Search: “JarService”

CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Apache Camel K CVE-2026-80351 lets tenant-controlled Maven repository content execute code inside the operator pod; fixed in 2.9.3/2.10.2.

Apache disclosed a critical eval injection vulnerability (CVE-2026-80351) in Apache Camel K, where improperly neutralized directives in dynamically evaluated Maven configuration let tenant-controlled repository content reach Maven execution inside the operator pod. This can allow tenant-controlled content to influence code execution in the operator context. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.

oss-security·Sep 10, 14:06 UTC · 6d agoVulnerability 3 sourcesCVE-2026-803512

Hackers infecting Android car systems to build proxy botnet

Kaspersky reports MoYu Group-linked malware infecting DoFun Android car head units, enrolling them in a BadBox-linked proxy botnet for ad fraud and traffic routing.

Kaspersky discovered malware on Android-based head units made by Chinese automotive supplier DoFun, the first documented case of a car head unit being infected through an attack purpose-built for such devices. Attackers abused TWCore, a legitimate DoFun system application that handles updates and can install new apps, to silently push a malicious app called JarService that displays ads, generates fraudulent ad clicks and downloads additional malware. One malware module turns infected head units into reverse proxies so other users' internet traffic can be routed through the car's connection. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BadBox operation, which previously infected over 70,000 Android devices and resurfaced as BadBox 2.0 after German authorities disrupted the original botnet in December 2024.

The Record·Aug 24, 12:26 UTC · 23d agoMalware in the wild

CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.

CVE-2026-82428 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0, rated important. Dependency artifacts uploaded with storm jar --artifacts were stored under blob keys derived only from the Maven coordinate, making keys identical and predictable for every cluster user. When a blob already existed, the uploader suppressed the collision, enabling a tenant to substitute dependency jars later executed by other tenants in cross-tenant attacks. Fixed in version 3.1.0.

oss-security·Sep 13, 14:23 UTC · 3d agoVulnerabilityCVE-2026-82428

Android car head units infected with proxy botnet malware through built-in software updaters

Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.

Kaspersky discovered malware delivered through the built-in TWCore system updater in Android-based car head units running DoFun infotainment firmware, turning devices into ad-fraud tools and nodes in a proxy botnet. The three-stage infection chain (JarService dropper, loader, and final payload supporting nine commands) installs the zhima reverse-proxy module, which Nokia's Deepfield team independently found on TV set-top boxes. Kaspersky attributes the operation with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet first identified by HUMAN Security in 2023. DoFun closed the gap after Kaspersky's responsible disclosure.

Help Net Security·Aug 24, 00:00 UTC · 23d agoMalware in the wild

Top 10 Best Mobile Device Management (MDM) Solutions in 2026

A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.

A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.

Cyber Security News·Sep 9, 07:45 UTC · 7d agoIndustry

Android Car Malware Spreads Through Built

Kaspersky found MoYu Group malware infecting DoFun Android car head units via firmware updaters, enabling ad fraud and proxy botnet operations.

Kaspersky discovered in June 2026 the first documented malware specifically infecting Android-based car head units, spread through the built-in updater (TWCore) of DoFun head unit firmware via a dropper dubbed JarService. The multi-stage implant supports nine commands enabling unwanted ads, ad fraud, and additional module downloads, and installs the zhima reverse proxy module. The campaign is attributed with high confidence to the MoYu Group behind the BADBOX ad fraud and residential proxy scheme; the distribution issue was fixed after responsible disclosure.

The Hacker News·Aug 25, 06:01 UTC · 22d agoMalware in the wild

The 12 Best Mobile Device Management (MDM) Solutions, Compared and Priced

A comparison of 12 MDM platforms ranks Microsoft Intune as best value for Microsoft 365 estates and Jamf, Kandji, and Mosyle for Apple fleets.

The buyer's guide compares 12 mobile device management (MDM) products, naming Microsoft Intune best value since it is included in Microsoft 365 E3/E5, and Jamf, Kandji, and Mosyle as Apple specialists with day-one OS support and automated compliance remediation. Eight of the twelve publish rates; per-device pricing punishes multi-device users, while Microsoft, Omnissa, and IBM offer per-user options. Free tiers from Mosyle, Miradore, and ManageEngine support genuine small deployments.

GBHackers·updated Sep 10, 08:19 UTC · 6d ago·first Sep 10, 08:09 UTC · 6d agoIndustry 4 sources

Malware Hijacks Android Car Head Units

Kaspersky reports first known malware infecting Android car head units via firmware updaters, repurposing vehicles as BADBOX proxy nodes for ad fraud.

