ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “forgejo”

26 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 2Data breach 1
SeverityAllcritical 0high 2medium 1low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control

Wiz observed active exploitation of three JFrog Artifactory flaws used to mint admin tokens, deploy malicious plugins, and install Rust backdoors on self-hosted servers.

JFrog Artifactory flaws CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 are being actively exploited against self-hosted instances, enabling token exposure, token scope abuse, and a critical default-configuration authentication bypass. Wiz observed attackers chaining CVE-2026-42018 and CVE-2026-42016 from August 15 to September 8, 2026, creating persistent administrator accounts in under five minutes, deploying malicious Groovy plugins, and installing Rust-based backdoors. At disclosure, 67-69 percent of Wiz-monitored organizations ran vulnerable instances; fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later depending on branch.

Cyber Security Newsupdated · 2d agofirst · 5d agoExploit / PoC in the wild 7 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-82329

Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)

Forgejo 16.0.4 fixes a critical remote code execution vulnerability in the self-hosted Git forge; administrators should update promptly.

The Forgejo project released version 16.0.4 of its self-hosted Git forge with a fix for a critical remote code execution vulnerability, as stated in the published release notes. The announcement provides no CVE identifier or technical exploitation details in the indexed text. Administrators running Forgejo instances should upgrade to 16.0.4 to apply the security fix.

Lobsters · security · 5d agoVulnerability1

Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API

Flextype CMS v1.0.0-alpha.3 exposes an SSRF flaw in its /api/v1/query endpoint, letting authenticated users make the server send arbitrary HTTP requests.

Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery vulnerability in the expression-processing functionality of the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch() function, causing the server to issue outbound HTTP requests. The application does not sufficiently restrict destination hosts, enabling requests to attacker-controlled or internal targets.

Full Disclosure · 12d agoVulnerability 8 sources

[webapps] flyto_core 2.26.7 - Server-Side Request Forgery

Exploit-DB published a server-side request forgery proof of concept for flyto_core 2.26.7.

Exploit-DB lists a proof-of-concept for server-side request forgery affecting flyto_core version 2.26.7. SSRF flaws can allow attackers to make arbitrary requests from the server toward internal resources. No CVE id is cited and no in-the-wild exploitation is reported.

Exploit-DB · Aug 17, 2026Exploit / PoC

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes · 21d agoVulnerability

CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery

Apache Impala CVE-2026-54048 lets crafted Avro schema URLs trigger SSRF to internal endpoints, with responses potentially leaking via error messages.

A server-side request forgery in Apache Impala 2.0.0 through 4.5.1 on all platforms can be triggered via an Avro schema URL using an http or file:/// URI on a table. An attacker can cause Impala to send GET requests to internal endpoints it can access, and responses may be exposed through parsing error messages. Users are advised to upgrade to a fixed release.

oss-security · 7d agoVulnerabilityCVE-2026-540481

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

ZDI disclosed a server-side request forgery in Fabric.js loadFromJSON (CVE-2026-19504) that can leak sensitive information from affected implementations.

Zero Day Initiative advisory ZDI-26-588 describes a server-side request forgery vulnerability in the Fabric.js canvas library's loadFromJSON function. Exploitation requires interaction with the library and attack vectors vary by implementation, potentially exposing sensitive information. The issue is rated 4.0 on the CVSS scale and tracked as CVE-2026-19504. The advisory does not report exploitation in the wild.

ZDI Published Advisories · 23d agoVulnerabilityCVE-2026-19504

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.

CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.

The Hacker Newsupdated · 6h agofirst · 9h agoExploit / PoC in the wild 2 sourcesCVE-2026-5430

Server-Side Request Forgery (SSRF)

Fortinet discloses a low-severity SSRF in the FortiSIEM GUI allowing authenticated attackers to send requests from targeted devices.

Fortinet PSIRT advisory FG-IR-26-159, revised 2026-08-12, describes a server-side request forgery (CWE-918) in the FortiSIEM GUI, scored CVSSv3 3.4. An authenticated attacker can send HTTP requests originating from the targeted device via specially crafted requests, potentially enabling internal network probing. No CVE identifier or exploitation status is included in the advisory text.

