Microsoft discloses Active Directory remote code execution and denial-of-service flaws
Both Important-rated flaws need low privileges; the record does not show an active exploitation campaign.
Stories per day · 30 days
5 RSS
Relatedphp2shell7microsoft6privilege-escalation6webshell5windows5active-roles3exchange3firewall3fragnesia3identity3linux-kernel3one-identity3pan-os3patch-tuesday3saml3bronze-sandcastle2dll-sideloading2extortion2
56 stories, newest first · one card per story
Stories tagged #active-directory
Citrus ransomware uses VLESS, Sn00py, and LLM-written attack scripts
Kaspersky says the new group enters via contractor VPN or RDP logins, then tries Certighost and an old print-spooler bug.
One Identity ships Active Roles 8.6 with RSTS security fix
The July 27 release supersedes 8.3 through 8.5 and adds a REST API plus SAML 2.0 token support.
Microsoft November 2026 patches fix 1095 flaws, one exploited
Only CVE-2026-124194, an Outlook spoofing bug scored 6.5, is exploited; 48 of 64 critical issues are remote code execution.
2
Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
1
ARES AI Red Team Platform Automates 66 Attack Modules
Open-core ARES tool releases 66 MITRE ATT&CK modules for Active Directory and cloud red team testing.
2
Hackers Use ARTEX AI Agents to Automate Active Directory Attacks
Google and Mandiant report ARTEX used since late August 2026 in attacks across multiple sectors including government and tech.
1
Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
2
GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
1
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
1
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
1
Vendor guide lists five CJIS v6.1 priorities for criminal-justice agencies
Specops pitches MFA and password tools while recapping IA-2, IA-5 and account-review rules agencies already face.
Ransomware crews threatened employees' families at 37% of surveyed firms
Semperis surveyed 1,200 professionals at organizations already hit; 59% paid and 87% saw identity systems targeted.
Why Active Directory weaknesses stay open for years in teams with one or two admins
intcube led 27 municipalities through a 12-week program to harden Windows Server and Active Directory.
2
Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families
Semperis says 37% of successful ransomware attacks included threats against employees’ friends or relatives.
4
AI Used in 84% of Ransomware Attacks as Identity Infrastructure Comes Under Fire.
Semperis survey of 1,200 ransomware victims finds AI in 84% of incidents and identity systems widely targeted.
3