Search: “web-servers”

39 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 14 Exploit / PoC 12 Ransomware 6 Threat actor 3 Malware 2 Phishing & fraud 1 Data breach 1 AI safety & security 1 Policy & legal 1

SeverityAll critical 14 high 17 medium 10 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.

The Hacker Newsupdated Sep 15, 12:19 UTC · 1d agofirst Sep 15, 06:52 UTC · 1d agoVulnerability 2 sources CVE-2026-48172 CVE-2026-54420

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 15:00 UTC · 2h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540

Php Servers And Iot Devices Cyber

Infosecurity Magazine headline reports a cyber campaign targeting PHP servers and IoT devices; no further details available.

The Infosecurity Magazine headline indicates a cyber campaign against PHP servers and IoT devices. Article text was unavailable, so techniques, scale and attribution are unknown.

Infosecurity MagazineAug 16, 00:00 UTC · Aug 16, 2026Malware1

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.

Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.

The Hacker NewsSep 5, 20:14 UTC · 10d agoExploit / PoC in the wild

Trends in Web Threats: Old Web Skimmer Still Active Today

Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.

Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.

Palo Alto Unit 42Aug 17, 13:05 UTC · Aug 17, 2026Research

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.

Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.

Security AffairsSep 7, 17:49 UTC · 8d agoExploit / PoC in the wild

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security NewsSep 15, 13:52 UTC · 1d agoVulnerability

Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information

Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.

Fortinet disclosed CVE-2026-26084 (advisory FG-IR-26-166), a CWE-284 improper access control flaw in the GUI of FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS, rated 8.9 CVSS v3.1. An unauthenticated remote attacker can send specially crafted HTTP requests to control NAT rules and expose sensitive information. Affected versions include FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 (plus Cloud/PaaS 5.0.4-5.0.5), fixed in 4.4.9 and 5.0.6. Fortinet researcher Adham El Karn found the flaw internally and the September 8 advisory reports no known exploitation.

GBHackersSep 9, 07:15 UTC · 7d agoVulnerability CVE-2026-26084

How MCP Servers Can Expose Enterprise Secrets

MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.

The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.

The Hacker NewsAug 17, 11:58 UTC · Aug 17, 2026AI safety & security CVE-2025-6514

Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons

Check Point links Chinese-speaking cluster Gambling Goblin to SEO-fraud compromises of Brazilian government sites via malicious Apache modules since mid-2025.

Check Point Research dubbed the cluster Gambling Goblin and linked it with medium-to-high confidence to Earth Berberoka, a Chinese-speaking group Trend Micro documented in 2022, citing shared oRAT tooling, Chinese-language artifacts, and domains mimicking trusted tech brands. Custom Apache modules installed on compromised Brazilian government and education servers acted as reverse proxies, routing selected visitors to gambling and sports-betting phishing pages impersonating Google Play, the Microsoft Store, and Amazon while stripping CSP headers. The broader Linux toolkit included the DownPro downloader, AlphaAgent and oRAT backdoors, the 3snake-based PasswordHarvester credential stealer, and an SSH brute-forcer, with operations extending to Vietnamese, Spanish, and English phishing pages.

Infosecurity MagazineSep 2, 14:00 UTC · 14d agoThreat actor

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42Aug 17, 13:05 UTC · Aug 17, 2026Research

New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server

cPanel disclosed critical SQL injection CVE-2026-67401 in EmailTrack, letting authenticated users with mail privileges gain root code execution; patched builds available.

cPanel disclosed CVE-2026-67401 on September 8, 2026, a critical SQL injection in the EmailTrack feature that monitors email delivery and routing. An authenticated attacker holding a valid cPanel account with mail-related privileges can create arbitrary files and achieve code execution as root, enabling full compromise of hosting servers and exposure of co-tenant customers. All supported cPanel/WHM versions before specific patched builds (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and 11.138.1.9 WP2) are affected; upgrading is the primary mitigation. No exploitation was reported at disclosure.

Cyber Security NewsSep 9, 08:37 UTC · 7d agoVulnerability CVE-2026-67401

[webapps] webpack_devserver 5.2.5 - CSRF

Exploit-DB published a cross-site request forgery proof of concept for webpack_devserver 5.2.5.