Fortinet PSIRT · Aug 12, 2026Advisory

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Unit 42 links new Elirks backdoor variants attacking Japanese organizations to 2012 Taiwan attacks, delivered via spear-phishing PDFs exploiting Adobe Flash CVE-2011-0611.

Unit 42 analyzed new Elirks backdoor variants found in an attack on a Japanese business, noting strong similarities to 2012 attacks on Taiwanese ministries. The backdoor retrieves its C2 address from attacker-created accounts on Japanese blog and SNS services. Recent deliveries used an airline e-ticket lure named "E-TKT" with a PDF exploiting Adobe Flash CVE-2011-0611. Shared infrastructure and tactics with the Scarlet Mimic campaign suggest possible ongoing cyber espionage across East Asia.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2011-0611

Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.

Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.

Full Disclosure · 12d agoVulnerability

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.

Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.

Security Affairs · 8d agoThreat actor in the wild

Red Flags That Expose Fake North Korean IT Workers

Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.

Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.

Dark Reading · 20d agoPhishing & fraud

[webapps] webpack_devserver 5.2.5 - CSRF

Exploit-DB published a cross-site request forgery proof of concept for webpack_devserver 5.2.5.

Exploit-DB lists a webapps CSRF proof-of-concept against webpack_devserver version 5.2.5. The flaw affects the local webpack development server, where cross-site requests could be issued against it. No CVE id is cited in the entry and no active exploitation is reported.

Exploit-DB · Aug 17, 2026Exploit / PoC

North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.

ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.

ANY.RUN · 27d agoThreat actor

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.

CISA added five actively exploited vulnerabilities to the KEV catalog: CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, CVE-2026-84869 in ConnectWise ScreenConnect (CVSS 9.9), and CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS. The Artifactory bugs are chained with CVE-2026-82329 to gain administrative control, deploy malicious Groovy plugins, and install Rust-based backdoors. CERT Polska dubbed the RouterOS chain 'MikroTrick'; FCEB agencies must patch between September 13 and 25, 2026.

The Hacker Newsupdated · 2d agofirst · 3d agoExploit / PoC in the wild 2 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-84869+3 CVEs2· 1 read

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on Security · 13d agoPhishing & fraud

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.

CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.

Security Affairs · 15d agoVulnerability in the wildCVE-2026-81578CVE-2026-82078

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.

Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.

Security Affairs · 15d agoThreat actor in the wild

The Nansh0u Campaign – Hackers Arsenal Grows Stronger

Guardicore researchers detail the Nansh0u campaign's growing arsenal, with three attacks traced to South African IPs hosted by VolumeDrive.

Guardicore security researchers analyzed three attacks detected in early April through the Guardicore Global Sensor Network (GGSN). All three attacks originated from source IP addresses in South Africa hosted by the VolumeDrive ISP. The write-up catalogs the expanding arsenal and tooling used by the Nansh0u campaign attackers and includes indicators of compromise.

Akamai Blog · 7d agoThreat actor in the wild

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabz · Aug 10, 2026Malware

CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

Unauthenticated attackers can forge Apache ZooKeeper operational log lines via newline injection in crafted ensemble authentication requests.

CVE-2026-84501 (moderate severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The forged entries could mislead operators or corrupt log-based monitoring and forensics.

oss-security · 20h agoVulnerabilityCVE-2026-845011

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security Affairs · Aug 12, 2026Malware in the wild

PurpleDelta's Fraudulent Employment Operations

Recorded Future details North Korean cluster PurpleDelta using AI-generated personas and ChatGPT assistants to infiltrate companies via fraudulent employment.

Recorded Future profiles PurpleDelta, a North Korean IT worker threat cluster, in a new research report. The group uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to obtain employment at target organizations and operate covertly. The report includes key indicators of compromise and recommended mitigation strategies for defenders.

Recorded Future · 29d agoThreat actor

North Korean Hackers Deploy New Linux Espionage Toolkit

Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.

Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.

SecurityWeek · 9d agoThreat actor in the wild1

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security · 19d agoPhishing & fraud in the wild