Search: “OAuth”

4 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 4 Malware 3 Industry 3 Phishing & fraud 3 Research 2 AI safety & security 2 Tools 2 Threat actor 2 Advisory 1 Data breach 1 AI tools & infra 1

SeverityAll critical 0 high 4 medium 8 low 2 info 10

Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theft

Jenkins patched 20 vulnerabilities across 13 plugins, including Groovy sandbox bypasses enabling remote code execution on CI/CD controllers.

Jenkins released security updates on September 16, 2026 for 20 vulnerabilities across 13 plugins, including nine fixes in the Script Security Plugin for Groovy sandbox bypasses. CVE-2026-92127 (classpath abuse) and CVE-2026-92128 (TOCTOU race on remote JAR loading) could allow arbitrary code execution in the controller JVM, exposing build secrets, credentials, and downstream deployment environments. Other flaws include stored XSS in the Warnings, Coverage, OWASP Dependency-Check and Gitee plugins, SSRF in the Gradle and Bitbucket plugins enabling credential capture, credential exposure via CVE-2026-92130, arbitrary file write via CVE-2026-92137, OAuth token theft, and an open redirect in the Keycloak Authentication Plugin. No exploitation is reported; fixes include Script Security Plugin 1422.v06869826dd9b_.

GBHackers06:21 UTC · 2h agoVulnerability CVE-2026-92122 CVE-2026-92123 CVE-2026-92124+17 CVEs

GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds

eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.

eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.

Cyber Security NewsSep 16, 14:54 UTC · 18h agoPhishing & fraud in the wild 9 sources5

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackersSep 16, 13:41 UTC · 19h agoPhishing & fraud in the wild2

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AISep 15, 18:11 UTC · 1d agoVulnerability HN 51↑ · 12 comments1