Exploit-DB lists a webapps CSRF proof-of-concept against webpack_devserver version 5.2.5. The flaw affects the local webpack development server, where cross-site requests could be issued against it. No CVE id is cited in the entry and no active exploitation is reported.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild

Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.

CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.

Cyber Security Newsupdated 15:50 UTC · 1h agofirst 13:12 UTC · 4h agoExploit / PoC in the wild 2 sources CVE-2026-89026

CISA Warns of Critical GitLab Vulnerability Exploited in Attacks

CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.

CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.

GBHackersupdated Sep 15, 00:52 UTC · 1d agofirst Sep 12, 05:17 UTC · 4d agoExploit / PoC in the wild 18 sources CVE-2026-857061

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.

CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.

The Hacker NewsAug 26, 11:55 UTC · 21d agoVulnerability CVE-2026-19913 CVE-2026-199121

Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation

Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.

Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.

GBHackersSep 9, 09:12 UTC · 7d agoThreat actor in the wild2

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)

0day Rubbish Research Team disclosed a CVSS 7.2 local privilege escalation (CWE-250) in Royal Server 5.04.50529.0 to LocalSystem.

Researchers publicly disclosed a local privilege escalation vulnerability in Royal Server 5.04.50529.0, classified as CWE-250 (execution with unnecessary privileges) with a CVSS score of 7.2. The flaw allows escalation to LocalSystem on the execution path without credential override. The disclosure was posted to the Full Disclosure mailing list on September 8, 2026; no patch or CVE id was mentioned in the notice.

Full DisclosureSep 8, 17:31 UTC · 8d agoVulnerability

[webapps] Bludit CMS - Stored XSS

A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.

Exploit-DB published a webapps entry for a stored XSS flaw in Bludit CMS, an open-source flat-file content management system. Stored XSS allows an attacker to persist malicious scripts that execute in other users' browsers, potentially enabling session theft or unauthorized actions. The listing did not include a CVE identifier or affected version range.

Exploit-DBSep 1, 00:00 UTC · 15d agoExploit / PoC1

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker NewsAug 27, 18:33 UTC · 19d agoThreat actor in the wildCVE-2022-0995 CVE-2021-3156 CVE-2015-5287+8 CVEs

[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)

A proof-of-concept cross-site scripting exploit for C-MOR video surveillance software 6.0104 appeared on Exploit-DB.

Exploit-DB published a proof-of-concept cross-site scripting (XSS) exploit against C-MOR 6.0104, an IP video surveillance platform. The listing demonstrates script injection in the web interface, but the provided text contains no CVE identifier or indication of active exploitation. Successful XSS against the surveillance console could enable session hijacking or manipulation of the monitoring interface.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC1

A revisit of remote Spectre attacks on Cloudflare Workers

Cloudflare details its 2024-2025 reassessment of remote Spectre attacks on Workers, covering new attack primitives and hardened defenses.

Cloudflare reassessed the feasibility of remote Spectre attacks against its Workers serverless infrastructure across 2024 and 2025. The write-up describes new attack primitives including Spectre gadgets, remote timers, and techniques for achieving co-location with victim workloads. It also explains new defenses that further harden Cloudflare Workers against speculative-execution side channels.

Cloudflare BlogAug 19, 16:00 UTC · 28d agoResearch

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated Sep 11, 14:17 UTC · 5d agofirst Sep 11, 09:07 UTC · 5d agoMalware in the wild 2 sources CVE-2026-46300 CVE-2026-43284 CVE-2026-31431

12 Best Enterprise Browsers Compared (2026): Features & Pricing

2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.

Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.

GBHackersSep 15, 06:32 UTC · 1d agoTools

TCRF taken offline by DDoS attack after Claude user ban

The Cutting Room Floor game wiki was taken offline by a DDoS attack after a user leveraging Claude was banned.

The Cutting Room Floor (TCRF), a wiki documenting unused video game content, was knocked offline by a distributed denial-of-service attack. The attack reportedly followed moderation action banning a user who was using Anthropic's Claude. The incident highlights friction between community sites and AI-assisted users and tools.

Lobsters · securityAug 28, 21:26 UTC · 18d agoAI safety & security in the wild

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.