Kaspersky documented the first known malware infection of Android-based car head units, delivered through the built-in TWCore firmware updater on DoFun devices via an MQTT-driven installation flag. A multi-stage chain installs the JarService dropper and a loader that pulls a clicker and reverse proxy module ('zhima') used for ad fraud and proxy botnet infrastructure. The malware supports nine commands, including clipboard changes, HTTP requests, and JavaScript loading, checking in with C2 every 90 minutes. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BADBOX botnet.

Security Affairs·Aug 22, 09:04 UTC · 25d agoMalware in the wild

Prisma SASE Archives

Palo Alto Unit 42 archive page describing Prisma SASE, which converges network security, SD-WAN and Autonomous Digital Experience Management in one service.

Vendor category page describing Prisma SASE as Palo Alto Networks' Secure Access Service Edge offering, combining network security, SD-WAN and Autonomous Digital Experience Management in a single service. The page contains no news, incident, vulnerability or research content.

Palo Alto Unit 42·Aug 17, 12:33 UTC · Aug 17, 2026Industry

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server

Payara Server 7.2026.1.RC1 HTTP EJB endpoints rely on attacker-controlled reflection and JNDI lookups without authorization, enabling arbitrary EJB method invocation.

Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction. Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1.

Full Disclosure·Sep 4, 00:13 UTC · 12d agoVulnerability 2 sources

Retrofitting Code Using LLMs to Support Exceptional Behavior

EXCODER combines static/dynamic analysis with LLMs to retrofit exception-handling code, achieving 85.92% pass@1 with Qwen 2.5 Coder 32B on Java benchmarks.

The paper introduces the task of retrofitting existing code with Exception Related Code (throw statements, guarding conditions, try/catch blocks) so that given Exceptional Behavior Tests pass. EXCODER performs context engineering by integrating static and dynamic program analysis output with LLMs; it was evaluated on a benchmark built from 304 methods across 75 GitHub Java projects. Combined with Qwen 2.5 Coder 32B, EXCODER achieves pass@1, 5, and 10 rates of 85.92%, 86.18%, and 86.51%, roughly 13 percentage points over baseline, and manual inspection reveals remaining limitations.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:18 UTC · 6d agoAI research1

Secure Access Service Edge (SASE) Archives

Palo Alto Unit 42 archive page describing Secure Access Service Edge (SASE), a cloud architecture unifying SD-WAN with SWG, CASB, FWaaS and ZTNA services.

Category archive page defining SASE as a cloud-native architecture that converges SD-WAN with security functions such as SWG, CASB, FWaaS and ZTNA into one cloud service. It frames SASE as a shift from separate networking and security disciplines to unified, cloud-delivered security and connectivity. The page contains no news, incident, vulnerability or research findings.

Palo Alto Unit 42·Aug 17, 12:33 UTC · Aug 17, 2026Industry

CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Apache Storm Nimbus 3.0.0 before 3.1.0 allows arbitrary server-side file read via unvalidated uploadedJarLocation in submitTopology calls.

CVE-2026-82426 (rated important) affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0. Nimbus accepted the uploadedJarLocation argument of submitTopology/submitTopologyWithOpts as a server-side path and opened it directly, without verifying the caller had actually uploaded that file via beginFileUpload. This enables arbitrary file read on the Nimbus host; the issue is fixed in version 3.1.0.

oss-security·Sep 13, 14:19 UTC · 3d agoVulnerabilityCVE-2026-824261

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.

Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.

IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.

arXiv cs.CR·Sep 11, 04:20 UTC · 5d agoResearch1

Prisma Cloud WAAS Archives

Unit 42 archive page for Prisma Cloud WAAS, Palo Alto's web application and API security module; contains no new findings.

This is a product category archive page from Unit 42 describing Prisma Cloud Web Application and API Security (WAAS). It advertises protection spanning the OWASP Top 10, API protection, risk profiling, file upload and geolocation controls for cloud-native architectures. No new research findings, incidents, or vulnerabilities are reported.

Palo Alto Unit 42·Aug 17, 12:19 UTC · Aug 17, 2026Industry

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.

CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.

oss-security·Sep 15, 20:04 UTC · 18h agoVulnerabilityCVE-2026-867921

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commits·Sep 8, 19:22 UTC · 7d agoTools

automatic module_metadata_base.json update

Metasploit Framework automatically updates its module metadata JSON in routine maintenance commit.

The Metasploit Framework repository received an automatic update to module_metadata_base.json, the metadata file that tracks module information. No specific new vulnerability, exploit module, or feature is described in the commit message. This is routine repository maintenance rather than a notable security event.

Metasploit Framework commits·Sep 3, 16:19 UTC · 12d agoTools

Product showcase: GitGuardian Honeytoken catches credential theft as it happens

GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.

GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.

Help Net Security·Sep 10, 05:30 UTC · 6d agoTools

Prisma Access Archives

Unit 42 archive page for Prisma Access, Palo Alto Networks' cloud-delivered SASE offering combining networking and security for distributed workforces.

This is a product category archive page from Unit 42 describing Prisma Access. It characterizes the product as cloud-delivered secure access service edge (SASE) that transforms networking and security for digital workforces. No new research findings, incidents, or vulnerabilities are reported.

Palo Alto Unit 42·Aug 17, 12:20 UTC · Aug 17, 2026Industry

[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints

Joomla fixes CVE-2026-71574, inconsistent ACL checks letting unauthorized users mutate data via webservice APIs, in CMS 5.4.8/6.1.3.

Joomla disclosed an inconsistent access control flaw (CVE-2026-71574) in mutating webservice endpoints, where unauthorized users could perform mutations restricted in the backend UI; impact is rated high. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2, with moderate severity and low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.

Joomla Security Centre·Aug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-71574

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.

CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.

oss-security·Sep 15, 19:54 UTC · 18h agoVulnerability 2 sourcesCVE-2026-76187

How to correlate Kubernetes audit logs with container runtime data

Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.

Elastic Security Labs demonstrates correlating Kubernetes audit logs with Defend for Containers (D4C) runtime telemetry in Elastic. In an Amazon EKS lab, a compromised workload service account performed discovery, read secrets, minted a token, created a privileged pod, and execed into it to attempt a container escape via nsenter and chroot. The escape wrappers appeared only in the decoded Kubernetes audit requestURI, not in runtime process events. The post covers join fields, prebuilt EQL sequence rules, and continues the control-plane correlation thread from the TeamPCP container attack scenario and the Hugging Face intrusion write-up.

Elastic Security Labs·Sep 3, 15:19 UTC · 12d agoResearch1

How MCP Servers Can Expose Enterprise Secrets

MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.

The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.

The Hacker News·Aug 17, 11:58 UTC · Aug 17, 2026AI safety & securityCVE-2025-6514

ToolHive: The open-source way to run any MCP server securely

Stacklok's open-source ToolHive runs Model Context Protocol servers in isolated containers with per-request identity enforcement, audit logging and a signed registry.

ToolHive, shipped under Apache 2.0, containersizes MCP servers locally via Docker or Podman or in clusters through a Kubernetes operator, applying permissions, network filtering, and secrets management. The platform includes a Registry Server implementing the official MCP Registry API with signing and provenance verification, a Virtual MCP Server gateway with OIDC/OAuth single sign-on and OpenTelemetry traces, and a desktop Portal for one-click installs. The browser-based cloud UI is retired, so the desktop app and CLI are the supported rollout paths.

Help Net Security·Sep 7, 00:00 UTC · 9d agoAI tools & infra1

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CR·Sep 14, 11:54 UTC · 2d agoResearch1

Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026

2026 CIEM guide ranks Wiz, Prisma Cloud, Okta, Entra Permissions Management and specialists Sonrai, Britive, Tenable/Ermetic for cloud entitlement right-sizing.

Buyer's guide covers ten CIEM products across three market routes: CNAPP-bundled (Wiz, Prisma Cloud), identity-suite (Okta, CyberArk, SailPoint, Saviynt) and specialists (Sonrai, Britive, Tenable/Ermetic). It cites machine identities outnumbering humans 10:1 plus effective-permissions sprawl as core drivers, with JIT elevation as the fix. Notable consolidation includes Tenable acquiring Ermetic and Zscaler acquiring Canonic.

Cyber Security News·Sep 15, 06:30 UTC · 1d agoTools

automatic module_metadata_base.json update

Metasploit Framework's automated pipeline refreshed its module metadata file, a routine repository maintenance commit introducing no new modules or exploits.

An automated Metasploit Framework commit updated module_metadata_base.json, the metadata database consumed by module tooling. The change is routine maintenance and contains no new exploit modules or vulnerability content.

Metasploit Framework commits·Sep 3, 13:45 UTC · 13d agoTools1

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center·Sep 3, 02:02 UTC · 13d agoTools1

Chainloop: Open-source evidence store and policy engine for the software supply chain

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Policy & legal

[20260805] - Core - Improper ACL checks for category webservice endpoints

Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.

Joomla disclosed an incorrect access control flaw (CVE-2026-72532) in category webservice endpoints, allowing unauthorized users to create categories for inaccessible components. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 and is rated moderate impact and severity with low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18; it was reported by Amin Isayev and Geo.

Joomla Security Centre·Aug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-72532