Search: “virtualization”

7 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 8 Advisory 6 Industry 5 Malware 3 Policy & legal 3 Threat actor 2 Tools 2 AI industry 1 Phishing & fraud 1 Research 1 AI research 1

SeverityAll critical 0 high 11 medium 9 low 1 info 12

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security NewsSep 16, 07:45 UTC · 16h agoVulnerability in the wildCVE-2026-62721

CVE-2026-89775: Guest-to-Host Escape in KVM/arm64

Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.

Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.

oss-securitySep 16, 16:04 UTC · 8h agoVulnerability CVE-2026-89775

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)

CVE-2026-90894 in Parallels Desktop for Mac lets any local user gain root via argument injection; patched in v27.0.0, PoC withheld.

JFrog researchers disclosed CVE-2026-90894, an argument injection flaw in Parallels Desktop for Mac v26.4.0 on Apple silicon that lets any local user gain root on the host. The chain combines a world-writable Unix socket for prl_disp_service (which runs as root), weak peer-credential authentication, and argument injection via --use-compress-program in the appliance extraction tar path. Alludo fixed the flaw in Parallels Desktop v27.0.0 in early September 2026; JFrog published technical details but withheld its proof-of-concept script.

Help Net Securityupdated Sep 16, 13:14 UTC · 11h agofirst Sep 16, 12:36 UTC · 12h agoVulnerability 4 sources CVE-2026-90894

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker NewsSep 16, 15:27 UTC · 9h agoThreat actor in the wild 2 sources CVE-2020-0688 CVE-2019-0708 CVE-2021-26855+1 CVEs

Oracle Critical Security Patch Update, September 2026 Review

Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.

Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.

Qualys ThreatPROTECTSep 16, 14:15 UTC · 10h agoAdvisory CVE-2026-83154 CVE-2026-83196 CVE-2026-83197+10 CVEs

Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families

Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.

Oracle's September 2026 Critical Security Patch Update ships 673 patches covering 672 unique CVEs, with more than 130 additional CVEs resolved through bundled fixes, pushing the effective total past 800. Over 100 flaws are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 fixes, Fusion Middleware 153 (78 unauthenticated and network-exploitable), and Hyperion 102. No in-the-wild exploitation of these specific flaws is reported, but Oracle cites CISA's earlier 72-hour remediation order for actively exploited CVE-2026-21962 (CVSS 10.0).

Cyber Security Newsupdated Sep 16, 19:29 UTC · 5h agofirst Sep 16, 13:03 UTC · 11h agoAdvisory 3 sources CVE-2026-21962

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackersSep 16, 05:33 UTC · 19h agoMalware in the wild 2 sources