The Hacker NewsSep 2, 13:44 UTC · 14d agoThreat actor in the wild

xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection

xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.

Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.

Palo Alto Unit 42Aug 17, 13:19 UTC · Aug 17, 2026Threat actor

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero

The Hacker NewsAug 7, 11:25 UTC · Aug 7, 2026Exploit / PoC CVE-2026-63078

You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements

Evaluation of 500k Tranco and 24.8M Common Crawl hosts shows Top-N domain sampling biases web security measurements; probability sampling yields unbiased estimates.

The study is the first comprehensive investigation of how sampling strategies affect web security measurement conclusions, comparing datasets and strategies across 500k Tranco domains and 24.8M Common Crawl hosts. It shows Top-N selection does not reflect the overall web distribution and may bias observed vulnerability rates, while probability-based strategies yield stable, unbiased prevalence and impact estimates. Hybrid sampling offers no advantage because its deterministic prefix consistently hurts accuracy, and the authors propose an adaptive probability-based strategy effective even when target prevalence is unknown.

arXiv cs.CRSep 10, 08:21 UTC · 6d agoResearch1

terms.txt: A Consent and Compensation Protocol for Agentic Web Access

terms.txt specifies a robots.txt-style protocol for per-path, per-purpose AI crawler consent and compensation, with enforcement adding 0.20-0.65 ms per request.

The paper documents that automated clients now make up most web requests, that training dominates Cloudflare-classified crawling, and that the largest AI platforms fetch thousands of pages per returned visitor while robots.txt cannot express identity, purpose, terms, or price. It specifies terms.txt plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

arXiv cs.CRSep 10, 07:01 UTC · 6d agoResearch

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos tracks UAT-10147, a Chinese-speaking cybercrime group exploiting vulnerable web servers and using agentic AI in post-compromise operations.

Cisco Talos identified a Chinese-speaking cybercrime group tracked as UAT-10147 that targets a wide range of vulnerable web servers. The report maps affected countries and analyzes the impact of BadIIS infections on compromised servers. It also documents the attack chain and emerging use of agentic AI during post-compromise activities.

Cisco TalosAug 20, 10:00 UTC · 27d agoThreat actor in the wild

'HTTP Terminator' Hunts for Novel Desync Attacks

PortSwigger's James Kettle discusses HTTP Terminator, an AI-powered open source tool that uncovered new HTTP request-smuggling (desync) techniques.

PortSwigger researcher James Kettle spoke with Dark Reading about HTTP Terminator, an AI-powered open source tool built to hunt for novel HTTP desync vulnerabilities. The tool has already discovered new HTTP request-smuggling techniques, extending Kettle's prior desync research.

Dark ReadingAug 26, 19:54 UTC · 20d agoTools

Over 36,000 exposed Plex servers vulnerable to recent flaws

Over 36,000 internet-exposed Plex Media Server instances remain unpatched against recently disclosed vulnerabilities, leaving them open to attack.

BleepingComputer reports that more than 36,000 Plex Media Server instances exposed to the internet have not yet applied patches for multiple recently disclosed security vulnerabilities. These unpatched, publicly reachable servers remain vulnerable to attacks until administrators install the available updates. The report underscores slow patch adoption for internet-facing media server software.

BleepingComputerSep 9, 10:11 UTC · 7d agoVulnerability

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm CenterSep 10, 12:58 UTC · 6d agoMalware in the wild 2 sources1

12 Best Server Security Solutions Compared (2026): Features & Pricing

GBHackers ranks 12 server security solutions for 2026, naming CrowdStrike and SentinelOne as server EDR leaders and Trend Micro Deep Security top for virtual patching.

The guide scores 12 server security platforms across five weighted criteria, with detection and response depth and Linux parity weighted 25% each. CrowdStrike and SentinelOne lead server EDR, Trend Micro Deep Security is highlighted for virtual patching of unpatchable estates, and Microsoft Defender for Servers is noted for Azure and hybrid economics. It is an editorial assessment comparing features and pricing models rather than a lab test.

GBHackersupdated 09:52 UTC · 7h agofirst Sep 11, 07:24 UTC · 5d agoIndustry 14 sources1

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker NewsSep 7, 18:12 UTC · 8d agoMalware in the wild1