Search: “X11”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Xen Security Advisory 510 v3 (CVE-2026-79602) - x86: improper handling of HVM emulation return codes

Xen Project released XSA-510 (CVE-2026-79602) fixing mishandled HVM emulation return codes that let PCI-passthrough guests crash Xen.

Xen Security Advisory 510 v3 publicly discloses CVE-2026-79602, improper handling of HVM emulation return codes in the Xen hypervisor on x86. A guest with an assigned PCI device that has at least one BAR in the IO port space can trigger a BUG() in Xen. The advisory was released publicly as version 3.

oss-security·Sep 8, 15:37 UTC · 8d agoVulnerability 4 sourcesCVE-2026-796021

28

Linux Zoom Client Proactively Reads X11 Clipboard

Simon Tatham reports that Zoom's Linux client proactively reads the X11 clipboard, potentially exposing copied passwords and other sensitive data.

A Mastodon post by Simon Tatham, shared via Lobsters, reports that the Linux Zoom client proactively reads the X11 system clipboard rather than accessing it only on explicit paste. Because X11 allows any running application to query clipboard contents, secrets such as copied passwords or tokens may be captured by the app. The observation highlights the broader privacy gap between X11's unrestricted clipboard access and more restricted display servers like Wayland.

Lobsters · security·Sep 12, 12:38 UTC · 4d agoResearch1

20

Fwd: XZ Utils 5.8.4 and a security fix

XZ Utils 5.8.4 fixes an invalid memory write that occurs when a decoder is reinitialized after allocation failure in 5.8.3 and older.

XZ Utils 5.8.4 has been released with a security fix for versions 5.8.3 and older. The flaw is an invalid memory write that can occur when a decoder is reinitialized after an allocation failure. The announcement was posted on the oss-security mailing list by Sam James pointing to the upstream stable release. Users and distributions running affected versions should upgrade to 5.8.4.

oss-security·Sep 9, 18:28 UTC · 6d agoVulnerability

45

X says attackers are targeting user accounts after the launch of X Money

X is investigating a wave of unsolicited password reset emails targeting users after the X Money payments launch, with no confirmed breaches yet.

Numerous X users reported unsolicited password reset emails following the launch of X Money, the platform's new payments service with accounts held at FDIC-insured Cross River Bank. Product engineer Mridul Singhai said the company found no evidence of successful breaches or mass account takeovers, while the Grok chatbot confirmed attackers are mass-triggering resets using public usernames. Users are being advised to enable two-factor authentication and Password Reset Protect while the investigation continues.

TechCrunch · Security·Sep 1, 20:48 UTC · 14d agoPhishing & fraud in the wild

45

[webapps] CubeCart 6.7.4 - Stored XSS

A proof-of-concept stored cross-site scripting exploit targeting CubeCart 6.7.4 was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit for a stored cross-site scripting (XSS) vulnerability in CubeCart 6.7.4, a PHP-based e-commerce web application. The listing demonstrates injection of attacker-controlled script that persists in the application, but no exploitation in the wild or CVE assignment is reported in the provided text.

Exploit-DB·Aug 31, 00:00 UTC · 16d agoExploit / PoC1

12

X Money rollout linked to password-reset attacks

X is investigating bulk unsolicited password-reset emails as its X Money payments service expands, with no confirmed breaches or account takeovers yet.

X users began reporting unexpected password-reset emails and codes on September 1, and product engineer Mridul Singhai said attackers appear to believe newly widespread X Money access makes accounts worth targeting. X says it has found no evidence of any breach or successful account takeover, and completing a reset still requires access to the account's email or phone number. X Money offers eligible US users interest-bearing accounts, a Visa debit card, and P2P payments, with Cross River Bank providing banking infrastructure. Malwarebytes warns the reset flood can serve as cover for phishing and urges reset protection, 2FA, and unique passwords.

Malwarebytes Labs·Sep 4, 12:29 UTC · 12d agoPhishing & fraud in the wild

45

[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)

A proof-of-concept cross-site scripting exploit for C-MOR video surveillance software 6.0104 appeared on Exploit-DB.

Exploit-DB published a proof-of-concept cross-site scripting (XSS) exploit against C-MOR 6.0104, an IP video surveillance platform. The listing demonstrates script injection in the web interface, but the provided text contains no CVE identifier or indication of active exploitation. Successful XSS against the surveillance console could enable session hijacking or manipulation of the monitoring interface.

Exploit-DB·Aug 31, 00:00 UTC · 16d agoExploit / PoC1

10

Chinese espionage groups swarm to exploit triple-link chain of zero-days

At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.

