 Vulnerabilities in BIND 9 Security Updatenew

ISC patched 14 BIND 9 vulnerabilities, seven high-severity, all enabling denial-of-service conditions, with no exploitation observed so far.

Internet Systems Consortium released BIND 9.21.26 and 9.20.29 fixing 14 flaws, seven rated high severity, that cause DoS via mismatched NOQNAME proofs, QTYPE TKEY queries, malformed authoritative answers, SVCB/HTTPS AliasMode records, crafted DNS-over-HTTPS requests, and oversized negative answers. CVE-2026-77692 lets an unauthenticated attacker crash named with a single crafted DoH SIG(0) request followed by premature connection closure. Medium-severity issues include cache poisoning and attacker-supplied data added to a zone. ISC says it is not aware of any of the bugs being exploited in the wild.

SecurityWeek12:39 UTC · 32m agoAdvisory CVE-2026-80274 CVE-2026-76163 CVE-2026-19666+4 CVEs

SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asianew

Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.

Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.

Cyber Security News12:26 UTC · 44m agoThreat actor in the wild

ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736)

ISC discloses fourteen vulnerabilities in BIND 9 DNS software, including a use-after-free, with fixes now available.

On September 16, 2026, Internet Systems Consortium disclosed fourteen vulnerabilities affecting BIND 9, listing CVE-2026-19033, CVE-2026-19662, CVE-2026-19666 (use-after-free), CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, and CVE-2026-81736. Details and fixes are published in the ISC knowledge base. No active exploitation is reported in the announcement.

oss-securitySep 16, 15:07 UTC · 22h agoVulnerability CVE-2026-19033 CVE-2026-19662 CVE-2026-19666+11 CVEs

BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks

ISC released BIND 9.20.29 patching 14 flaws, including two DNSSEC validation bypasses enabling cache poisoning and multiple denial-of-service bugs.

Internet Systems Consortium shipped BIND 9.20.29 (and 9.21.26) fixing 14 vulnerabilities affecting recursive and DNSSEC-validating resolvers. Key flaws include CVE-2026-77119 (CVSS 5.9), which lets injected NSEC3 records from sibling zones make forged answers appear validated, and CVE-2026-19941, enabling forged DNSSEC-validated NXDOMAIN responses. DoS issues include CVE-2026-19668 (CVSS 5.3, CPU exhaustion via crafted DS/DNSKEY key tags) and cache bloat bugs CVE-2026-81736 and CVE-2026-81563; CVE-2026-1903 fixes partially unsigned TSIG zone transfers and CVE-2026-78301 fixes out-of-zone record serving. ISC reports no active exploitation and says CVE-2026-19668 and CVE-2026-77119 have no workarounds, so upgrading is the only reliable mitigation.

GBHackers11:24 UTC · 1h agoVulnerability CVE-2026-77119 CVE-2026-19941 CVE-2026-19668+4 CVEs

Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.

Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 (September 16, 2026) describes CVE-2026-76460, insufficient authentication controls (CWE-648) on an exposed API endpoint in Cisco ISE and ISE-PIC, rated CVSS 10.0. Successful exploitation lets an unauthenticated remote attacker bypass management interface authentication and potentially obtain command-and-control with root privileges, enabling log tampering and persistence. Software updates are available with no workarounds; Cisco urges prioritized patching, log review for suspicious usernames, and reimaging of suspect nodes.

GBHackersupdated 12:40 UTC · 31m agofirst 10:06 UTC · 3h agoVulnerability in the wild 21 sources CVE-2026-76460

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.

Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.

Cyber Security News07:55 UTC · 5h agoThreat actor in the wild 5 sources CVE-2020-0688 CVE-2019-0708

Chosen Brick, Iran’s Surveillance Malware

UK, US, and Dutch agencies warn Iranian CHOSEN BRICK malware targets dissidents and journalists via Telegram, harvesting contacts, emails, and messages since 2025.

The UK NCSC, FBI, and Dutch AIVD jointly attributed the CHOSEN BRICK Windows malware family to Iranian intelligence services, used since at least 2025 against dissidents, journalists, and activists worldwide, including in the UK, US, and Netherlands. Operators build rapport over WhatsApp or Telegram, impersonating known contacts or platform support, then deliver lures disguised as installers for Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass, or fake MRI results. The malware persists via registry Run keys, adds Microsoft Defender exclusions, and uses per-victim Telegram bot IDs for C2, with newer versions adding HTTPS or SOCKS5 proxies. Some victims' data appeared on pro-Iranian leak sites, raising harassment and physical-safety risks.

Security Affairsupdated 12:53 UTC · 18m agofirst 07:25 UTC · 5h agoMalware in the wild 8 sources

Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins

Microsoft's September Windows 11 cumulative update KB5124008 breaks Active Directory domain trust on domain-joined machines, blocking logins despite valid credentials.

Microsoft is investigating community reports that KB5124008, the September 8, 2026 cumulative update for Windows 11 24H2/25H2 (builds 26100.9445/26200.9445), breaks the AD secure channel, causing 'The user name or password is incorrect' errors on interactive logon. Admins reproduced the failure consistently and observed nltest error 1786 (ERROR_NO_TRUST_LSA_SECRET) plus domain controller Event 4625 with status 0xC000006D over NTLM. The problem is suspected in Machine Identity Isolation, a Credential Guard capability that moves machine-account secrets into virtualization-based security, and disabling it via registry value, Group Policy, or Intune baseline restored trust. The September 14 out-of-band update KB5129195 does not address the domain trust issue, and Microsoft's release notes do not list it as a known problem.

Cyber Security News00:29 UTC · 12h agoVulnerability 2 sources

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabzupdated 10:17 UTC · 2h agofirst Sep 16, 15:13 UTC · 21h agoThreat actor in the wild 3 sources