Search: “remote-work”

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Researchers expose DPRK remote IT worker infiltration tactics, including forged identities and AI-assisted interview behavior.

A joint investigation by Mauro Eldritch, Heiner García, and ANY.RUN hired suspected DPRK developers linked to Lazarus Group into controlled sandboxes, revealing forged IDs, remote-access tools, AI-assisted workflows, and VPN/VPS infrastructure. The FBI is investigating a North Korean remote IT worker who reportedly worked for a U.S. federal agency. The article outlines verification steps and indicators including VPS and AstrillVPN exit node IPs.

The Hacker News·Aug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security·Aug 28, 00:00 UTC · 19d agoPhishing & fraud in the wild

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on Security·Sep 3, 11:18 UTC · 13d agoPhishing & fraud

Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update

Microsoft's September 2026 Patch Tuesday updates (KB5124008) can break Remote Desktop Services, causing RDP failures and freezes across Windows clients and servers.

Microsoft confirmed its September 2026 security updates, including KB5124008 for Windows 11 24H2/25H2, introduced a reliability regression where RDP connections fail after several minutes and servers hang at the 'Please wait for the Remote Desktop Configuration' screen. MMC, RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page may also stop responding. The issue affects Windows 10/11 clients and Windows Server 2012 through 2025; Microsoft marked it Mitigated on September 11 and is developing a permanent fix, with VM restart offered as a temporary workaround.

Cyber Security News·Sep 14, 10:43 UTC · 2d agoAdvisory

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.

Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

[remote] ipTIME A3004T - Remote Code Execution

A remote code execution exploit was published for ipTIME A3004T routers, a flaw relevant to internet-facing devices.

Exploit-DB published exploit #52644 for the ipTIME A3004T router, demonstrating remote code execution. Router RCE flaws are typically exploitable by unauthenticated attackers on exposed devices. The disclosure text does not report exploitation in the wild.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

Cron Job Injection in Remote Backup

Fortinet FortiSandbox command injection flaw (CVSS 6.7) in remote backup cron jobs lets privileged attackers execute arbitrary code via crafted HTTP requests.

Fortinet advisory FG-IR-26-167 discloses a command injection vulnerability (CWE-77, CVSSv3 6.7) in FortiSandbox's remote backup cron job functionality. A privileged attacker can execute unauthorized code or commands via crafted HTTP requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.

CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.

oss-security·Sep 13, 14:35 UTC · 3d agoVulnerabilityCVE-2026-824353

Red Flags That Expose Fake North Korean IT Workers

Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.

Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.

Dark Reading·Aug 26, 19:21 UTC · 21d agoPhishing & fraud

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit-DB published an authenticated remote code execution exploit targeting Metabase version 0.61.0.

A new Exploit-DB entry (ID 52680) describes an authenticated remote code execution vulnerability in Metabase 0.61.0. The listing provides minimal detail, but authenticated RCE in a widely deployed BI tool is notable for defenders running exposed instances. No CVE id or in-the-wild exploitation is mentioned in the listing.

Exploit-DB·Sep 3, 00:00 UTC · 13d agoExploit / PoC1

[remote] PCMan 2.0.7 - Buffer Overflow

A remote buffer overflow in PCMan 2.0.7 has a public proof-of-concept exploit published on Exploit-DB.

Exploit-DB listing 52657 discloses a remote buffer overflow vulnerability in PCMan version 2.0.7. A proof-of-concept exploit is publicly available, allowing attackers to potentially crash or compromise affected instances. The listing includes no CVE identifier and reports no observed exploitation in the wild.

Exploit-DB·Aug 18, 00:00 UTC · 29d agoExploit / PoC1

Citrix expands Platform Flex with observability and secure developer services

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026Industry

Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...

ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.

Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 19:06 UTC · 9d agoVulnerabilityCVE-2026-33824

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

A public proof-of-concept demonstrates remote code execution in Ghost CMS 6.19.0, the widely deployed open-source publishing platform.

Exploit-DB lists a remote code execution proof of concept affecting Ghost CMS version 6.19.0. Ghost is a popular open-source platform used by publishers and blogs worldwide. The listing does not cite a CVE id or report in-the-wild exploitation.

Exploit-DB·Sep 2, 00:00 UTC · 14d agoExploit / PoC1

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 published technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint.

Rapid7 released an analysis covering CVE-2026-63520, a remote code execution flaw affecting Microsoft SharePoint. SharePoint is widely deployed in enterprise environments, making exposed, unpatched servers a likely target for exploitation. Defenders should consult the Rapid7 write-up for exposure checks and patch guidance. The available text does not confirm active exploitation at this time.

Rapid7 Blog·Aug 24, 16:18 UTC · 23d agoVulnerabilityCVE-2026-635201

RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress

Huntress reports RMM tool abuse jumped 277% and now appears in nearly 40% of its investigations as attackers leverage trusted remote access software.

Huntress observed a 277% increase in remote monitoring and management (RMM) tool abuse, with such abuse now present in nearly 40% of its investigations. Attackers exploit legitimate, trusted remote access tools to gain access and persistence, complicating detection because the software is expected on endpoints. The write-up explains common abuse patterns and defenses against them.

Huntress·Aug 21, 17:00 UTC · 26d agoThreat actor in the wild

Microsoft: September updates cause RDS failures on Windows Server

Microsoft confirms September 2026 Patch Tuesday updates break Remote Desktop Services on Windows Server 2012+; Group Policy mitigations and rollback workarounds available.

