Search: “backup-manager”

ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-626 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bzfilelist component.

The Zero Day Initiative published advisory ZDI-26-626 describing a link-following denial-of-service vulnerability in the bzfilelist component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoVulnerability 5 sourcesCVE-2026-19820

Plesk Backup Manager Flaw Lets Low-Privileged Users Gain Root Access to Servers

CVE-2026-68488 in Plesk Backup Manager lets low-privileged subscription users exploit a symlink race during restores to gain root on Linux servers.

CVE-2026-68488 is a symlink race condition in Plesk Obsidian for Linux Backup Manager during subscription-content restore operations, allowing a user with Panel and FTP access to change ownership of files outside their subscription and escalate to full root access. Affected versions are Plesk for Linux 18.0.80.6 and earlier and 18.0.79.10 and earlier; Plesk for Windows is not affected. Patches are available in 18.0.80.7 and 18.0.79.11 or later. The flaw requires valid subscription access, so it is not unauthenticated remote code execution, but successful exploitation yields complete server compromise, especially dangerous in shared-hosting and multi-tenant deployments.

Cyber Security News·Sep 13, 04:58 UTC · 3d agoVulnerabilityCVE-2026-684881

Synology ActiveProtect Manager 2.0 improves AI-driven security

Synology released ActiveProtect Manager 2.0, expanding backup coverage to EC2, Azure, Proxmox and Google Workspace, with AI anomaly detection and malware scanning coming in 2.1.

Synology launched ActiveProtect Manager 2.0 for its DP Series data protection appliances, adding platform coverage for Amazon EC2, Azure VM, Proxmox VE, Nutanix AHV and Google Workspace. The release introduces cross-platform recovery, expanded backup destinations including Azure Blob Storage, and volume-level software storage encryption. The upcoming 2.1 update will add AI/ML anomaly detection tracking change rates, mass deletions and entropy, plus pre-restore malware scanning using Microsoft Defender, Bitdefender and ESET with Auto Fallback to the last clean version.

Help Net Security·Sep 4, 00:00 UTC · 12d agoTools

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Check Point shows attackers can abuse Microsoft Defender's signed remediation driver for arbitrary Ring 0 file and registry operations without exploiting any vulnerability.

Check Point Research presents BTR Reforged, a technique that repurposes Microsoft Defender's trusted remediation driver into an attacker-controlled kernel operation primitive. The signed driver can be instructed to execute arbitrary file and registry operations from Ring 0 without exploits, vulnerabilities, or memory corruption. The work demonstrates how trusted security components can be turned into attacker primitives, which is relevant for defenders assessing driver abuse risks.

Check Point Research·Aug 20, 13:07 UTC · 27d agoResearch

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security·Sep 15, 05:30 UTC · 1d agoTools1

Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)

ArXiv paper shows the trusting-trust compiler backdoor technique can compromise an entire Linux distribution via the strip utility.

The paper (arXiv 2607.24888) demonstrates that Ken Thompson's trusting-trust attack, long viewed as a compiler-specific threat, can backdoor an entire Linux distribution by targeting the strip utility. A compromised tool reproduces its backdoor in subsequent rebuilds of itself, generalizing the attack surface beyond compilers. The finding has supply-chain implications for build reproducibility and distribution trust, though it is a research result with no observed real-world exploitation.

Lobsters · security·Sep 5, 10:58 UTC · 11d agoResearch

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabz·15:13 UTC · 3h agoThreat actor in the wild

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky reports APT group HoneyMyte upgraded its CoolClient backdoor with a kernel-mode Windows rootkit hiding processes, files, and network connections.

Kaspersky researchers discovered a new variant of the HoneyMyte CoolClient backdoor equipped with a kernel-mode Windows rootkit driver. The rootkit hides malicious processes, files, and network connections from security tools and threat analysts, significantly increasing the backdoor's stealth. The report documents an upgrade to the APT group's backdoor tooling with a kernel-level implant.

Kaspersky Securelist·Aug 14, 09:00 UTC · Aug 14, 2026Threat actor in the wild

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Researchers propose provenance-guided selective replay letting LLM agents forget revoked information without restarts, matching full reset behavior.