Proofpoint observed at least four state-aligned threat groups, starting with TA412/Violet Typhoon/APT31 on August 28, chaining three zero-days in the 'BlueMoon' exploit chain targeting Chrome, Chromium-based browsers and Microsoft Windows. The chain includes RCE flaws in Chromium's JavaScript engine (CVE-2026-85046, CVE-2026-87491) and a Windows Advanced Local Procedure Call privilege-escalation zero-day (CVE-2026-85880), enabling sandbox code execution, sandbox escape and system privileges. APT31 delivered the chain via phishing links to NGOs, mining and commodity trading firms in the US, installing a browser extension disguised as Google Gemini to surveil activity and steal credentials. Other groups (UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) targeted US aerospace, Vietnamese manufacturing, and Indonesian and Singaporean organizations; fewer than 20 victims were directly observed but the true count is likely higher.

CyberScoop·updated 16:06 UTC · 1h ago·first Sep 9, 21:17 UTC · 6d agoExploit / PoC in the wild 18 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858802· 1 read

88

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

Drupal issues moderately critical advisory for XSS in bundled CKEditor affecting content editors; fixed versions released, exploitation theoretical.

Drupal published SA-CORE-2026-013, rated moderately critical (13/25), covering an XSS vulnerability in the CKEditor library used for WYSIWYG editing. An attacker able to create or edit content, even without direct CKEditor access, could exploit it to target users with WYSIWYG permissions. Affected versions include Drupal core 10.5.x, 11.0.x and 11.4.x below 11.4.7, and updated releases are available. Exploitation is rated theoretical.

Drupal Security Advisories·16:21 UTC · 54m agoAdvisory

32

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.

Unit 42 observed the xHunt campaign targeting Kuwait transportation and shipping organizations between May and June 2019, installing backdoors named after characters from the anime Hunter x Hunter, including Hisoka, Killua, Sakabota, and Netero. The tools use HTTP and DNS tunneling for C2, and Hisoka v0.9 added an unusual email-based C2 channel that abuses Exchange Web Services with stolen credentials to exchange email drafts. The Gon tool provides port scanning, file transfer, screenshots, remote command execution, and RDP session creation, while EYE acts as a cleanup failsafe if a legitimate user logs in. Related activity targeting Kuwait between July and December 2018 was reported by IBM X-Force IRIS, suggesting the campaigns are likely related.

Palo Alto Unit 42·Aug 17, 13:21 UTC · Aug 17, 2026Threat actor1

52

Xen Security Advisory 509 v3 (CVE-2026-62437) - x86: DMs may cause mem leak by IRQ binding

Xen Project released XSA-509 (CVE-2026-62437) fixing a memory leak in IRQ tracking when guests with assigned PCI devices are terminated.

Xen Security Advisory 509 v3 publicly discloses CVE-2026-62437, a memory leak affecting the Xen hypervisor on x86. When guests are terminated, cleanup of PCI devices assigned to those guests and removal of associated IRQ tracking structures may fail, leaking memory. The advisory was released publicly as version 3.

oss-security·Sep 8, 15:35 UTC · 8d agoVulnerabilityCVE-2026-62437

25

Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

Cisco fixed a stored cross-site scripting flaw in Industrial Ethernet 1000 series switches exploitable by authenticated remote users.

Insufficient validation of user-supplied input in the web-based management interface of Cisco Industrial Ethernet 1000 Series Switches allows stored XSS. An authenticated remote attacker can inject malicious code into specific interface pages and execute arbitrary script in another user's context. Exploitation requires valid credentials; Cisco has released software updates.

Cisco Security Advisories·Aug 19, 16:00 UTC · 28d agoAdvisory

22

N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it

Datadog researchers detonated a new N4D Mesh Controller sample in microVMs, revealing rotated infrastructure, a UPX-packed go-titan agent, and persistence behavior.

Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated command infrastructure and a UPX-packed agent labeled go-titan. Runtime evidence showed MCP tool abuse, multi-service scanning, and persistence mechanisms. The report provides hunting guidance for defenders tracking this infrastructure.

Datadog Security Labs·Aug 20, 00:00 UTC · 27d agoMalware

55

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-security·Sep 4, 21:23 UTC · 11d agoVulnerability

28

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.

CVE-2026-78318 is a moderate-severity cross-site scripting flaw in Apache Syncope's syncope-client-idrepo-common-ui module. The notification message, optionally shown by the Console and Enduser UIs, is improperly neutralized, enabling unauthenticated reflected XSS. Affected versions are 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; no exploitation is reported.

oss-security·Sep 14, 15:48 UTC · 2d agoVulnerabilityCVE-2026-783181

25

Cisco security advisory (AV26-876)

Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.

The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.

Canadian Centre for Cyber Security·Sep 3, 13:13 UTC · 13d agoAdvisory

26

[Control Systems] Siemens security advisory (AV26-864)

Siemens fixed a vulnerability in Element maps-ng V47-V49 (SSA-682041); Canada's Cyber Centre urges administrators to apply the updated releases.

Siemens advisory SSA-682041 addresses a vulnerability affecting Element maps-ng V47 prior to V47.12.3, V48 prior to V48.11.3, and V49 prior to V49.16.1. Canada's Cyber Centre republished the notice (AV26-864) encouraging users and administrators to review the vendor links and apply the necessary updates. No CVSS score or exploitation details were provided in the bulletin.