Microsoft confirmed that September 2026 Patch Tuesday security updates cause Remote Desktop Services failures on Windows Server 2012 and later, plus Windows 10 and Windows 11. Symptoms include unstable RDS, RDP connection failures after several minutes, sign-in issues, servers hanging at 'Please wait for the Remote Desktop Configuration,' and unresponsive MMC, RDS Licensing Diagnoser, and File Explorer. Microsoft published per-version Group Policy mitigations (covering KBs such as KB5124008, KB5122880, KB5122878, KB5122871, KB5122882, KB5122876, KB5123099, KB5123065, KB5123066) and suggests restarting affected VMs. Rolling back the updates restores RDS functionality but removes this month's security fixes.

BleepingComputer·updated Sep 15, 08:40 UTC · 1d ago·first Sep 14, 09:50 UTC · 2d agoAdvisory 3 sources1

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs details a pre-authentication remote code execution flaw, tracked as CVE-2026-8452, in Citrix NetScaler appliances.

watchTowr Labs published technical analysis of a pre-authentication remote code execution vulnerability in Citrix NetScaler, tentatively assigned CVE-2026-8452. The CVE identifier is marked as provisional in the write-up. No confirmation of in-the-wild exploitation is provided in the available text.

watchTowr Labs·Aug 14, 07:08 UTC · Aug 14, 2026Exploit / PoCCVE-2026-8452

Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)

Forgejo 16.0.4 fixes a critical remote code execution vulnerability in the self-hosted Git forge; administrators should update promptly.

The Forgejo project released version 16.0.4 of its self-hosted Git forge with a fix for a critical remote code execution vulnerability, as stated in the published release notes. The announcement provides no CVE identifier or technical exploitation details in the indexed text. Administrators running Forgejo instances should upgrade to 16.0.4 to apply the security fix.

Lobsters · security·Sep 10, 17:40 UTC · 6d agoVulnerability1

[webapps] Langflow 1.10.0 - RCE

A public proof-of-concept demonstrates remote code execution in Langflow 1.10.0, the open-source AI workflow builder.

Exploit-DB lists a remote code execution proof of concept targeting Langflow version 1.10.0. Langflow is a widely used open-source tool for building AI agent and LLM workflows. The listing does not include a CVE id or evidence of in-the-wild exploitation, but RCE in AI development tooling is relevant to teams running it in production.

Exploit-DB·Sep 2, 00:00 UTC · 14d agoExploit / PoC1

[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.

Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.

Exploit-DB·Aug 25, 00:00 UTC · 22d agoExploit / PoCCVE-2026-421671

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News·Sep 4, 14:51 UTC · 12d agoThreat actor in the wild

Remote Desktop Services Failures on Windows Servers Following September Update

September 2026 Patch Tuesday updates cause Windows Server 2019/2022/2025 RDS sessions to freeze, forcing administrators to roll back.

Cumulative updates KB5122876 (Windows Server 2019), KB5122882 (2022), and KB5122871 (2025) trigger Remote Desktop Services freezes hours after boot, with RDP connections hanging at 'Connecting…' and Event ID 20498 logged. Administrators trace the fault to an apparent deadlock in RDPSERVERBASE!WDLIB_Close during session teardown; only hard resets restore service and the issue recurs. The same September release patched roughly 973 vulnerabilities, including two actively exploited zero-days (CVE-2026-81963, CVE-2026-85880, both in CISA's KEV) and a critical RDS RCE, CVE-2026-69525 (CVSS 9.8). Workarounds include DISM-based removal of the update or an unofficial FeatureManagement registry key disabling the suspected audio-redirection code path; Microsoft has not yet confirmed the bug.

Cyber Security News·Sep 11, 04:46 UTC · 5d agoVulnerability in the wild 2 sourcesCVE-2026-81963CVE-2026-85880CVE-2026-69525+1 CVEs1

Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code

Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.

Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.

Cyber Security News·Sep 9, 10:10 UTC · 7d agoVulnerabilityCVE-2026-69485

[webapps] Grav CMS 2.0.7 - RCE

A proof-of-concept exploit for remote code execution in Grav CMS 2.0.7 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for a remote code execution vulnerability in Grav CMS 2.0.7. The listing is for web applications and provides code defenders can use to reproduce the issue. No exploitation in the wild or CVE assignment is stated in the listing.

Exploit-DB·Sep 1, 00:00 UTC · 15d agoExploit / PoC

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.

CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.

oss-security·Sep 15, 20:04 UTC · 1d agoVulnerabilityCVE-2026-867921

Insights into Suspected DPRK Workers

Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.

Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.

Huntress·Aug 26, 04:00 UTC · 21d agoThreat actor in the wild

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes·Aug 25, 16:11 UTC · 22d agoVulnerability

North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.

ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.

ANY.RUN·Aug 20, 07:58 UTC · 27d agoThreat actor

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 and Microsoft disclose CVE-2026-63520, a SharePoint RCE that chains with CVE-2026-55040 for unauthenticated RCE; patches released.

Rapid7 Labs' zero-day research project on Microsoft SharePoint uncovered two vulnerabilities that, when chained, achieve unauthenticated remote code execution. The second flaw in the chain, CVE-2026-63520, affects all supported versions of Microsoft SharePoint and has been disclosed and fixed. The first chain component, CVE-2026-55040, was disclosed by Rapid7 and Microsoft the previous month.

Rapid7 Blog·Aug 11, 13:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-63520CVE-2026-550401