Search: “jar”

91 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 97 Vulnerability 65 Industry 40 Exploit / PoC 31 Ransomware 30 Threat actor 20 Policy & legal 20 Data breach 12 Phishing & fraud 10 Research 4 AI tools & infra 4 Advisory 1 Tools 1 AI research 1

SeverityAll critical 87 high 95 medium 91 low 58 info 5

CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.

CVE-2026-82428 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0, rated important. Dependency artifacts uploaded with storm jar --artifacts were stored under blob keys derived only from the Maven coordinate, making keys identical and predictable for every cluster user. When a blob already existed, the uploader suppressed the collision, enabling a tenant to substitute dependency jars later executed by other tenants in cross-tenant attacks. Fixed in version 3.1.0.

oss-securitySep 13, 14:23 UTC · 2d agoVulnerability CVE-2026-82428

Malware researchers analyzed an intriguing Java ATM Malware

Security AffairsJul 30, 09:26 UTC · Jul 30, 2019Malware

First step in cross

Kaspersky SecurelistMar 3, 15:57 UTC · Mar 3, 2016Malware

Cybercriminals Using Polyglot Files in Malware Distribution to Fly Under the Radar

The Hacker NewsJan 15, 00:00 UTC · Jan 15, 2023Malware

The Story of Manuel’s Java RAT

Security AffairsJan 25, 18:54 UTC · Jan 25, 2019Malware

Continued analysis of the LightsOut Exploit Kit

Cisco TalosMay 2, 17:24 UTC · May 2, 2014Exploit / PoC CVE-2013-2465 CVE-2012-1723 CVE-2013-2423+1 CVEs

Fake Trump sex video used to spread QNode RAT

Security AffairsJan 6, 16:02 UTC · Jan 6, 2021Malware

Trump Sex Scandal Video Is a RAT

Infosecurity MagazineJan 7, 19:31 UTC · Jan 7, 2021Malware

Malware expert analyzed a threat that went undetected for at least 2 years

Security AffairsAug 20, 13:58 UTC · Aug 20, 2018Malware

Analyzing a variant of the GM Bot Android malware

Security AffairsJan 6, 21:22 UTC · Jan 6, 2017Malware

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content

The Hacker NewsJun 29, 04:18 UTC · Jun 29, 2026Malware

Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan

The Hacker NewsMar 23, 10:44 UTC · Mar 23, 2026Malware

Hackers Using Fake Trump's Scandal Video to Spread QNode Malware

The Hacker NewsJan 6, 14:00 UTC · Jan 6, 2021Malware

CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Apache Storm Nimbus 3.0.0 before 3.1.0 allows arbitrary server-side file read via unvalidated uploadedJarLocation in submitTopology calls.

CVE-2026-82426 (rated important) affects Apache Storm Nimbus (org.apache.storm:storm-server) versions 3.0.0 before 3.1.0. Nimbus accepted the uploadedJarLocation argument of submitTopology/submitTopologyWithOpts as a server-side path and opened it directly, without verifying the caller had actually uploaded that file via beginFileUpload. This enables arbitrary file read on the Nimbus host; the issue is fixed in version 3.1.0.

oss-securitySep 13, 14:19 UTC · 2d agoVulnerability CVE-2026-824261

A new Adwind variant involved in attacks on US petroleum industry

Security AffairsOct 2, 11:34 UTC · Oct 2, 2019Malware

Malware researchers decrypted the Qrypter Payload

Security AffairsMar 29, 12:35 UTC · Mar 29, 2019Malware

Anti-decompiling techniques in malicious Java Applets

Kaspersky SecurelistAug 19, 14:14 UTC · Aug 19, 2013Vulnerability CVE-2013-0422

Sophisticated Malware Campaign Targets Windows and Linux Systems

Infosecurity MagazineJun 2, 15:30 UTC · Jun 2, 2025Malware

Kazakh Organizations Targeted by 'Bloody Wolf' Cyber Attacks

The Hacker NewsAug 5, 12:42 UTC · Aug 5, 2024Malware

Alert: Cybercriminals Deploying VCURMS and STRRAT Trojans via AWS and GitHub

The Hacker NewsMar 15, 00:00 UTC · Mar 15, 2024Malware

1,500+ Minecraft Players Infected by Java Malware Masquerading as Game Mods on GitHub

The Hacker NewsJun 18, 16:16 UTC · Jun 18, 2025Malware

Minecraft Users Warned of Malware Targeting Modpacks

Infosecurity MagazineJun 9, 11:15 UTC · Jun 9, 2023Malware

Outlook for Web Bans 38 More File Extensions in Email Attachments

The Hacker NewsSep 26, 19:21 UTC · Sep 26, 2019Vulnerability

Experts uncovered a malspam campaign using Boeing 737 Max crash

Security AffairsMar 17, 10:34 UTC · Mar 17, 2019Threat actor

Hackers target financial firms hosting payloads on Google Cloud Storage

Security AffairsDec 26, 09:15 UTC · Dec 26, 2018Malware

Stealth CrossRAT malware targets Windows, MacOS, and Linux systems

Security AffairsJan 26, 08:07 UTC · Jan 26, 2018Malware

President Obama executive order ejected 35 Russians out of US

Security AffairsDec 30, 10:23 UTC · Dec 30, 2016Policy & legal

Kaspersky Security Bulletin. Spam and phishing in 2015

Kaspersky SecurelistFeb 5, 10:58 UTC · Feb 5, 2016Phishing & fraud

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

McAfee Labs reports Weedhack malware spread via spoofed Minecraft client websites using SEO poisoning, with over 6,300 blocked access attempts.

McAfee Labs found multiple lookalike websites impersonating legitimate Minecraft clients (Glazed, Radium, Meteor, Nova, Xenon) still distributing Weedhack, a multi-stage malware whose JAR payloads collect system information, add Microsoft Defender exclusions, and steal sensitive data. Distribution relies on SEO poisoning to outrank official sources, plus Discord, MediaFire, GitHub, and Minecraft hosting sites; nearly half of malicious URLs were Discord links. One fake site was built with the AI website builder Lovable, and McAfee blocked more than 6,300 access attempts to malicious sites.

The Hacker NewsAug 24, 17:41 UTC · 22d agoMalware in the wild