Search: “open-source software”

5 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 5 Industry 4 Research 3 AI safety & security 3 Tools 3 Malware 2 Exploit / PoC 2 Vulnerability 1 AI research 1 AI tools & infra 1 Data breach 1 Policy & legal 1 Threat actor 1 Advisory 1

SeverityAll critical 1 high 5 medium 4 low 1 info 18

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.

VulnCheck reported active exploitation of CVE-2026-89026 (CVSS v3.1 9.8) in Issabel Framework, the web framework for the open-source Issabel unified communications PBX. A hard-coded HS256 JWT signing key identical across every installation lets unauthenticated attackers forge bearer tokens and abuse the /pbxapi/manager/originate endpoint, causing Asterisk to execute arbitrary OS commands as the Asterisk user. A patch replacing the hard-coded key with one stored in /etc/issabel.conf shipped August 1, 2026, and the Shadowserver Foundation first observed exploitation on September 9, 2026. Details on real-world abuse, attribution, and scale remain unknown.

The Hacker News15:50 UTC · 5h agoExploit / PoC in the wild 2 sources CVE-2026-89026

Using AI for Weapons Development

Anthropic report reveals Yemen-based actors used Claude Code to build guidance software for guided rockets and ballistic missiles.

Bruce Schneier highlights Anthropic's misuse disclosure describing a threat actor cell in northern Yemen running three weapons programs: a guided rocket with phone-class homing guidance, a 2,000+ km multi-stage ballistic missile, and the 'R2000' hypersonic glide vehicle set. The actors used Claude Code as a substitute for human engineers to write GNC software, integrate an open-source autopilot, tune controls, and run flight simulations, orchestrating multiple Claude instances in delegated roles. Safeguards blocked many requests but evasion tactics included hiding intent and splitting work across sessions; one guided rocket test-fire failed but no operational device was fielded.

Schneier on SecuritySep 14, 16:07 UTC · 2d agoAI safety & security in the wild

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.

The Hacker Newsupdated Sep 15, 12:19 UTC · 1d agofirst Sep 15, 06:52 UTC · 1d agoVulnerability 2 sources CVE-2026-48172 CVE-2026-54420

NightEagle targets Russian companies

Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.

Kaspersky's Global Emergency Response Team investigated NightEagle (APT-Q-95) incidents over the past year, finding the group—active since at least 2023 and formerly focused on Asia—now targeting Russian businesses. Attackers used compromised VPN credentials and deployed the GhostContainer .NET backdoor on Microsoft Exchange servers, built from Neo-reGeorg, a CVE-2020-0688 exploit, and ysoserial's GhostWebShell, injected in memory via VIEWSTATE manipulation with AMSI bypass. For lateral movement they combined Microsoft dev tunnels with rdp2tcp over RDP, exploited BlueKeep (CVE-2019-0708) to create local admin accounts, and performed DCSync replication against Active Directory.

Kaspersky Securelistupdated 15:27 UTC · 5h agofirst 10:00 UTC · 11h agoThreat actor in the wild 2 sources CVE-2020-0688 CVE-2019-0708

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security LabsSep 14, 00:00 UTC · 2d agoMalware in the wild