Search: “extensions”

10 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 47 AI research 45 Exploit / PoC 43 Threat actor 40 Vulnerability 27 AI safety & security 27 Industry 26 Research 26 AI industry 22 Advisory 21 Phishing & fraud 18 Tools 18 Policy & legal 13 Model release 11

SeverityAll critical 21 high 97 medium 97 low 10 info 176

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.

CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.

CERT/CC Vulnerability NotesSep 11, 20:11 UTC · 5d agoVulnerability CVE-2026-842861

AI helps scammers build convincing antivirus renewal pages

Malwarebytes found scammers using AI to build polished fake antivirus renewal pages impersonating Avast, harvesting names, emails and phone numbers for follow-up fraud calls.

Malwarebytes analyzed a fake Avast renewal site targeting Belgian users in French, claiming a €129.99 Avast Premium Security renewal and collecting name, email address and Belgian mobile number through a cancellation form. Leftover code comments written in polite French and other stylistic clues suggest the page was generated with AI assistance, and the form was never connected to send data anywhere. The scam typically progresses to phone calls pressuring victims to install remote access software, and AI substantially lowers the barrier for producing polished, localized scam pages at scale.

Malwarebytes LabsSep 16, 08:41 UTC · 21h agoPhishing & fraud

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security NewsSep 15, 12:21 UTC · 1d agoResearch

CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

Apache OpenNLP CVE-2026-67211: unbounded map pre-sizing in SymSpellModelSerializer enables out-of-memory denial of service in opennlp-symspell 3.0.0-M4/M5.

CVE-2026-67211 affects the opennlp-symspell artifact in versions 3.0.0-M4 and 3.0.0-M5 only. The SymSpellModelSerializer.create() method performs unbounded map pre-sizing, allowing crafted input to trigger out-of-memory denial of service. Releases 1.x and 2.x are unaffected because the spellcheck extension was introduced in 3.0.0-M4; the issue is resolved in 3.0.0-M6.

oss-securitySep 11, 19:22 UTC · 5d agoVulnerability 2 sources CVE-2026-67211

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm CenterSep 10, 12:58 UTC · 6d agoMalware in the wild1

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

CybleSep 10, 10:45 UTC · 6d agoMalware1

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

Cisco disclosed a UEFI Secure Boot bypass in UCS servers and UCS-based appliances letting authenticated or physically present attackers execute unauthorized software.

Cisco published an advisory for a vulnerability in the UEFI Shell implementation of UCS servers and UCS-based appliances. Memory write commands remain available in the UEFI Shell while Secure Boot is enabled, allowing an attacker to modify UEFI memory and bypass validation checks to run unauthorized software. Exploitation requires either valid credentials for a user or admin account, or unauthenticated physical access to select the UEFI Shell boot option at boot time. The issue affects firmware boot integrity rather than the running operating system.

Cisco Security AdvisoriesSep 8, 16:00 UTC · 8d agoAdvisory

LG accused of 'egregious invasion of privacy' over TV data collection

Gamers Nexus alleges LG smart TVs record audio and generate transcripts in standby while harvesting location, network, and device data for LG's ads business.

Researchers at Gamers Nexus claim LG smart TVs continued capturing audio after voice recognition activated, including in standby, producing plaintext transcripts, some stored locally and sent after reconnection. Testing reportedly found collection of IP addresses, location data, nearby Wi-Fi network details, and enumeration of unpaired local devices such as phones, routers, and PCs, with data flowing to LG Ads Solutions. The team is coordinating responsible disclosure of vulnerabilities including an alleged remote code execution flaw. LG says its TVs do not collect, record, or store ambient conversations and that voice recognition is optional.

The Register · SecuritySep 8, 14:15 UTC · 8d agoIndustry1

Cisco Advance Notification for Publication of September 2, 2026, Security Advisories

Cisco PSIRT published September 2, 2026 advisories including critical IOS XR hardening fixes and a Nexus 9000 remote code execution flaw.

Cisco's PSIRT released its September 2, 2026 batch of security advisories, including a Cisco IOS XR Software security hardening release bundling six CVEs (CVE-2026-20274 through CVE-2026-20280) rated critical with CVSS 9.8. A separate critical (CVSS 9.8) remote code execution vulnerability, CVE-2026-20212, affects Nexus 9000 Series switches with Silicon One, and a high-severity (CVSS 7.5) denial-of-service flaw, CVE-2026-20281, affects the Desk Phone 9800 Series and related SIP phones. Administrators should review the advisories and prioritize patching the critical-rated issues.

Cisco Security AdvisoriesSep 2, 16:02 UTC · 14d agoAdvisory CVE-2026-20277 CVE-2026-20278 CVE-2026-20280+6 CVEs

Scammers are getting smarter about where they target you

Malwarebytes data shows scammers tailor fraud by platform: 90% of toll scams arrive via email/SMS and MrBeast is now the most impersonated person.

Malwarebytes threat research analyzed global scam data from April 15 to July 14, 2026, across more than 20 scam types, finding each type favors a specific channel such as email, SMS, phone, or social media. Roughly nine in ten toll scams arrive by email or text, about half of IRS scams come by phone, and MrBeast is impersonated in about 30% of impersonation scams. The most impersonated brands are Google, Microsoft, Apple, Roblox, and Amazon, and Malwarebytes blocks around 500,000 phishing websites daily. Gaming scams on Roblox, Steam, Discord, and Minecraft increasingly carry losses of $1,000 or more, with 15-19% activity spikes in mid-2026.

Malwarebytes LabsSep 2, 12:45 UTC · 14d agoPhishing & fraud