The paper formalizes execution-state unlearning for stateful LLM agents, requiring that agents behave as if a revoked memory record was never observed across transcripts, compressed memory, tool plans, and KV caches. It proves exact unlearning requires at least T-τ+1 recomputed transitions and that Provenance-Guided Selective Replay attains this bound via a provenance graph, KV cache cropping, and sanitized replay. In audits across three agent suites, nine baselines, and three model families, memory deletion left leakage unchanged, instruction-based forgetting collapsed under elicitation (Leak@probes = 1.00), and selective replay matched full resets at up to 9x fewer recomputed tokens.

arXiv cs.CR·Sep 4, 08:31 UTC · 12d agoAI safety & security1

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker News·Sep 6, 08:34 UTC · 10d agoMalware in the wild

Product showcase: Enpass Password Manager breaks away from the proprietary cloud model

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Industry

Veeam security advisory (AV26-855)

Canada's Cyber Centre advisory AV26-855 says Veeam Backup & Replication and Veeam ONE vulnerabilities are resolved in 13.0.3 and 13.1 updates.

Advisory AV26-855, dated August 27, 2026, states that as of August 25 Veeam is affected by vulnerabilities in Backup & Replication (prior to 13.0.3 build 13.0.3.63 and prior to 13.1 build 13.1.0.411) and Veeam ONE (prior to or equal to 13.0.2.6723 and 13.1.0.7034). Fixes are documented in KB4902 (Veeam Backup & Replication 13.1) and KB4905 (Veeam ONE 13.1 Patch 0). The Cyber Centre urges users and administrators to apply the available updates. No CVE identifiers or exploitation details are given.

Canadian Centre for Cyber Security·Aug 27, 14:03 UTC · 20d agoAdvisory

Re: Retrospective by 'gpg.fail' authors

Peter Gutmann replies to gpg.fail retrospective, pointing to PGP's arbitrary packet format as root of many past vulnerabilities.

Peter Gutmann posted a follow-up on oss-security referencing an Hacker News discussion of the gpg.fail authors' retrospective. The thread argues that a recurring source of severe PGP vulnerabilities is the format's permissive packet system, where a PGP message is a practically arbitrary stream of packets. This is discussion and retrospective analysis rather than a new disclosure.

oss-security·updated 17:16 UTC · 1h ago·first Sep 13, 13:57 UTC · 3d agoResearch 8 sources4

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CR·Sep 4, 11:23 UTC · 12d agoResearch

DeepZero: Open-source hunting for vulnerable Windows drivers

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security·05:30 UTC · 13h agoTools

Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.

Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.

Palo Alto Unit 42·Aug 17, 13:18 UTC · Aug 17, 2026Phishing & fraud in the wild1

Cron Job Injection in Remote Backup

Fortinet FortiSandbox command injection flaw (CVSS 6.7) in remote backup cron jobs lets privileged attackers execute arbitrary code via crafted HTTP requests.

Fortinet advisory FG-IR-26-167 discloses a command injection vulnerability (CWE-77, CVSSv3 6.7) in FortiSandbox's remote backup cron job functionality. A privileged attacker can execute unauthorized code or commands via crafted HTTP requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online·Sep 10, 11:51 UTC · 6d agoMalware in the wildCVE-2025-53521

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.

In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.

Zscaler ThreatLabz·Aug 17, 14:06 UTC · Aug 17, 2026Malware in the wild1

When LLM Decompilers Recompile More and Preserve Less

Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.

The paper demonstrates that LLM-based decompilers can produce code that recompiles and passes all shipped tests yet diverges on other legitimate inputs—4.9% overall and up to 13% for one system—and can make disclosed vulnerabilities vanish without a visible crash. Across 300 real GitHub functions and 287 CVE-grounded functions, a refinement LLM lifted Ghidra's build rate from 75% to 90% while Matched rate fell from 74% to 62%, with up to one tenth of vulnerabilities showing Crash Absence. Decompile-Diverge detects these gaps by synthesizing drivers, growing fuzzing corpora from the reference, and rerunning decompiled code on identical inputs.

arXiv cs.CR·Sep 4, 17:16 UTC · 12d agoResearch

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security Affairs·Aug 16, 17:18 UTC · Aug 16, 2026Threat actor in the wild1

Mapping the malware blast radius a single alert won't show you

Help Net Security·Aug 9, 04:34 UTC · Aug 9, 2026Malware