Canadian Centre for Cyber Security·Aug 31, 15:59 UTC · 16d agoAdvisory

22

Storm-1175 Replaces Medusa With New StormEncryptor Ransomware

Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.

Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.

Security Affairs·Aug 13, 08:09 UTC · Aug 13, 2026Ransomware in the wildCVE-2026-18577CVE-2026-1731CVE-2023-21529+15 CVEs1

62

Cortex XSIAM Archives

Palo Alto Networks positions Cortex XSIAM as a purpose-built platform to simplify security operations and speed incident remediation.

The Unit 42 blog page is a product category archive for Cortex XSIAM. The platform is marketed as purpose-built for SecOps transformation, simplifying security operations and accelerating incident remediation against current and future threats. No research findings, incidents, or vulnerabilities are discussed.

Palo Alto Unit 42·Sep 8, 14:27 UTC · 8d agoIndustry 6 sources

10

The 12 Best Extended Detection & Response (XDR) Platforms, Compared and Priced

Buyer's guide compares 12 XDR platforms, favoring Microsoft Defender XDR, Stellar Cyber and CrowdStrike, and warns ingestion pricing inflates costs.

The article compares 12 extended detection and response platforms, distinguishing native XDR (CrowdStrike, Palo Alto Cortex XDR, Microsoft Defender XDR, SentinelOne) from open XDR (Stellar Cyber, Arctic Wolf, Rapid7). It argues data ingestion pricing, not per-endpoint fees, is the main budget risk and should be modeled before signing. It repeats the consolidation note that Sophos acquired Secureworks for approximately $859 million in February 2025, and flags that ExtraHop is NDR rather than full XDR.

GBHackers·updated Sep 9, 08:07 UTC · 7d ago·first Sep 9, 07:51 UTC · 7d agoIndustry 3 sources1

14

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabz·Aug 10, 15:51 UTC · Aug 10, 2026Malware

50

Apple Xcode Integer Underflow Flaw Lets Crafted Archives Leak Memory and Crash Builds

Researchers disclosed an integer underflow in Apple's Mach-O archive parser that lets crafted static libraries crash Xcode builds or leak process memory.

SecureLayer7 disclosed an integer underflow in the mach_o::Archive::Entry::name() function in Apple's open-source dyld project, reported to Apple Product Security on May 23, 2026, with no public patch after more than 90 days. Crafted static archives (.a files) cause the parser's unsigned index to wrap to SIZE_MAX, producing SIGSEGV crashes in the ld-prime linker, out-of-bounds reads that may print adjacent memory to stderr, or SIGABRT in libtool and ranlib. The modern parser is used by ld-prime, the default linker for arm64, arm64e, and x86_64 since Xcode 15, while legacy ld-classic is unaffected. Crafted archives need only be processed, creating supply-chain risk via vendored SDKs, binary dependencies, and CI pipelines.

GBHackers·Sep 10, 11:41 UTC · 6d agoVulnerability1

42

[webapps] Bludit CMS - Stored XSS

A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.

Exploit-DB published a webapps entry for a stored XSS flaw in Bludit CMS, an open-source flat-file content management system. Stored XSS allows an attacker to persist malicious scripts that execute in other users' browsers, potentially enabling session theft or unauthorized actions. The listing did not include a CVE identifier or affected version range.

Exploit-DB·Sep 1, 00:00 UTC · 15d agoExploit / PoC1

25

[dos] Nmap 7.99 - Extension Header Integer Underflow

A proof-of-concept denial-of-service exploit for Nmap 7.99 leverages an integer underflow in extension header parsing to crash the scanner.

Exploit-DB lists a denial-of-service proof of concept targeting Nmap version 7.99. The flaw is an integer underflow when handling extension headers, which can crash the scanner. No exploitation in the wild or patch details are mentioned in the listing.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

22

xHunt Campaign: New Watering Hole Identified for Credential Harvesting

Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.

Palo Alto Unit 42 identified a Kuwait government organization's webpage injected with hidden HTML referencing image paths on domains (microsofte-update.com, learn-service.com) tied to xHunt/Hisoka C2 infrastructure. When visitors loaded the page, Windows would attempt SMB/NetBIOS authentication to the remote share, allowing the operators to capture NTLM hashes that could be cracked or relayed. Related DNS redirect activity on xHunt infrastructure in 2019 pointed to additional credential-harvesting interest against Kuwaiti government email servers.

Palo Alto Unit 42·Aug 17, 13:18 UTC · Aug 17, 2026Threat actor in the wild

52

Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)

Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.

Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.

Palo Alto Unit 42·Aug 17, 12:18 UTC · Aug 17, 2026Threat actor in the wild1

72

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security Labs·Sep 14, 00:00 UTC · 2d agoMalware in the wild

58

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.

Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.

The Hacker News·Aug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild

76