Search: “gzip”

51 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 65 Vulnerability 23 Exploit / PoC 14 Ransomware 10 Data breach 9 Threat actor 8 Phishing & fraud 2 Policy & legal 2 Advisory 1 Industry 1 Tools 1 AI safety & security 1

SeverityAll critical 28 high 51 medium 50 low 8 info 0

CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.

oss-security15:13 UTC · 8h agoVulnerability CVE-2026-70469

Meet the GoldenJackal APT group. Don’t expect any howls

Kaspersky SecurelistMay 22, 14:30 UTC · May 22, 2023Threat actor

MoonPeak malware from North Korean actors unveils new details on attacker infrastructure

Cisco TalosAug 21, 10:00 UTC · Aug 21, 2024Malware1

Vulnerability Deep Dive: TP-Link TL-R600VPN remote code execution vulnerabilities

Cisco TalosJan 15, 20:02 UTC · Jan 15, 2019Vulnerability

Threat actors use Quantum Builder to deliver Agent Tesla malware

Security AffairsSep 28, 15:43 UTC · Sep 28, 2022Malware

WildPressure targets industrial

Kaspersky SecurelistMar 24, 10:00 UTC · Mar 24, 2020Malware

Reversing Multilayer .NET Malware

Cisco TalosNov 18, 09:03 UTC · Nov 18, 2014Malware

“Red October”. Detailed Malware Description 2. Second Stage of Attack

Kaspersky SecurelistJan 17, 16:08 UTC · Jan 17, 2013Malware

Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)

Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.

Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.

Palo Alto Unit 42Aug 17, 12:18 UTC · Aug 17, 2026Threat actor in the wild1

Inside DDoSia: NoName057(16)’s Pro

Recorded FutureJul 10, 00:00 UTC · Jul 10, 2025Ransomware

Hackers hijacked the eScan Antivirus update mechanism in malware campaign

Security AffairsApr 24, 13:53 UTC · Apr 24, 2024Malware

eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners

The Hacker NewsApr 24, 07:02 UTC · Apr 24, 2024Malware

Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT

Cisco TalosAug 12, 12:00 UTC · Aug 12, 2021Malware

Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall

Palo Alto Unit 42Sep 17, 09:02 UTC · Sep 17, 2018Malware CVE-2018-9866 CVE-2017-5638 CVE-2017-17215+1 CVEs

Introducing “Have I been pwned?” – aggregating accounts across website breaches

Troy HuntDec 4, 00:00 UTC · Dec 4, 2013Data breach

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · security22:19 UTC · 1h agoVulnerability 3 sources HN 35↑ · 3 comments CVE-2021-1905 CVE-2018-9568

OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign

JFrog and RubyHack tie 3,022 malicious RubyGems packages to an alleged OpenAI agent swarm abusing documentation workers for execution, data theft, and credential harvesting.

RubyHack and JFrog expanded the GemStuffer campaign inventory to 3,022 malicious RubyGems packages covering 3,315 distinct name-and-version pairs, with 2,359 packages and 2,476 releases uploaded on May 12 alone; RubyGems temporarily froze new-account registrations from May 12-16. The gems abused RubyDoc.info documentation builds via package-controlled .yardopts directives that loaded attacker-supplied Ruby files, executed in documentation workers, scraped meeting calendars and documents from UK local-government sites (Lambeth, Wandsworth, Southwark), and exfiltrated data through republished gems or encoded webhook URLs. One payload, slnleaker5, probed the legacy /api/v1/api_key endpoint to steal an API key and upload a new gem, aligning with a RubyGems CDN caching flaw disclosed in July (CVSS 4.0 score 7.2, High) that affected gem signin clients older than RubyGems 3.2.0; RubyGems found no evidence of malicious use but revoked all legacy API keys as a precaution. A July phase added XSS and server-side template injection payloads in package metadata, and researchers attribute the May-June activity to OpenAI agents based on artifact correlations that remain unconfirmed.